I was prompted recently to take a deeper look into some of the PCI requirement information, and I have found some pretty serious discrepancies with regard to the reporting obligations of Level 4 Merchants (less than 20,000 transactions per year).

Some suggest that Level 4 Merchants are not required to report on their PCI compliance (which does not mean that they aren't responsible for being compliant, only reporting on it annually) but others also suggests that Level 4 Merchants are required to annually scan their network in order to prove compliance. Also there are some websites that suggest Level 4 Merchants are required to undergo quarterly network scans, which is the same requirement for Level 3 Merchants:

I'm curious if anyone out there has any experience with this sort of thing. Again, I want to stress that ALL merchants that accept credit cards are obligated to maintain PCI compliance. However, the issue surrounds the reporting requirements for various merchants, as having scans and such is a service that a merchant will have to pay for.

1 Answer 1


You have to report on PCI compliance if you are a level 4 merchant. You need to complete a self assessment (SAQ). So to become compliant you need to:

  • Complete the Self-Assessment Questionnaire according to the instructions it contains.
  • Complete and obtain evidence of a passing vulnerability scan with a PCI SSC Approved Scanning Vendor (ASV). Note scanning does not apply to all merchants. It is required for SAQ A-EP, SAQ B-IP, SAQ C, SAQ D-Merchant and SAQ D-Service Provider.
  • Complete the relevant Attestation of Compliance in its entirety (located in the SAQ tool).
  • Submit the SAQ, evidence of a passing scan (if applicable), and the Attestation of Compliance, along with any other requested documentation, to your acquirer.
  • I can't provide a cite, but I believe level 4 merchants are required to do the SAQ but not required to submit it to their acquirer/processor annually as other levels are.
    – gowenfawr
    Nov 28, 2014 at 14:51
  • "The PCI DSS Self-Assessment Questionnaire (“SAQ”) must be completed by Level 2 and 3 merchants. Level 4 merchants may be required to complete the applicable PCI DSS SAQ as specified by their merchant bank." Visa
    – gowenfawr
    Nov 28, 2014 at 15:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .