Also called: Merchant levels, PCI DSS Level 1 Compliance, PCI Level 1
What PCI compliance levels are
PCI compliance levels group merchants by card transaction volume and help determine how you validate PCI DSS compliance. Common merchant bands are Level 1, more than 6 million transactions a year or a prior breach that caused an Account Data Compromise event; Level 2, 1 million to 6 million; Level 3, 20,000 to 1 million; and Level 4, fewer than 20,000. Card-brand criteria can differ, so these bands do not settle every merchant’s classification.
Volume is counted over 12 months, per acquiring region and per card scheme. If you accept payment cards, you must validate PCI DSS compliance annually. Your level affects the validation method, not whether the security standard applies. PCI DSS v4.0.1 is the current version as of 2026.
Your PCI level changes how you validate compliance, not the security standard your business must meet.
How your level affects validation
Your validation could involve a Self-Assessment Questionnaire (SAQ) or a Report on Compliance (ROC). A ROC is completed by a Qualified Security Assessor (QSA) or an appropriately qualified internal security resource. A quarterly scan by an Approved Scanning Vendor (ASV) depends on your payment setup, so do not assume a level alone tells you whether scans are required.
A prior breach that results in an Account Data Compromise event is a Level 1 criterion in the cited merchant-level guidance, even if your transaction count is lower. Your level sets the validation route; PCI DSS requirements still apply to the systems and processes that handle card data.
What it means for your costs
Your PCI level does not set interchange, network assessments, or your processor markup. The direct cost comes from the work needed to validate and maintain compliance, such as assessment, scanning, and remediation. The research provides no reliable standard dollar amount for those costs.
Processors commonly bill a monthly PCI non-compliance fee when you have not validated compliance. That is a processor charge, not a card-network fee. A breach can also bring investigation and remediation costs, and the transaction-volume level alone does not predict the total.
Where it appears on your statement
Look for a line named “PCI non-compliance fee” or similar. The exact label varies, so compare the charge across months and check whether it stops after your compliance status is validated. The level itself is not usually a processing-fee line, and the statement does not prove that your security controls meet PCI DSS.
What you can actually change
- Confirm your classification. Get your assigned level and the transaction count used to set it. Confirm whether the count is separated by acquiring region and card scheme.
- Complete annual validation. Find out whether you need an SAQ or ROC, and whether your payment setup requires quarterly ASV scans. Keep the submitted validation record.
- Review recurring fees. Search your statement for a PCI non-compliance fee. Once your status is validated, verify whether the monthly charge is removed.
- Limit card-data exposure. Map where card data enters or is stored, and remove unnecessary storage. Fewer systems handling card data can reduce the work involved in protecting and validating them.
Frequently asked questions
How do I know my PCI compliance level?
Start with your annual card transaction count, separated by acquiring region and card scheme. Common merchant bands range from Level 4 below 20,000 transactions to Level 1 above 6 million, but card-brand criteria differ. Get the level assigned to your business and the count used to classify it.
Does a small business still need PCI compliance?
Yes. Accepting payment cards means you must validate PCI DSS compliance annually. A lower transaction volume affects the validation route, such as whether an SAQ is appropriate; it does not remove the security requirements.
Does a higher PCI level mean higher processing fees?
No. PCI levels determine validation requirements, not interchange or card-network assessments. Higher levels can require more assessment work, and a processor may bill a monthly PCI non-compliance fee when your business has not validated compliance.
What is the difference between an SAQ and a ROC?
An SAQ is a self-assessment questionnaire completed by your business. A ROC is a Report on Compliance completed by a Qualified Security Assessor or an appropriately qualified internal security resource. Your required validation method depends on your classification and applicable requirements.