What Is PCI Compliance? Merchant Levels, SAQ Types, and QSAs
PCI compliance means meeting the Payment Card Industry Data Security Standard (PCI DSS), the security standard for every business that stores, processes, or transmits payment card data, and proving it each year to your acquiring bank or the card brands. The PCI Security Standards Council (PCI SSC) writes the standard, now version 4.0.1, and the card brands and acquirers decide who must validate and how. Your merchant level, set by your annual transactions with each brand, decides the document: Level 1 merchants, above 6 million Visa transactions a year, need a Report on Compliance (ROC) from a Qualified Security Assessor (QSA), and most other merchants complete the Self-Assessment Questionnaire (SAQ) that matches how they accept cards.
Who sets PCI DSS and who enforces it?
The PCI SSC writes and maintains PCI DSS, and the card brands enforce it. The Council published PCI DSS v4.0.1 on June 11, 2024 as a limited revision with no added or deleted requirements, and it retired v4.0 on December 31, 2024. Its FAQs state that the Council will not replace the brands' compliance programs and imposes no consequences for non-compliance. Each brand sets its own levels and runs its own enforcement.
For a merchant, the enforcer you deal with is the acquirer, the bank that contracts with you to accept card payments. PCI SSC tells merchants to ask their acquiring bank how to validate and tells service providers to ask the brands, and Visa's compliance page says acquirers must make their merchants validate at the right level and pay any assessment Visa levies. A merchant that stores, processes, or transmits card data for other businesses counts as a service provider too.
What are the PCI compliance levels?
PCI compliance levels rank merchants by annual transactions with each card brand, and the level decides the validation document. Visa and Mastercard share four thresholds, and a merchant that meets Visa's criteria for a level takes that level with Mastercard too, even when its Mastercard volume alone would place it lower. The table combines Visa's published merchant levels with Section 2.2.2 of Mastercard's Security Rules and Procedures (August 4, 2026 edition), as of October 2026.
| Level | Visa transactions per year | Mastercard and Maestro transactions per year | What you submit |
|---|---|---|---|
| Level 1 | More than 6 million, or a global merchant that any Visa region rates Level 1 | More than 6 million, or meets Visa's Level 1 criteria, or designated by Mastercard | Annual ROC by a QSA (Mastercard also accepts an ISA), quarterly ASV scans, and an Attestation of Compliance (AOC) |
| Level 2 | 1 million to 6 million | More than 1 million, up to 6 million | Annual SAQ, quarterly ASV scans, and an AOC; Mastercard requires a QSA or ISA to validate SAQ A, A-EP, or D |
| Level 3 | 20,000 to 1 million e-commerce | More than 20,000, up to 1 million e-commerce | Annual SAQ and quarterly ASV scans; no validation to Mastercard required |
| Level 4 | Fewer than 20,000 e-commerce, and all others up to 1 million | All other merchants | Set by the acquirer for Visa; for Mastercard, compliance with no validation to Mastercard unless a law requires it |
A compromise moves merchants up the table. Visa can raise a compromised merchant's level, and Mastercard can designate a merchant with a confirmed compromise as Level 1, which changes the path from a self-assessment to a ROC, the largest single jump in PCI compliance cost. Mastercard's Site Data Protection page adds that acquirers report the status of their Level 1 and Level 2 merchants twice a year.
Where American Express and Discover differ
American Express and Discover count their own transactions. American Express sets Level 1 at 2.5 million or more American Express transactions a year and Level 2 at 50,000 to 2.5 million, both with annual validation and quarterly network scans, and merchants below 50,000 submit validation documents when American Express designates them. Discover uses three levels: 6 million or more Discover Network transactions, 1 million to 6 million, and all other merchants, which submit an SAQ-based AOC when Discover asks. A merchant with 3 million transactions on each brand is Level 2 for Visa and Level 1 for American Express, so check each brand you accept.
Service provider levels
Visa and Mastercard draw the service provider line at 300,000 transactions a year. Visa's Level 1 covers VisaNet processors and any service provider above 300,000 Visa transactions, which need an annual ROC by a QSA, and all others are Level 2 and complete an annual SAQ. Mastercard puts each third-party processor, payment gateway, token service provider, and 3-D Secure service provider at Level 1 regardless of volume, plus data storage entities and payment facilitators above 300,000 transactions. A service provider that self-assesses uses SAQ D for Service Providers, the only SAQ open to service providers.
