PCI Level 1 service provider: what it means, and what to ask

What a PCI Level 1 service provider is

Two words carry the claim. “Service provider” is a role the Council defines, and “Level 1” is a rank each card brand assigns. Start with the first:

The same entry goes wider: it also covers “companies that provide services that control or could impact the security of CHD and/or SAD,” such as managed firewall and hosting providers. So your processor, your gateway, the company that hosts your checkout and the one that runs your firewall can all be service providers to you. A phone company that only carries the line is not, for that service.

The level is not the Council's. Its Quick Reference Guide says each card brand runs its own compliance program, deciding “which entities need to validate compliance, validation levels, whether an entity is eligible to complete a Self-Assessment Questionnaire (SAQ) or must complete a Report on Compliance (ROC), and any fines or penalties.” Visa, Mastercard and American Express each publish two levels for service providers. Level 1 is the top one, and at all three it means the same kind of proof: an independent assessor's full review every year, written up in a Report on Compliance, not a questionnaire the provider fills in itself.

PCI DSS service provider levels, brand by brand

Each brand draws its own line, and they do not count the same thing. Visa counts a provider's Visa transactions. American Express counts “the sum of volume submitted by the Service Provider and Entities' Service Provider to whom they provide Services.” Mastercard mostly counts nothing: it puts whole kinds of provider at Level 1 whatever their volume, and applies its transaction line only to a few.

Visa

Visa's Level 1 covers “VisaNet® processors or any service provider that stores, processes and/or transmits over 300,000 Visa transactions annually.” Its requirement: “Complete the annual on-site PCI data security assessment and submit an executed attestation of compliance (AOC), signed by both the service provider and the qualified security assessor (QSA) to Visa.” Below that line, a Level 2 provider may sign a self-assessment, SAQ D, instead. Visa adds one condition that matters for the lists further down: “PCI DSS compliance validation by a QSA is required before a service provider can be listed on the Visa Global Registry of Service Providers.”

Mastercard

Mastercard names its Level 1 by kind: “All Third-Party Processors (TPPs),” “All Merchant Payment Gateways (MPGs),” and all staged digital wallet operators, digital activity, business payment, token, 3-D Secure and installment service providers. Data storage entities, payment facilitators and AML/sanctions providers join them only with “more than 300,000 total combined Mastercard and Maestro transactions annually.” Its Level 1 requirement is an “Annual PCI assessment resulting in the completion of a Report on Compliance (ROC),” and its footnote says the ROC is “conducted by an appropriate PCI SSC-approved QSA.” So a payment gateway sits at Mastercard's Level 1 from its first day of business.

American Express

American Express sets its line at 2.5 million card transactions a year, “or any Service Provider that American Express otherwise assigns a Level 1.” Level 1 sends a Report on Compliance AOC; Level 2 an SAQ AOC. The policy also says “Service Providers are not eligible for STEP,” the program that lightens a merchant's paperwork.

Service provider levels vs merchant levels

Merchant levels and service provider levels share a name and nothing else. Your merchant level comes from the cards you take for your own sales, brand by brand, and most small shops sit at the bottom of every ladder. A provider's level comes from what it handles for everyone it serves. The two ladders even set Level 1 in different places: Mastercard's merchant Level 1 starts above six million transactions a year, its service provider line at 300,000, and most provider types skip the count entirely.

So a processor's Level 1 never passes down to you. You still work out your own level with your acquirer (the PCI merchant level calculator reads each brand's published thresholds), and you still pick your own questionnaire from the merchant SAQ types. The service provider form is a different document: the Council's guide says “Self-Assessment Questionnaire D for Service Providers is the ONLY SAQ option for service providers,” and at Visa, Mastercard and American Express only a Level 2 provider may use it. A merchant who stores card numbers lands on the merchant version, SAQ D for merchants, which is its own subject.

The Level 1 path: QSA, ROC and AOC

Behind every honest “Level 1” claim sits the same yearly cycle. The Council's guide describes the people and papers; the brands' pages above say Level 1 cannot skip any of them.

1. 01

   Hire a QSA company

   An independent firm on the Council's list does the assessment. The provider cannot sign it off alone.

2. 02

   The assessment, written up as a ROC

   Environment, samples and how each requirement was tested, on the Council's mandatory ROC template.

3. 03

   The service-provider-only requirements

   Extra requirements apply to providers, including Requirement 12.9: supporting customers' PCI DSS compliance.

4. 04

   A signed AOC, to the brands

   The provider and the QSA sign the Attestation of Compliance. Visa receives it; Mastercard gets it yearly through the Mastercard customer that registered the provider.

5. 05

   The AOC, to customers who ask

   The Council expects a provider with an AOC to hand it to customers on request, with evidence of what the assessment covered.

Source: PCI DSS v4.x Quick Reference Guide, pp. 11–12, 17–19; Visa and Mastercard service provider levels, read on 2026-11-01

The QSA

“Qualified Security Assessors (QSAs) are independent security organizations that have been qualified by the PCI SSC to assess and validate an entity's adherence to PCI DSS.” The Council publishes the QSA list; on 22 October 2026 it showed 418 companies. The assessor's name travels with the result: it is printed on the provider's AOC and on both brand lists below.

The ROC

“The ROC contains more detailed information than the Self-Assessment Questionnaires, including information about the entity's environment, the samples the assessor selected, and how each requirement was assessed and validated.” It is the long document. What the Council expects a provider to hand its customers on request is the summary on top of it.

The AOC

“An Attestation of Compliance (AOC) is a declaration of the results of a PCI DSS assessment, completed and signed by the entity that underwent the assessment and the QSA company (if involved).” For a Level 1 provider the QSA is always involved, so both signatures should be there. The Council also expects the provider to prove scope: a provider that had its own assessment “is expected to provide sufficient evidence to its customers to verify that the scope of the TPSP's PCI DSS assessment covered the services applicable to the customers.” How to read that document part by part is in the PCI AOC guide.

The PCI Level 1 service provider lists

The Council's own program listings cover assessors and validated solutions. For companies, the two public lists come from the card brands, and both are built on the same Level 1 paperwork.

Visa's Global Registry of Service Providers

Visa calls its registry “the payment industry's designated source for information on registered and compliant agents that provide payment-related services to Visa clients and merchants,” and lists a provider only after “PCI DSS compliance validation by a QSA.” A listing shows the validation, a valid-through date and the assessor; a provider whose papers run more than 91 days late is removed. How to read a registry row is in the AOC guide's provider section.

Mastercard's SDP compliant service provider list

A company appears on it when it is registered as a service provider by a Mastercard customer and Mastercard has received its ROC AOC from a QSA. The list is a PDF, “updated monthly”; the edition dated 16 October 2026 runs to 71 pages, one line per provider with its region, AOC date and assessor. Dates printed in yellow are 1 to 60 days past due, red 61 to 90, and “After 90 days past due, the registered service provider's name is removed from the List.”

Same provider, two lists, two dates

The lists do not print the same date. Visa shows when the validation runs out; Mastercard shows the date on the last AOC. Two processors, read on each:

Both lists name Coalfire Systems as the assessor for these two. The registered company name is often the parent (Square appears under Block, Inc.), so search the legal name on your contract, not the brand on the website.