PCI DSS Compliance for Merchants
All merchants fall in to one of four levels, with varying degrees of obligation under the PCI standard. As a merchant you can see where you fall in to the scheme using the guide below.
Level 1 PCI DSS Compliance for Merchants
Level 1 PCI Merchants are:
- Any merchant – regardless of acceptance channel – processing over 6,000,000 payment card transactions per year
- Any merchant that has suffered a hack or an attack that resulted in an account data compromise
- Any merchant that the payment card vendor, at its sole discretion, determines should meet the Level 1 merchant requirements to minimize risk to the payment card system /li>
- Any merchant identified by any other payment card brand as Level 1
Validation for Level 1 PCI Merchants
Annual On-Site Security Audit and Quarterly Network Scans must be performed by an independent Qualified Security Assessor (QSA), independant Approved Scan Vendor or internal audit if signed by an Officer of the Company.
Level 2 PCI DSS Compliance for Merchants
Level 2 PCI Merchants are:
- Any merchant processing 1,000,000 to 6,000,000 payment card transactions per card per year
Validation for Level 2 PCI Merchants
Annual PCO Self Assessment Questionnaire and Quarterly Network Scans must be performed by the merchant or an independent Approved Scan Vendor.
Level 3 PCI DSS Compliance for Merchants
Level 3 PCI Merchants are:
- Any e-commerce merchant processing 20,000 to 1,000,000 payment card transactions per card per year
Validation for Level 3 PCI Merchants
Annual PCO Self Assessment Questionnaire and Quarterly Network Scans must be performed by the merchant or an independent Approved Scan Vendor.
Level 4 PCI DSS Compliance for Merchants
Level 4 PCI Merchants are:
- All merchants regardless of acceptance channel
Validation for Level 4 PCI Merchants
Annual PCO Self Assessment Questionnaire and Quarterly Network Scans must be performed by the merchant or an independent Approved Scan Vendor.
While compliance is mandatory for Level 4 PCI Merchants, validation is optional but strongly recommended.
