Payment Certification Levels
A practical guide to EMVCo L1 / L2 / L3 terminal certifications, PCI DSS merchant compliance tiers, and the standards that govern every card-present transaction.
PCI DSS Merchant Compliance Levels
The Payment Card Industry Data Security Standard (PCI DSS) defines four merchant tiers based on annual transaction volume. The level determines the validation method required — from a simple SAQ to a full on-site audit by a Qualified Security Assessor.
Also applies to any merchant that has experienced a data breach, regardless of volume.
- Annual on-site audit by a QSA (Qualified Security Assessor)
- Report on Compliance (ROC) submitted to acquirer
- Quarterly network scan by an ASV (Approved Scanning Vendor)
- Annual penetration test
- Attestation of Compliance (AOC) form
- Annual SAQ (Self-Assessment Questionnaire)
- Quarterly ASV network scan
- QSA audit may be required by some networks
- AOC form
- Annual SAQ
- Quarterly ASV network scan
- AOC form
- Annual SAQ (required by most acquirers)
- Quarterly ASV scan (recommended)
- AOC form (acquirer-dependent)
SAQ Types at a Glance
| SAQ | Who it applies to | Questions |
|---|---|---|
A | Card-not-present, fully outsourced payment page (iFrame / redirect) | ~22 |
A-EP | E-commerce site that partially controls the payment flow | ~191 |
B | Card-present, imprint-only or standalone dial-out terminals | ~41 |
B-IP | Standalone IP-connected terminals (no electronic cardholder data) | ~83 |
C | POS with payment app connected to internet; no storage of CHD | ~160 |
C-VT | Virtual terminal on a dedicated computer; no electronic CHD storage | ~73 |
D | All other merchants; service providers use D-SP | ~329 |
P2PE | Merchants using a PCI-validated P2PE solution | ~35 |
Related Tools
Use these tools to work with the cryptographic primitives that underpin terminal and card security.
Common questions
What are the PCI DSS merchant levels?
The card brands set them by annual transaction volume. With Visa: Level 1 over 6 million transactions, Level 2 1–6 million, Level 3 20,000–1 million e-commerce transactions, Level 4 fewer than 20,000 e-commerce or up to 1 million other transactions. Level 1 needs an annual Report on Compliance; the others usually complete a Self-Assessment Questionnaire.
What are the PCI DSS service provider levels?
Level 1 service providers store, process or transmit more than 300,000 card transactions a year and need an annual Report on Compliance by a QSA; Level 2 providers handle fewer and may validate with SAQ D for service providers. Thresholds come from the card brands, not the PCI SSC.
Who decides a merchant’s PCI level?
The card brands and the merchant’s acquirer. A merchant that suffered a breach can be moved to Level 1 regardless of volume.