The 12 PCI DSS requirements
PCI DSS v4.0.1 organizes its controls under 12 principal requirements, and each SAQ or ROC tests some or all of them. The titles below are the standard's own, from the PCI SSC document library.
| Requirement | Title in PCI DSS v4.0.1 | What it asks for |
|---|---|---|
| 1 | Install and Maintain Network Security Controls | Firewalls and similar controls around the cardholder data environment (CDE) |
| 2 | Apply Secure Configurations to All System Components | Hardening standards, with vendor default passwords changed or removed |
| 3 | Protect Stored Account Data | Minimal retention, no sensitive authentication data after authorization, and unreadable stored card numbers |
| 4 | Protect Cardholder Data with Strong Cryptography During Transmission Over Open, Public Networks | Strong encryption wherever card data crosses public networks |
| 5 | Protect All Systems and Networks from Malicious Software | Anti-malware, plus anti-phishing mechanisms under 5.4.1 |
| 6 | Develop and Maintain Secure Systems and Software | Secure development, patching, and payment page script control under 6.4.3 |
| 7 | Restrict Access to System Components and Cardholder Data by Business Need to Know | Least privilege, with user access reviewed every six months |
| 8 | Identify Users and Authenticate Access to System Components | Unique IDs, 12-character passwords, and multi-factor authentication (MFA) for all CDE access under 8.4.2 |
| 9 | Restrict Physical Access to Cardholder Data | Facility controls, media handling, and tamper checks on card readers |
| 10 | Log and Monitor All Access to System Components and Cardholder Data | Audit logs, automated log review under 10.4.1.1, and 12 months of log history |
| 11 | Test Security of Systems and Networks Regularly | Quarterly scans, annual penetration and segmentation tests, and payment page tamper detection |
| 12 | Support Information Security with Organizational Policies and Programs | Policies, risk analyses, awareness training, third-party oversight, and incident response |
What are the PCI DSS SAQ types?
An SAQ is the self-assessment form a merchant or service provider completes when its acquirer and the brands allow self-validation. PCI SSC publishes ten for v4.0.1, and each covers only the requirements that fit one way of accepting cards, so the narrowest SAQ you qualify for sets how much of the standard you evidence.
| SAQ | Who is eligible | Typical example |
|---|---|---|
| SAQ A | Card-not-present merchants that outsource all card data functions to PCI DSS compliant providers; the provider serves each element of the payment page by redirect or iframe | Checkout redirects to a processor's hosted page |
| SAQ A-EP | E-commerce merchants that outsource processing but whose own page serves the payment form or controls the redirect | A direct post or JavaScript checkout form |
| SAQ B | Imprint machines or standalone dial-out terminals only, with no electronic storage | A countertop terminal on a phone line |
| SAQ B-IP | Standalone PCI-approved terminals connected to the processor over IP, with no electronic storage | A countertop terminal on its own network link |
| SAQ C | A payment application system connected to the internet, with no electronic storage | A restaurant point-of-sale system |
| SAQ C-VT | Card data typed one transaction at a time into a provider-hosted virtual terminal in a web browser, with no card reader and no electronic storage | A phone-order desk using a processor's web terminal |
| SAQ P2PE | Only hardware terminals in a PCI-listed point-to-point encryption (P2PE) solution, with no electronic storage | Terminals managed through a validated P2PE solution |
| SAQ SPoC | A phone or tablet with a secure card reader that is part of a PCI-validated SPoC solution | A field service team taking payments on tablets |
| SAQ D for Merchants | Any merchant that fits no other SAQ, including any that stores card data electronically | An online retailer storing cards for repeat orders |
| SAQ D for Service Providers | Service providers that a card brand allows to self-assess | A hosting provider below the Level 1 thresholds |
SAQ A changed in this cycle. On January 30, 2025, PCI SSC published a revised SAQ A that removed Requirements 6.4.3 and 11.6.1 and the 12.3.1 risk analysis behind them, and added an eligibility criterion: the merchant confirms its site is not susceptible to attacks from scripts that could affect its e-commerce systems. The revision took effect on March 31, 2025. FAQ 1588 applies the criterion only to merchants that embed a provider's iframe, which meet it with their own script controls or with confirmation from their compliant provider, and redirect merchants fall outside it. FAQ 1604, published in June 2026, confirms that SAQ A merchants still owe quarterly scans by an Approved Scanning Vendor (ASV) under Requirement 11.3.2.
