Merchant levels defined

All merchants will fall into one of the four merchant levels based on transaction volume over a 12-month period. Transaction volume is based on the aggregate number of transactions (inclusive of credit, debit and prepaid) from a merchant Doing Business As ("DBA"). In cases where a merchant corporation has more than one DBA, the aggregate volume of transactions stored, processed or transmitted by the corporate entity is used to determine the validation level. If data is not aggregated, such that the corporate entity does not store, process or transmit cardholder data on behalf of multiple DBAs,  the DBA’s individual transaction volume will be used to determine the validation level. Merchant levels are defined as:

* New merchant level definitions effective of July 18, 2006.

** Any merchant that has suffered a hack that resulted in an account data compromise may be escalated to a higher validation level.

Compliance validation basics

In addition to adhering to the PCI Data Security Standard, compliance validation is required for Level 1, Level 2, and Level 3 merchants, and may be required for Level 4 merchants.

The PCI DDS requires that all merchants perform external network scanning to achieve compliance. Level 4 merchants, new or changing processors, will be required to use a compliant application or prove compliance beginning October 2008 and may  be required to submit the self assessment questionnaire and quarterly scan reports.