PCI Merchant Level Calculator
Determine your PCI DSS merchant level from your annual card transaction volume to understand your validation requirements.
Last reviewed by the Radiatus Cloud team
Determine your PCI DSS merchant level from annual transaction volume.
Going for ISO 27001, SOC 2, HIPAA or GDPR?
Radiatus runs end-to-end compliance & GRC programs.
Find your PCI DSS merchant level
The Payment Card Industry Data Security Standard classifies merchants into four levels based on how many card transactions they process a year, and the level determines how you must validate compliance. This calculator applies the widely used Visa thresholds: Level 1 for more than six million transactions, Level 2 for one million to six million, Level 3 for twenty thousand to one million e-commerce transactions, and Level 4 for everything below that. Higher levels face more rigorous validation.
The volume is counted per card brand per year, across all channels, so a busy merchant can reach a higher level than expected.
Validation requirements by level
The merchant level drives the type of assessment you must complete. Level 1 merchants generally need an annual on-site assessment producing a Report on Compliance, signed off by a Qualified Security Assessor, plus quarterly network scans. Lower levels usually complete an annual Self-Assessment Questionnaire and quarterly scans by an approved vendor. Knowing your level lets you plan the right assessment and avoid surprises.
Card brands set their own thresholds, which mostly align, and your acquiring bank ultimately confirms your level and requirements. This is general guidance, not a formal determination. All calculation happens locally in your browser.
Related tools
- SOC 2 Evidence Readiness — Interactive checklist to gauge your SOC 2 evidence readiness.
- Privacy Policy Checker — Check if your policy covers standard requirements (GDPR/CCPA basics).
- Compliance Req Finder — Find which standards (ISO, SOC2, HIPAA) apply to your industry/region.
- Audit Readiness Planner — Plan your compliance audit timeline (SOC2, ISO) backwards from deadline.
Frequently Asked Questions
How is PCI merchant level determined?
By annual card transaction volume. More than six million is Level 1, one to six million Level 2, twenty thousand to a million e-commerce Level 3, and below that Level 4.
What does each level require?
Level 1 typically needs an assessor-signed Report on Compliance and scans; lower levels usually complete a Self-Assessment Questionnaire and quarterly scans.
Are the thresholds the same for all card brands?
They are broadly aligned but each brand sets its own. These figures follow the common Visa thresholds; your acquirer confirms your level.
Does channel affect the level?
Yes. The twenty-thousand threshold for Level 3 is specific to e-commerce transactions, while other channels fall into Level 4 below a million.
Privacy & Security
Everything runs in your browser; nothing is uploaded.
How to Use
Enter your annual card transaction count and channel.
Disclaimer: This tool is provided "as is" without warranty of any kind. Results are for educational and utility purposes.
Related Tools
SOC 2 Evidence Readiness
ComplianceInteractive checklist to gauge your SOC 2 evidence readiness.
Privacy Policy Checker
ComplianceCheck if your policy covers standard requirements (GDPR/CCPA basics).
Compliance Req Finder
ComplianceFind which standards (ISO, SOC2, HIPAA) apply to your industry/region.