Level 1 PCI compliance cost: what actually sets the bill

What defines Level 1, across brands that do not agree

Level 1 thresholds are set per network, and each network counts only its own transactions. Mastercard sets it at more than six million total combined Mastercard and Maestro transactions annually, and additionally deems any merchant meeting Visa's Level 1 criteria to be a Mastercard Level 1 merchant, which is a cross-reference worth noticing: the brands are not independent of each other in the direction you might assume. Visa sets it at more than six million Visa transactions a year. Discover publishes six million or more on Discover Network. American Express sets it lower, at 2.5 million or more American Express transactions a year, per its Data Security Operating Policy dated April 2026. JCB is the exception worth knowing about, because it does not operate merchant levels at all, so nothing about your JCB volume makes you Level 1 and no JCB row belongs in a level table however often you see one.

The practical consequence is that a merchant exceeding any single brand's threshold is Level 1 for that brand, and in practice that tends to set the shape of the whole compliance programme rather than one brand's corner of it. The American Express threshold is the one that arrives first and surprises people, because it sits at well under half the Visa and Mastercard bar. Acquirers vary in how aggressively they apply the upgrade trigger for a merchant hovering at a threshold, some acting at the quarter and some at the annual review, so confirm your designation in writing with yours before you plan anything. The step from Level 2 to Level 1 is not a step in fee, it is a step in kind: an SAQ becomes a Report on Compliance.

Who may actually sign the ROC

This part is published, in Mastercard's own rulebook, and it is more permissive than the market assumes. A Level 1 merchant needs an annual assessment producing a ROC Attestation of Compliance signed by a QSA, a PCI SSC-certified Internal Security Assessor, or an executive officer of the merchant. Three routes, printed in section 2.2.2 of the 3 February 2026 Security Rules and Procedures. Most Level 1 merchants engage a QSA, and most Level 1 pages assume that is the only option, but the ISA route is a real PCI SSC programme rather than a loophole, and it is worth pricing against the QSA quote you actually hold rather than dismissing.

What the ISA route costs is not something this page can tell you, and nor can anyone else who is not the PCI SSC: the Council publishes its ISA programme fees on its own site, so read the current year's figure there. What can be said is the shape of the decision. It is a standing headcount commitment weighed against a recurring external fee, so it turns on your own two numbers rather than on a rule of thumb. It only works where you have staff who can hold the qualification and stay independent of the systems they assess, which is the constraint that rules it out for most organisations that ask about it. And your acquirer can require more than the brand rules do, because what it accepts is a term of your merchant agreement rather than a card brand rule. Confirm the route it will accept before you invest in either one.

The seven things a Level 1 assessment is priced against

There are no dollar figures against these, because a QSA engagement is bought from a market that publishes no price and a range here would be a guess at somebody else's undisclosed fee. What is knowable, and more useful, is what the work is metered on. Notice that your transaction count is not on this list. It decides that you are Level 1; it does not decide what Level 1 costs you.

The gap between a compact Level 1 engagement and an enterprise one is almost entirely the third and sixth of these, scope and locations, rather than vendor choice. That is the useful part: scope is the thing you can change, and a system that is out of scope is not assessed, not evidenced and not argued about. Vendor choice is where most merchants spend their negotiating energy instead. More on what a QSA prices against.

What the standard fixes, and what it leaves to your scope

PCI DSS sets the test set and the frequency. It does not price either, and no firm that sells the testing publishes a rate. So the honest way to read this table is as the quantity side of your quote: the standard fixes how often, your scope fixes how much, and the multiplication happens in a proposal rather than on this page.

Frequencies are read off PCI DSS v4.0.1. The segmentation row is the one most often misquoted: Requirement 11.4.5 sets at least every 12 months for all entities, and the six-month cadence in Requirement 11.4.6 applies to service providers only. If you are a merchant being quoted for twice-yearly segmentation testing, ask which requirement it is being quoted against before you pay for it.

The lines that are not in the proposal

The line that most often blows a Level 1 budget is not the assessment fee. It is one of these, and the first is frequently larger than the fee itself.

• Remediation after gaps are found, which is often the largest line and is not always in the headline fee
• Your own staff's time collecting evidence, which never appears in the proposal
• Re-assessment if you fail and need a re-test
• Travel and on-site fieldwork for multi-location operations
• Scope expansion mid-engagement when undocumented systems surface
• Tooling bought to satisfy a specific control, such as SIEM, FIM or MFA

Remediation deserves its own sentence, because it is the line that makes Level 1 budgets look wrong in retrospect. It is not really an assessment cost at all: it is the cost of the gap between how your environment is and how it needs to be, and it runs from a configuration change to an encryption or segmentation project. Nobody can quote it before fieldwork, including the firm that will bill it. The only thing that reduces it is finding the gaps before an assessor does, because gaps closed before fieldwork are not billed as change orders. That is also why a renewal costs less than a first ROC for a structural reason rather than as a discount: the scoping is done and the evidence templates carry forward.

What non-compliance actually exposes a Level 1 merchant to

This is the part of the cost question with published figures behind it, and they do not work the way most pages claim. Card brand assessments are levied on your acquirer, not on you. Visa's rule is explicit that where a merchant has been deficient in securely maintaining account information, Visa may impose a non-compliance assessment on the Member. Mastercard's Table 2.2 assesses the Customer. Neither brand has a contract with you. What reaches you is set by the indemnity clause of your own merchant agreement, which is a private contract and the only document where your number exists. At Level 1 that clause is usually negotiable and almost never negotiated.

Source: Mastercard Security Rules and Procedures, Merchant Edition, 3 February 2026, section 2.2.5, Table 2.2. Read the column heading carefully: these are ceilings, per violation, per calendar year, and Mastercard's own wording is "up to". They are not monthly, they are not ranges, and they are assessed on the Customer, meaning your acquirer. Mastercard sets Level 1 and Level 2 merchants in the same band, at a higher one than Level 3. Mastercard also states that noncompliance may result in merchant termination, which is the tail risk that appears on no fee schedule and is the one that matters at this volume.

Visa publishes no routine schedule for PCI DSS non-compliance at all. Rule 12.5.1.1 routes that to the Account Information Security Program Guide, which Visa does not publish, so anyone quoting you a Visa PCI fine schedule is quoting something Visa has not printed. What Visa does publish is its breach-response assessments:

Sources: Visa, What To Do If Compromised, Visa Supplemental Requirements v10.0, effective 25 June 2026, section 9 for the assessment and section 8 for the investigation fee. These attach to the WTDIC breach-response requirements rather than to PCI DSS non-compliance generally. Visa sets the same USD 100,000 figure for issuers, acquirers and VisaNet processors as for Level 1 and Level 2 merchants. Separately, Rule 12.5.1.3 provides for an assessment of up to USD 100,000 per incident for failing to report a suspected or confirmed compromise to Visa within three calendar days. That is the one Visa penalty with a published ceiling, it is charged per incident, and the clock is short enough that the plan has to exist before the incident does. Figures last verified 17 July 2026; full detail on the penalties page.