My Merchant Account Blog - Breaking Down the Levels of PCI DSS

Breaking Down the Levels of PCI DSS

Tuesday, December 02, 2008

The Payment Card Industry Data Security Standard (PCI DSS) helps to ensure that cardholder data is secure, whether in processing the transaction or storing the credit card number. PCI has been around for quite a few years, but now more and more merchants are hearing about it.

PCI DSS Merchant Levels

Merchants are divided into four categories:

Level One: Processing more than six million transactions per year or has had a security breach with cardholder data compromised
Level Two: Processing less than six million but more than 150,000 per year
Level Three: Processing less than 150,000 but more than 20,000 transactions per year
Level Four: Processing less than 20,000 transactions per year

When version 1.1 was released, it combined all transactions instead of separating between Visa and MasterCard transactions. Also these transactions are determined by your company, not per merchant account. So let's say Merchant Account A is processing 80,000 transactions a year and Merchant Account B is processing 100,000 transactions a year, you would be considered a Level Two Merchant.

Level One Merchants

Compliance validation has been required for merchants that process over 6 million (Visa) transactions a year since September 30, 2004. MasterCard required Level One merchants be compliant by June 30, 2005. An on-site security audit is also required annually with a network scan every quarter.

Level Two Merchants

Visa required Level Two merchants be PCI compliant by September 20, 2007. MasterCard is requiring the Level Two merchants be compliant by December 31, 2008.

Level Three Merchants

Both Visa and MasterCard required Level Three merchants to be compliant by June 30, 2005.

Level Four Merchants

There is no set date for Level Four merchants. This is determined by your merchant account provider or the acquiring bank. However, if you are not compliant and a breach occurs, you can be fined $500,000 or more by the card associations. If you are compliant and compromised, those fees might be waived or reduced. It would be in your best interest to become compliant if you have not already.

PCI DSS Version 1.2

Beginning on October 1, 2008, the PCI Security Standards Council released version 1.2 (see summary of PCI changes). You can review the Self-Assessment Questionnaire A and Attestation of Compliance to help you get started. Typically, Levels Two, Three, and Four Merchants will need to complete this Questionnaire.