PCI Merchant Level Calculator

What a PCI merchant level is

A merchant level is a card brand's label for how much of its card traffic you handle, and it decides how you prove PCI compliance each year. The PCI Security Standards Council writes the standard, but each card brand runs its own program: “which entities need to validate compliance, validation levels, whether an entity is eligible to complete a Self-Assessment Questionnaire (SAQ) or must complete a Report on Compliance (ROC), and any fines or penalties.”

Your acquirer assigns your merchant level from your yearly card volume for each card brand. Visa, Mastercard and Discover set their own thresholds; ask your acquirer which level you are. Of the 4 brands here, 3 print their thresholds on their own sites, and those are the only ones this calculator applies. Visa's page says your total Visa volume over 12 months sets your level and publishes no numbers, so its line always reads “ask your acquirer”.

How to use the calculator

1. Pull 12 months of processor statements or your gateway's report, split by card brand. Count transactions, not money: every level threshold here is a number of transactions.
2. Enter each brand's yearly total across every channel. For Visa and Mastercard, also enter how many of those were e-commerce; Mastercard's Level 3 is counted on e-commerce alone.
3. Read each brand's level, why it landed there, and what that brand asks you to send.
4. Copy or print the receipt and take it to your acquirer. Then find your questionnaire with the SAQ type finder.

Worked example: a shop with a till and a web store

The calculator opens on this shop. Its counts are made up for the example; the thresholds are the brands' own. The shop lands on the same level number with every brand that publishes one, each for its own reason, and Visa gives no number at all.

Mastercard is the one to watch: this shop's Mastercard total is far below one million, but its online sales alone pass 20,000, and that is Mastercard's Level 3 test. A shop with the same total and fewer web orders would be Level 4.

What your level means for validation

Depending on the card brands' programs, an entity either has a detailed assessment documented in a Report on Compliance or self-assesses with an SAQ. An AOC goes with either one, and “Quarterly submission of an ASV scan report … may also be required.” In practice, Level 1 with a brand that publishes levels means a ROC; the lower levels mean an SAQ, sometimes only when the brand asks.

• ROC. An assessor's report, signed off in an Attestation of Compliance. Mastercard also requires a QSA or ISA at Level 2 on SAQ A, SAQ A-EP or SAQ D; the PCI consultants and QSA firms compared page shows who does what.
• SAQ. You answer the questionnaire that fits how you take cards (see PCI SAQ types explained) and work through it with the PCI compliance checklist.
• Scans. Discover lists quarterly ASV scans at every level; American Express asks for them “with certain SAQ types.” What an ASV scan is covers the rest.

“PCI SSC does not define compliance requirements for any organization or set compliance validation responsibilities … Compliance validation requirements are set by brands, acquirers, payment facilitators, etc.” Before you start an SAQ, confirm with the organization you submit it to (usually your acquirer, the merchant bank) that you are eligible for it.

Programs that can lighten the paperwork

Visa's Technology Innovation Program can remove the requirement to verify PCI DSS compliance “when at least 75% of yearly transactions originate through EMV chip-enabled terminals, a validated point-to-point encryption solution or integrated industry-standard tokenization solution meeting EMVCo Tokenization Specification.” Eligibility is Visa's and the acquirer's call.

Discover runs a similar Security Compliance Innovation Program for merchants that, among other criteria, have “met at least 75% of merchant’s transactions originated from using security technologies” such as chip terminals, a validated P2PE solution or EMVCo tokenization. Merchants with an outside acquirer ask that acquirer whether they qualify.

Where each brand says so

Each brand's table, in its own terms, as read on its own site. Mastercard also puts a merchant at Visa's level when it meets Visa's criteria, and Discover puts any merchant another brand or acquirer treats as Level 1 at its own Level 1; the calculator applies the second rule when your Mastercard or American Express count makes you Level 1.

Visa's own rulebook says acquirers report their merchants' PCI DSS status to Visa “at least every 6 months” and that “The criteria for each Merchant’s level is set out in the Account Information Security (AIS) Program Guide,” which is not linked from Visa's compliance page. That is why the Visa line asks your acquirer.

After you know your level

Your level tells you what to send; your SAQ type tells you what to answer. The yearly PCI compliance loop puts the two in order, and if a ROC or an assessor is now on the cards, the PCI compliance cost calculator adds up what that year costs you. A PCI non-compliance fee on a merchant statement comes from the acquirer or processor under its card-brand program, never from the PCI Security Standards Council; PCI compliance fees explained covers who bills what.