Service Provider Level
PCIComplianceHubLast updated
The tier a payment brand assigns a service provider, determining how it must validate compliance. Level 1 service providers, the tier each brand reserves for its highest transaction volumes, require an annual onsite assessment producing a Report on Compliance; Level 2 service providers may generally self-assess using SAQ D for Service Providers. The thresholds are set by each payment brand rather than by the PCI Security Standards Council, and they differ between brands. PCI DSS also contains requirements that apply only to service providers, independent of level.
Applies to. PCI DSS v4.0.1 does not set service provider levels; each payment brand assigns them, usually by annual transaction volume, and the acquirer or brand tells the service provider which level applies and what to submit. The level decides the form of validation, a QSA-led Report on Compliance or SAQ D for Service Providers, and how often; the standard itself cares only about status. A set of requirements marked as applying to service providers only, including a documented cryptographic architecture, executive responsibility for the compliance programme, six-monthly scope confirmation and a written acknowledgement of responsibility to customers, binds a service provider at any level.