How to pick the right SAQ: BD Emerson's decision rule
Trace where card data travels in each payment channel before you open a questionnaire. BD Emerson works through five steps, in this order:
- Confirm your level with each brand you accept. If any brand rates you Level 1, or you are a Level 1 service provider, you need a ROC, and the SAQ question ends.
- List your channels, such as e-commerce, card present, and mail and telephone orders, and map each data flow from customer to processor, including any system that could change it.
- Look for stored card data. A database, spreadsheet, call recording, or backup that holds card numbers puts you on SAQ D for Merchants until that data is gone.
- Match each channel to the narrowest SAQ whose eligibility criteria it meets in full. A criterion met in part is a criterion failed.
- If channels land on different SAQs, ask your acquirer whether it wants one SAQ per channel or one SAQ D for all of them, and keep its answer in writing.
Step 3 carries the most weight, because one stored card number rules out all SAQs except D. Step 4 is where scope reduction pays: moving a checkout from a self-hosted form to a provider's hosted page moves that channel from SAQ A-EP or D to SAQ A.
ROC vs AOC vs SAQ: what each document does
The ROC and the SAQ are the two ways to document an assessment, and the AOC is the signed declaration of the result. PCI SSC describes the AOC as the document that attests to your compliance status.
| Document | What it is | Who completes it | Where it goes |
|---|---|---|---|
| Report on Compliance (ROC) | Full assessment report on PCI SSC's ROC Template, with a finding for each applicable requirement | A QSA, or an ISA where the brand accepts one | Kept by the entity and provided to the acquirer or brand on request |
| Self-Assessment Questionnaire (SAQ) | Self-assessment of the requirements for one way of accepting cards | The merchant or service provider, plus a QSA or ISA where a brand requires one | The acquirer, with the AOC |
| Attestation of Compliance (AOC) | Declaration of the ROC or SAQ result | Signed by an executive officer of the entity, plus the QSA or ISA when one performed the assessment | Merchants send it to the acquirer; service providers send it to the brands |
What is a PCI QSA? QSA vs ISA vs ASV
A PCI QSA works full time for a PCI SSC validated QSA company and is authorized to perform PCI DSS assessments and prepare the reports brands and acquirers require. An Internal Security Assessor (ISA) works for a qualified ISA sponsor company and assesses its own employer, and an ASV runs the external scans in Requirement 11.3.2.
| Role | Who it is | What it does | When you need one |
|---|---|---|---|
| QSA | Full-time employee of a validated QSA company, trained and tested by PCI SSC | Tests controls, samples systems, writes the ROC, and signs the AOC | Each year for Level 1 merchants and service providers, and for Mastercard Level 2 merchants on SAQ A, A-EP, or D unless an ISA validates |
| ISA | Employee of a qualified ISA sponsor company, trained by PCI SSC | Assesses its employer and validates its SAQs where a brand accepts that | When your brands accept ISA-led validation, as Mastercard does for Levels 1 and 2 |
| ASV | Scanning company on PCI SSC's ASV list | Runs external vulnerability scans and issues pass or fail reports | Each quarter, whenever Requirement 11.3.2 applies, SAQ A included |
Check any QSA company against PCI SSC's QSA list before you sign. Penetration testers are a separate role: Requirements 11.4.2 and 11.4.3 call for a qualified internal resource or a qualified external third party with organizational independence, and the tester does not need to be a QSA or an ASV. BD Emerson prepares companies for the assessment and tests their environments. We are not a QSA company, we do not sign Reports on Compliance, and we are not an ASV. We scope the CDE, assess gaps, remediate, prepare SAQ and ROC evidence for your QSA, and perform network penetration tests and segmentation tests. Our guide to internal vs external penetration testing explains what each test proves.
How to tell which path your acquirer expects
Ask your acquirer in writing which level it assigns you and which documents it wants, because the acquirer sets your requirements and receives your AOC. Then check four conditions that change the answer.
