Level 2 PCI compliance cost 2026: SAQ or QSA pricing read

The Level 2 SAQ vs QSA decision

PCI DSS does not require Level 2 merchants to engage a QSA. The card brand programmes allow Level 2 merchants to self-assess via the appropriate Self-Assessment Questionnaire. However, the acquiring bank has contractual authority over its merchant book and can require any merchant, including Level 2, to engage a QSA for an annual on-site assessment. Acquirers exercise this discretion based on industry risk, breach history, chargeback rates, and processing pattern.

The cost differential is roughly 3 to 5x. SAQ D self-assessment with consultant assist runs $5,000 to $20,000. QSA-led assessment at Level 2 scope runs $35,000 to $70,000 for the compact band where ControlScan, SecurityMetrics, or boutique-tier QSAs compete, or $60,000 to $90,000 if the acquirer specifies a named-firm tier QSA (Coalfire, A-LIGN, Schellman, Trustwave). Before budgeting, get the acquirer's required path in writing.

The conversation with the acquirer is worth having proactively. Some acquirers are willing to accept SAQ D in place of QSA if the merchant demonstrates strong security posture (clean breach history, low chargeback rates, mature security program documentation). The cost of the conversation is one hour with the acquirer's risk team; the savings can be $30,000+ per year.

Full Level 2 cost decomposition (SAQ D path)

Anchored to Vendr aggregated buyer data and the Verizon Payment Security Report compliance maintenance figures. The QSA-led path adds $30,000 to $60,000 to the year-one total versus the SAQ D path.

Three concrete Level 2 scenarios

Scenario one. A B2B SaaS subscription business with 2 million transactions per year, single-region AWS deployment, Stripe Elements integration (custom checkout), acquirer accepts SAQ D self-assessment. Year-one total: $18,000 to $35,000. SAQ D with consultant assist $10,000 to $15,000, ASV scanning $600 to $1,500, external pen test $7,000 to $12,000, tooling $3,000 to $5,000, year-one remediation $3,000 to $10,000. Renewal years drop to $15,000 to $25,000.

Scenario two. A mid-market e-commerce retailer with 4 million transactions per year, multi-region cloud CDE, custom checkout requiring PCI v4.0 Req 6.4.3 payment-page script management, acquirer accepts SAQ D self-assessment with annual security attestation. Year-one total: $30,000 to $50,000. SAQ D $15,000 to $20,000, ASV scanning $2,000, external pen test $15,000 to $20,000, script monitoring tooling $5,000, year-one remediation $5,000 to $15,000.

Scenario three. A regional retail chain with 3.5 million transactions per year across 80 stores, in-store P2PE terminals plus e-commerce SAQ A-EP, acquirer requires QSA-led annual assessment due to industry-sector risk classification. Year-one total: $55,000 to $85,000. QSA assessment $40,000 to $60,000 (ControlScan or boutique-tier QSA), ASV scanning $2,500, pen tests $10,000 to $15,000, tooling $5,000, year-one remediation $5,000 to $15,000. The acquirer-imposed QSA requirement adds roughly $35,000 versus the SAQ D path that this merchant might otherwise have used.

Level-2-specific cost levers

Three levers materially change Level 2 economics. First, the SAQ A migration. For Level 2 e-commerce merchants who can migrate from custom checkout to hosted checkout (Stripe Checkout, PayPal, Adyen Drop-in), the SAQ type changes from SAQ D (329 controls, $10,000 to $20,000) or SAQ A-EP (191 controls, $4,000 to $12,000) to SAQ A (22 controls, $500 to $2,000). This is the single highest-leverage cost reduction available at Level 2, often saving $10,000+ per year.

Second, the acquirer conversation. Acquirers who impose QSA-led assessment on Level 2 merchants can sometimes be persuaded to accept SAQ D if the merchant demonstrates strong security posture. The conversation is one meeting; the saving is potentially $30,000+ per year. This is most often successful for merchants moving from a higher-risk processor relationship to a standard-risk relationship.

Third, tokenisation for SAQ D scope reduction. For Level 2 merchants stuck on SAQ D because of card-on-file storage requirements (recurring billing, subscription, marketplace seller payouts), implementing tokenisation through Stripe, Braintree, Basis Theory, or VGS removes the card data storage from the merchant's environment and can move the SAQ classification to a simpler type. The tokenisation implementation cost ($2,000 to $10,000 one-off) typically pays back within the first compliance cycle.