Businesses that accept credit card payments must follow PCI compliance rules. But not every company faces the same requirements. The payment industry groups businesses into levels of PCI compliance based on how many card transactions they process each year.
Understanding the levels of PCI compliance helps you know what security checks and reporting your business must complete. A local shop that runs a few thousand transactions each year will not face the same requirements as a national retailer.
Your PCI level affects how you report compliance and how often your systems must be reviewed. If you accept card payments through retail credit card processing, automotive credit card processing, or a point of sale system, your business falls into one of the PCI compliance levels.
This blog explains how PCI levels work and how to identify the PCI level that applies to your business.
What Are PCI Levels?
PCI levels classify businesses based on the number of credit card transactions they process each year. Card brands use these levels to decide how businesses must report PCI compliance.
Many owners ask what PSI levels are. The correct term is PCI levels, which stands for Payment Card Industry levels.
These categories help payment processors apply the correct security requirements. They also help determine whether your business must complete security scans, self assessments, or independent audits.
The four PCI compliance levels range from Level 1 to Level 4. Level 1 applies to the largest businesses. Level 4 applies to most small businesses.
Your transaction volume across all payment channels determines your PCI level. That includes online transactions, phone payments, and payments processed through point of sale products.
The 4 PCI Compliance Levels
The payment industry uses four PCI compliance levels to classify merchants. Each level carries different validation requirements.
Level 1 PCI Compliance
Level 1 PCI compliance applies to merchants that process more than six million card transactions per year.
This level typically includes large retailers, national restaurant chains, and major ecommerce companies.
Businesses at this level must complete the most detailed compliance process. That often includes:
- Annual security audits by a qualified security assessor
- Quarterly network security scans
- Detailed reporting to payment processors
Level 1 PCI compliance focuses on large organizations that handle high transaction volumes and large amounts of cardholder data.
Level 2 PCI Compliance
Level 2 PCI compliance applies to businesses that process between one million and six million card transactions each year.
These merchants still handle large payment volumes but usually face fewer reporting requirements than Level 1 businesses.
Level 2 merchants generally must:
- Complete an annual Self Assessment Questionnaire
- Perform quarterly network scans if required
- Confirm compliance with their payment processor
Many growing retail chains and regional ecommerce companies fall into Level 2 PCI compliance.
Level 3 PCI Compliance
Level 3 PCI compliance applies to businesses that process between twenty thousand and one million online card transactions per year.
These businesses often run online stores or subscription based services.
Level 3 merchants usually complete:
- An annual Self Assessment Questionnaire
- Security scans for internet facing systems
Companies that process most transactions online often fall into this category.
Level 4 PCI Compliance
Level 4 PCI compliance applies to merchants that process fewer than twenty thousand online transactions each year or fewer than one million total card transactions.
Most small businesses fall into Level 4 PCI compliance. That includes local stores, service providers, and auto repair shops.
Level 4 merchants typically must:
- Complete a Self Assessment Questionnaire
- Follow PCI security standards for payment systems
- Work with a secure payment provider
Businesses using payment processing for small businesses through modern payment systems often complete these steps as part of their payment setup.
Which PCI Level Applies to Your Business?
To determine your PCI level, review your total annual card transaction volume across all payment channels.
Consider these factors:
- In store transactions using point of sale products
- Online credit card payments
- Phone payments entered manually
- Transactions processed through payment gateways
Most small retailers and service businesses fall into Level 4 PCI compliance because their annual transaction volume is lower.
For example:
- A retail shop using retail credit card processing
- An auto repair business using automotive credit card processing
- A small service company accepting card payments
These businesses usually process fewer than one million card transactions each year.
Even though Level 4 merchants face fewer reporting requirements, they must still follow PCI compliance standards to protect cardholder data.
Working with a trusted payment provider can help simplify PCI compliance tasks. Providers such as Simpay support secure payment processing and help businesses manage compliance requirements.
If you are unsure which PCI level applies to your business, speak with an expert at Simpay. They can review your transaction volume and help you maintain PCI compliance with secure payment tools.
