PCI compliance levels: Visa, Mastercard, Amex and Discover

PCI compliance levels are the tiers card brands use to decide how much proof a merchant owes that it follows the Payment Card Industry Data Security Standard (PCI DSS). Each brand sets its own levels, mostly by the number of its card transactions you process in a year. Visa uses three levels, Mastercard four, American Express four and Discover three. The level changes the paperwork, not the rules: every merchant follows the same standard, PCI DSS v4.0.1.

Most small businesses sit in the lowest level of every brand and validate once a year with a self-assessment questionnaire (SAQ). Below are each brand's thresholds, what each level has to file, two worked examples, and the counting mistakes that put merchants in the wrong tier. Everything is current as of October 2026.

Who sets PCI compliance levels?

The card brands do, and your acquirer applies them. The PCI Security Standards Council (PCI SSC) writes the standard and the SAQ forms, but it doesn't decide who validates or how. Its About Us page says that's up to the payment brands and acquirers, and it names American Express, Discover, JCB International, Mastercard and Visa as brands with their own compliance programs.

Visa puts the acquirer's role plainly: acquirers must ensure their merchants validate at the appropriate level and collect the required documents (Visa). In practice, your processor's PCI portal is where that happens.

What are the PCI compliance levels for each card brand?

Here are the thresholds as each brand publishes them. They count transactions, not dollars, and each brand counts only its own cards.

Sources: Visa, Mastercard, American Express and Discover.

A few details hide in that table. Visa merged its old Levels 3 and 4 into one Level 3 on April 25, 2024, without changing anyone's compliance requirements, so older guides that list a Visa Level 4 are out of date. Mastercard's Level 3 counts only e-commerce transactions. American Express sets much lower thresholds than the others. And Discover's Level 1 also covers merchants that another brand or an acquirer requires to validate as Level 1.

How each brand counts matters as much as the thresholds:

• Visa counts the corporate entity's total Visa transactions, including credit, debit and prepaid (Visa).
• Mastercard combines Mastercard and Maestro transactions.
• American Express counts volume across all the locations that roll up to your highest Amex merchant account.
• Discover says your level depends on your annual volume, your level with other payment brands and, in some cases, its own discretion.

What does each PCI level have to file?

Level 1 means an assessment and a Report on Compliance (ROC). Below that, it's usually an SAQ with its Attestation of Compliance (AOC), and at Mastercard's lowest levels, nothing goes to the brand at all.

Sources: Visa, Mastercard's Security Rules and Procedures, American Express and Discover. Discover also asks for an AOC every year unless it has formally agreed otherwise.

Mastercard's lower levels deserve a closer look. Its rules require validation to Mastercard only from Level 1 and Level 2 merchants and from service providers. Below that, the job sits with the acquirer: the same rules require acquirers to validate a risk management program covering their Level 3 and Level 4 merchants. Expect your acquirer to keep asking for your SAQ anyway, because Visa and Discover still want one at the lower levels.

Which PCI level is a typical small business?

Usually the lowest level at every brand, or one step above it. Two made-up businesses show how the counting works.

A family restaurant in Boise takes $1.4 million a year in card sales at a $35 average, or 40,000 transactions. Its mix is 50% Visa, 30% Mastercard, 12% American Express and 8% Discover.

An online shop in Atlanta ships 60,000 orders a year, all paid online: 45% Visa, 40% Mastercard, 10% Amex and 5% Discover. That's 27,000 Visa transactions (Level 3), 24,000 Mastercard e-commerce transactions (Mastercard Level 3, because it's over 20,000), 6,000 Amex transactions (Level 4) and 3,000 Discover transactions (Level 3).

Both businesses end up with the same basic job: a yearly SAQ for their acquirer. What differs is which SAQ, and that depends on how they take cards, not on their level. The restaurant's countertop terminals point one way, and the shop's hosted checkout points another. Our guide to what PCI compliance is has the full SAQ table.

Can your PCI compliance level change?

Yes, in two ways: you grow, or something goes wrong.

Growth is the predictable one. A business that passes 1 million Visa transactions in a year moves to Visa Level 2, and one that passes 50,000 Amex transactions moves to Amex Level 2, which brings mandatory SAQ and AOC filing with Amex. Recheck your counts every year, especially after opening locations or adding an online store.

A breach is the other. Discover says a merchant that suffers a breach involving Discover cardholder data may be moved to a higher level. Mastercard and American Express can both place a merchant in Level 1 at their discretion. And Visa's compromise rules list assessments for Level 3 merchants, effective February 9, 2025, of $5,000 for merchants with up to 100,000 annual transactions and $10,000 for those with 100,000 to 500,000 (Visa). A breach can raise your level and your costs at the same time.

What's the difference between PCI levels and SAQ types?

Levels decide how much proof you owe. SAQ types decide which questionnaire you fill in. They come from different bodies, and they're easy to mix up.

The card brands set levels. PCI SSC sets the SAQs, which it calls validation tools for SAQ-eligible merchants to report the results of their self-assessments (PCI SSC). Each SAQ fits a way of taking cards:

So "Level 3" doesn't tell you what to file, and "SAQ A" doesn't tell you your level. You need both. Our guides to point-to-point encryption and hosted payment pages explain how those setups shrink the questionnaire.

Does every PCI level follow the same standard?

Yes. A Level 4 merchant follows the same PCI DSS as a Level 1 merchant; it just proves it with less paperwork. PCI SSC says the standard is intended for all merchants regardless of size or transaction volume (PCI SSC).

Everyone uses the same version, too. Since v4.0 was retired on December 31, 2024, v4.0.1 is the only active one, and the requirements it had marked as future-dated became mandatory on March 31, 2025.

Common mistakes with PCI compliance levels

• Treating the lowest level as an exemption. It lowers the paperwork, not the obligation, and Mastercard says Level 4 merchants must still comply.
• Counting dollars instead of transactions. Every brand's threshold is a transaction count.
• Counting only credit cards. Visa includes debit and prepaid.
• Adding all the brands together. Each brand counts its own cards against its own table.
• Missing Mastercard's e-commerce tier. An online business can reach Mastercard Level 3 with as few as 20,001 online Mastercard sales.
• Assuming a PCI fee on your statement means you're compliant. Our guide to the PCI compliance fee explains what those charges usually cover.

How do you find your PCI level and validate?

Start from your own numbers, then confirm with your acquirer.

1. Pull 12 months of statements and total your transactions by brand. Count online transactions separately for Mastercard.
2. Compare each total with that brand's table above.
3. Ask your acquirer, through your processor, which level it has you in and what it wants each year.
4. Pick the SAQ that matches how you take cards, answer it honestly, and sign the AOC.
5. Book quarterly ASV scans if your SAQ or your level requires them.
6. Ask whether you qualify for relief. Visa's Technology Innovation Program removes the annual validation requirement for eligible merchants that run at least 75% of their transactions through chip terminals, validated P2PE or EMVCo tokenization (Visa).

The levels work the same way for merchants across the United States, and Canadian merchants face the same brand programs; our guide to PCI compliance in Canada covers what's different there. Chip and tap POS terminals and hosted checkout through our online payments keep card data off your own systems, which keeps your SAQ short. Our page on how Clearo helps with PCI compliance adds the third piece, a virtual terminal for phone orders.

Your next step

If you're not sure which level or SAQ applies to you, or there's a PCI charge on your statement nobody has explained, send us a recent statement for a free statement review. We'll flag PCI-related fees and tell you what your setup likely requires. Clearo offers PCI compliance support, and you can contact us to talk it through first.