Level 1 PCI compliance cost 2026: full ROC pricing read

What defines Level 1 PCI across all card brands

Level 1 designation thresholds are set per card brand and differ slightly. Visa and Mastercard set the bar at 6 million card transactions per year across all channels. Discover sets it at 6 million transactions. American Express sets it at 2.5 million transactions per year and additionally allows itself to designate any AmEx merchant Level 1 at AmEx's discretion. JCB designates any merchant processing 1 million or more JCB transactions per year as Level 1.

Any merchant exceeding the threshold for any one card brand is Level 1 for that brand specifically, which in practice means a merchant exceeding any single threshold is Level 1 for the whole compliance programme. Additionally, any merchant suffering a confirmed cardholder data compromise is treated as Level 1 by the affected card brands regardless of transaction volume, typically for at least the next ROC cycle. This breach-induced Level 1 designation is one of the most significant cost shocks in the PCI world and is a recurring driver of urgent ROC engagements.

The official PCI SSC PCI DSS v4.0 document library contains the formal merchant level definitions in the Reporting Guide. Acquiring banks publish their interpretation of these thresholds, and there is sometimes minor variation in how aggressively an acquirer applies the upgrade trigger for borderline merchants. Confirm your designation in writing with your acquirer before budgeting; the cost step between Level 2 and Level 1 is steep.

Full Level 1 cost decomposition

Anchored to the Verizon Payment Security Report compliance maintenance data, public Coalfire and A-LIGN customer disclosures, and Vendr aggregated buyer data. Year-one remediation is the most variable line item and depends heavily on pre-engagement security maturity.

Three concrete Level 1 scenarios

Scenario one. A SaaS payment processor with 8 million transactions per year, single-region AWS deployment, single cardholder data environment, hosted-checkout integration with all cardholder data flowing through a PCI Level 1 payment gateway (Stripe, Adyen, Braintree). Year-one total: $80,000 to $130,000. QSA fee dominates ($50,000 to $80,000), with bundled pen testing through the same QSA at $20,000 to $30,000 and ASV plus tooling rounding out. Renewal years drop to $50,000 to $80,000.

Scenario two. A mid-cap e-commerce retailer with 15 million transactions per year, custom checkout integration with Stripe Elements requiring SAQ A-EP-equivalent controls under Req 6.4.3 script management, multi-region cloud CDE across AWS US-East and US-West, payment-page script monitoring tooling already deployed. Year-one total: $150,000 to $220,000. QSA fee $90,000 to $140,000, separate external and internal pen testing $40,000 to $60,000, segmentation validation $10,000, ASV plus tooling $15,000 to $25,000, year-one remediation roughly $30,000.

Scenario three. A global hotel chain with 50 million transactions per year, hundreds of in-scope locations across multiple countries, on-property POS terminals with mixed P2PE and non-P2PE deployment, in-property card storage for booking adjustments and tip processing. Year-one total: $300,000 to $500,000+. QSA fee $150,000 to $250,000+ reflecting the multi-site fieldwork, multiple pen tests across regional environments $50,000 to $100,000, segmentation validation per region $15,000 to $30,000, enterprise-scale tooling $50,000 to $100,000, year-one remediation typically the largest line item at $50,000 to $150,000+ because pre-engagement security maturity at multi-site enterprises is consistently uneven across properties.

Level-1-specific cost levers

Three levers materially change Level 1 economics. First, scope reduction through tokenisation or hosted payment pages. Moving cardholder data flow out of the merchant's CDE through Stripe Checkout, Adyen Drop-in, or full tokenisation reduces the number of in-scope systems by 60 to 90 percent in many cases. The Level 1 ROC still happens, but the assessor's evidence collection effort drops dramatically, and the fee follows. This is the single highest-leverage cost lever at Level 1.

Second, the Internal Security Assessor path. Training one or two internal employees as PCI ISAs at $3,000 to $5,000 per certification, plus annual continuing education, can replace the QSA-led annual ROC for organisations with mature internal security functions. The annual saving for Level 1 enterprises is typically $50,000 to $150,000+ versus engaging an external QSA, though the up-front investment is meaningful and the ISA must remain organisationally independent of the systems they assess.

Third, the multi-framework bundle. For Level 1 organisations with combined PCI plus SOC 2 plus ISO 27001 obligations (typical of B2B SaaS and fintech), engaging a single named-firm QSA to handle all three frameworks (A-LIGN or Schellman are the most aggressive on this) saves 25 to 40 percent versus engaging separate firms. For Level 1 plus FedRAMP combined, Coalfire's bundle is the cheapest path.