First, another brand may rate you higher: Mastercard applies your Visa level when it is higher, and American Express starts Level 1 at 2.5 million of its own transactions. Second, you may qualify for a waiver. Visa's Technology Innovation Program lets eligible Level 1 and Level 2 merchants skip annual validation when at least 75 percent of transactions run through chip terminals or a PCI-validated P2PE solution, with no stored sensitive authentication data and no breach, and Visa's TIP application says those merchants must still comply with PCI DSS. Mastercard's Validation Exemption Program, in Section 2.2.4 of its rules, works in a similar way and excludes merchants that sell mainly through e-commerce without EMV tokens or through mail and telephone orders. Third, Mastercard's Level 2 rule brings a QSA or ISA into the SAQ. Fourth, a past compromise lets Visa and Mastercard raise your level. If the acquirer's answer differs from the brand tables, follow the acquirer, since its merchant agreement binds you, and ask which brand rule it applies.
How often do you have to validate PCI compliance?
You validate once a year with a new ROC or SAQ and a signed AOC, and several requirements run on shorter clocks. Visa requires service providers to demonstrate compliance at least every 12 months, and Discover sets the AOC due date one year after the prior validation.
| Activity | Frequency | Requirement |
|---|---|---|
| ROC or SAQ, with a signed AOC | Every 12 months | Brand validation programs |
| External ASV scans | At least once every three months, and after significant changes | 11.3.2, 11.3.2.1 |
| Internal vulnerability scans | At least once every three months, with authenticated scanning | 11.3.1, 11.3.1.2 |
| Internal and external penetration tests | At least once every 12 months, and after significant changes | 11.4.2, 11.4.3 |
| Segmentation tests | Every 12 months for merchants, every six months for service providers | 11.4.5, 11.4.6 |
| Payment page tamper detection | At least once every seven days, or as a targeted risk analysis sets | 11.6.1 |
| Scope confirmation | Every 12 months, and every six months for service providers | 12.5.2, 12.5.2.1 |
| Security awareness training | At hire and at least once every 12 months | 12.6.3 |
One exception applies to the first year. Under the applicability notes for Requirement 11.3.2, an initial assessment does not need four passing quarterly scans if the latest scan passed, a documented process requires quarterly scanning, and rescans show the earlier findings fixed. From the second year, each quarter needs a passing scan.
Frequently asked questions
What is PCI compliance in simple terms? PCI compliance means your business meets PCI DSS, the security standard the card brands require of anyone who stores, processes, or transmits card data, and proves it each year. Merchants prove it to their acquiring bank with a Self-Assessment Questionnaire or a Report on Compliance plus a signed Attestation of Compliance, and most add quarterly scans by an Approved Scanning Vendor.
Who decides my PCI merchant level? Your acquirer assigns your level from each card brand's thresholds and your transactions over the past 12 months. Visa and Mastercard both start Level 1 above 6 million transactions a year, and Mastercard applies your Visa level when it is higher. American Express and Discover count their own transactions on their own scales.
What is the difference between PCI Level 1 and Level 2? Level 1 merchants, above 6 million Visa or Mastercard transactions a year, validate with an annual Report on Compliance from a Qualified Security Assessor, and Mastercard also accepts an Internal Security Assessor. Level 2 merchants, with 1 million to 6 million, complete an annual SAQ, and Mastercard requires a QSA or ISA to validate SAQ A, A-EP, or D.
Do small businesses have to be PCI compliant? Yes. PCI DSS applies to all merchants that accept cards, whatever their size. Most small merchants sit at Level 4, where Visa leaves validation to the acquirer and Mastercard requires compliance without validation to Mastercard unless a law requires it. Your acquirer can still require an annual SAQ and quarterly scans under your merchant agreement.
Which SAQ applies if I use a hosted payment page? A hosted payment page points to SAQ A when the provider serves each element of the payment page and no card data touches your systems. Redirect merchants fall outside the script criterion PCI SSC added in January 2025. Iframe merchants must confirm their site is protected from script attacks, and both still owe quarterly ASV scans.
What does a PCI QSA do? A Qualified Security Assessor works for a PCI SSC qualified QSA company and is authorized to assess merchants and service providers against PCI DSS. The QSA tests your controls, samples your systems, writes the Report on Compliance, and signs the Attestation of Compliance. Level 1 merchants and Level 1 service providers need one each year.
If you need to confirm your level, choose the narrowest SAQ you qualify for, or prepare for a QSA, our PCI DSS compliance consulting team can map your card data flows, test the segmentation that keeps systems out of scope, and assemble the evidence your acquirer or QSA will ask for.
About the author
