Skip to content

PCI Merchant Levels

LevelDiscoverMastercardVisaAmerican Express
1All merchants processing 6 Million or more card transactions annually on the Discover® network.

OR

Any merchant that Discover, in its sole discretion, determines should meet the Level 1 compliance validation and reporting requirements.

OR

All merchants required by another payment brand or acquirer to validate and report their compliance as a Level 1 merchant.
All Third Party Processors (TPPs)

OR

All Staged Digital Wallet Operators (SDWOs)

OR

All Digital Activity Service Providers (DASPs)

OR

All Token Service Providers (TSPs)

OR

All 3-D Secure Service Providers (3-DSSPs)

OR

All AML/Sanctions Service Providers

OR

All Installment Service Providers (ISPs)

OR

All Data Storage Entities (DSEs) and Payment Facilitators (PFs) with more than 300,000 total combined Mastercard and Maestro transactions annually

Merchants processing over 6 million Visa transactions annually across all channels or Global merchants identified as Level 1 by any Visa region
2.5 million or more American Express Card transactions per year (or if you’ve been selected a Level 1 by American Express)
2All merchants processing between 1 Million and 6 Million card transactions annually on the Discover network.

All DSEs and PFs with 300,000 or less total combined Mastercard and Maestro transactions annually

OR

All Terminal Servicers (TSs)3

1 to 6 million Visa transactions annually across all channels
50,000 to 2.5 million American Express Card transactions per year (Service providers: less than 2.5 million transactions)
3All other merchants

20,000 to 1 million Visa e-commerce transactions annuallyLevel 3 Designated: Less than 50,000 American Express Card Transactions per year and has been designated by American Express as being required to submit validation documents. (merchants only; does not apply to service providers). American Express will contact these designated merchants and provide them details for reporting their security status by submitting PCI validation documents.

Level 3: Less than 50,000 American Express Card transactions per year (merchants only; does not apply to service providers)
4
Merchants processing less than 20,000 Visa ecommerce transactions annually and all other merchants processing up to 1 million Visa transactions annually
Level EMV: 50,000 or more American Express Chip-enabled Card transactions per year with at least 75% made on an EMV-enabled (Chip-enabled) terminal capable of processing contact and contactless American Express transactions