PCI DSS levels: what a small merchant must validate
How PCI DSS merchant levels work, who decides what a small merchant must validate, and what questionnaires, scans and assessors involve each year.
By Achekam · · 5 min read · For Running a business businesses in South Africa, Nigeria, Kenya
At some point your bank or payment provider will send you a form with "PCI DSS" at the top and a request to complete it by a date. For a small shop, workshop or online seller, the first reaction is usually confusion: what level are we, who says so, and what are we actually being asked to prove?
The answers are simpler than the paperwork suggests. Your level depends mostly on how many card payments you take. What you must do to validate is decided by the bank or provider that processes your card payments, not by you. And for most small merchants, validation is a yearly self-assessment rather than an outside audit.
Everyone must comply; not everyone validates the same way
The Payment Card Industry Data Security Standard (PCI DSS) sets security requirements for anyone who handles card data. Stripe's PCI guide states that all businesses that accept card payments must comply with PCI DSS, whatever their volume, region or the way they take payments.
Stripe's guide describes compliance as three main parts: collecting and transmitting card details securely, storing data securely, and validating every year that the required security controls are in place. The first two are what you do every day. The third is what the form is about.
Complying and validating are different. You must comply regardless of size. How you prove it, and whether you must prove it at all, depends on your level and on who manages your compliance.
Four levels, set mostly by yearly card volume
Stripe's guide explains that there are four PCI compliance levels, typically based on the volume of card transactions a business processes over a 12-month period, with different validation requirements at each level.
| Level | Who, per Stripe's guide | How compliance is validated |
|---|---|---|
| Level 1 | More than 6 million Visa or Mastercard transactions a year, or more than 2.5 million American Express transactions, or any merchant that has had a data breach | No self-assessment allowed: an annual Report on Compliance, signed by a Qualified Security Assessor or the merchant's executive officer, plus a quarterly network scan by an Approved Scanning Vendor |
| Levels 2 and 3 | Lower volumes; your acquirer or provider can tell you the thresholds it applies | As your acquirer or provider directs |
| Level 4 | The smallest merchants | See below |
Note the breach rule. A small business that suffers a card data breach can be treated as Level 1, whatever its volume, with the heavier validation that brings.
Your acquirer or provider decides what you validate
The PCI Security Standards Council itself says that whether an entity must comply with, or validate compliance to, a PCI standard is at the discretion of the organisations that manage compliance programmes, such as a payment brand or acquirer. The Council writes the standard; it does not tell individual merchants what to file.
In practice, that means your merchant bank, or the payment provider that settles card payments to you, tells you your level and what to send them. If two providers process your cards, each may ask separately. When in doubt, ask them directly: "What level are we, and what do you need from us this year?"
Questionnaires, scans and assessors
Three terms come up in every PCI request:
- Self-Assessment Questionnaire (SAQ). A form you complete yourself, answering whether each relevant requirement is in place. There is more than one version, and your provider will tell you which one to use.
- Approved Scanning Vendor (ASV). The Council describes ASVs as companies it has qualified and trained to carry out external vulnerability scans as the standard requires. Some merchants must have one scan their internet-facing systems regularly.
- Qualified Security Assessor (QSA). The Council describes QSAs as independent security organisations it has qualified to validate an entity's adherence to PCI DSS. In Stripe's description of Level 1, the Report on Compliance is signed by a QSA or by the merchant's executive officer.
The smallest merchants
Stripe's guide notes two points about Level 4. Visa does not recognise Level 4 merchants. Under Mastercard guidance, Level 4 merchants must comply with PCI DSS, but validation of compliance is not required except where applicable law or regulation requires it.
So even when nobody asks for a form, the duty to protect card data remains. And your acquirer may still ask for a questionnaire as a condition of your merchant agreement. Treat its request as the rule that applies to you.
Mapping your card touchpoints
Before you answer any questionnaire, list every place card details can appear in your business. Achekam's role is narrower than many owners assume, and it is worth being precise:
- Card terminal at the counter. A card payment at an Achekam till is recorded by the cashier from the bank terminal's slip, because the till is not connected to any card machine. The terminal belongs to your bank or provider, and its slips are paper you must store and dispose of carefully.
- Pay links on invoices. A business can create a payment link for an issued customer invoice, and the customer pays on a public page showing the business's name and branding, through the gateway the business has set up.
- Gateway settings. A workspace administrator enters the business's own payment gateway credentials in Settings under Payment Gateways & Checkout. Non-administrators can view but not save them. Keep the number of administrators small and review the list.
Also list the places outside any system: card numbers written on order forms, card details read over the phone, screenshots sent on messaging apps. These are often where small merchants fall short, and no software setting changes them. The questionnaire your provider sends will ask about exactly these practices.
Putting the yearly check in the calendar
Stripe's guide states that PCI compliance is not a one-time event but an annual process, and advises checking and revalidating when the business adds anything new that involves card data, such as physical stores, new markets or a customer support centre.
A simple routine:
- Diary the date your provider's annual request usually arrives, and a reminder a month before.
- Each year, update your list of card touchpoints before completing the questionnaire.
- Whenever you open a branch, start selling online, or add a phone-order line, ask your provider whether your validation changes. Opening a new branch or going online covers that moment.
- Keep each year's completed questionnaire and any scan reports together.
Where to look next
The PCI Security Standards Council's home page for PCI DSS carries the current version of the standard and its supporting documents. Read it for the requirements, then ask your acquirer or payment provider which level they place you at and what they need from you this year.
General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.
