PCI Merchant Levels & Validation Requirements

Overview

Understand your route to PCI DSS compliance

To understand how the PCI DSS applies to your organisation, it’s important to refer to each card payment brand’s PCI validation requirements.

As a general rule, merchants and service providers will fall into one of four levels, based on the annual volume of card data transacted. Categorisation will affect the minimum standards expected and the requirement to complete either a Self-Assessment-Questionnaire (SAQ) or Reports on Compliance (ROC). All level one merchants and service providers – organisations that process millions of transactions annually – are required to undergo an onsite assessment.

The SAQ varies and it is important to choose the most appropriate version for the payment scenario.

PCI SAQ A

Card-not-present merchants (e-commerce or mail/telephone-order) that have fully outsourced all cardholder data functions to PCI DSS-validated third-party service providers and do not store, process or transmit cardholder data on in-house systems or premises.

PCI SAQ A-EP

E-commerce merchants who outsource all payment processing to PCI DSS-validated third parties, and who have a website(s) that doesn’t directly receive cardholder data but that can impact the security of the payment transaction. No electronic storage, processing, or transmission of any cardholder data on the merchant’s systems or premises.

PCI SAQ B

Merchants using imprint machines with no electronic cardholder data storage; and/or standalone, dial-out terminals with no electronic cardholder data storage.

PCI SAQ B-IP

Merchants using only standalone, PTS-approved payment terminals with an IP connection to the payment processor, with no electronic cardholder data storage. Not applicable to e-commerce channels.

PCI SAQ C

Merchants with payment application systems connected to the internet that electronically store cardholder data.

PCI SAQ C-VT

Merchants who manually enter a single transaction at a time via a keyboard into an Internet-based virtual terminal solution that is provided and hosted by a PCI DSS-validated third-party service provider. No electronic cardholder data storage.

PCI SAQ P2PE-HW

Merchants using only hardware payment terminals that are included in and managed via a validated, PCI SSC-listed P2PE solution, with no electronic cardholder data storage.

PCI SAQ D

Includes merchants not covered by any other SAQ types as well as service providers defined by a payment brand as eligible to complete a SAQ.

An overview of PCI DSS

PCI DSS requirements

PCI DSS log monitoring

PCI DSS penetration testing

Get in touch

Complete the form for a prompt response from our team.

Two Redscan team members analysing cyber security intelligence

From the blog

From the blog Case studies Latest news

30th May 2023

Microsoft threat detection and response: five key pitfalls (and how to address them)

24th May 2023

EPP vs EDR – What’s The Difference?

22nd May 2023

The Cyber Essentials 2023 update – what’s involved?

10th May 2023

Kroll named as winners at Global Infosec Awards and Computing Security Excellence Awards!

Hospitality Company

Securing a hospitality company’s continued global expansion

Asset Management Firm

Enhancing security visibility for a leading asset management firm

National Homebuilder

Ensuring threat visibility across a hybrid cloud network

Specialist Bank

Raising the bar by uncovering vulnerabilities across a bank’s estate

5th June 2023

Ransomware groups emulating business practices to increase profits

Ransomware gangs are adopting business-like practices in order to increase their profits, according to a new report.

30th May 2023

Half of UK CEOs view cyber as a bigger business risk than the economy

50% of UK CEOs see cyber security as a bigger risk to their company than economic uncertainty, according to new research.

22nd May 2023

Warning of increase in business email compromise (BEC) Attacks

A new report is warning about a surge in business email compromise (BEC) attacks and the changing tactics used by cyber criminals.

15th May 2023

Ransomware victim numbers surge by 27%

The number of ransomware victims listed on data leak sites increased by 27% year-on-year in April, with manufacturing the most affected industry, according to a new report.