PCI Merchant Levels by Card Brand: Visa, Mastercard, Amex, Discover, JCB

How levels work

Higher levels typically mean more rigorous validation (ROC with QSA). Lower levels may self-assess with SAQs if eligible.

Multi-brand merchants

You may face the strictest applicable validation across brands. Track Visa, Mastercard, Amex, Discover, and JCB expectations separately.

Operations

Monitor volume growth that could bump your level mid-year; engage the acquirer early.

How CyberSilo Helps

• Evidence mapping in CyberSilo CSA
• Detection and logging proof with ThreatHawk SIEM
• Advisory scoping — contact CyberSilo

Frequently Asked Questions

Where are official thresholds?

Card brand and acquirer programme documents.

Does Level 4 mean no security?

No — PCI DSS still applies; validation path differs.

Service providers?

SP levels are a separate classification.

Related Resources

• PCI hub
• SAQ B