Level 2 PCI compliance cost: where self-assessment is not self-service

The SAQ fork, which is the real Level 2 decision

Everything expensive about Level 2 follows from which questionnaire your payment environment forces you into, and that is set by how you take payments rather than by how many payments you take. Volume makes you Level 2. Architecture decides what Level 2 costs you. Nobody publishes a fee for completing any of these questionnaires or for validating one, so the honest way to size the gap is the one number the PCI SSC does publish: the count of requirements in the document itself.

Counts are the number of requirements in each SAQ document under v4.0.1, in the PCI SSC document library. Read yours before you scope anything, and confirm your payment flow against the eligibility criteria printed in the front of it rather than against the marketing name of your integration. Since v4.0.1, SAQ A eligibility also requires confirming your site is not susceptible to script attacks. Validation column: Mastercard SPME, 3 February 2026, section 2.2.2. See the SAQ types guide for the full set.

Roughly ten times the controls is the shape of the SAQ A against SAQ D decision, and it recurs annually. That is why, for a Level 2 e-commerce merchant, the migration from an in-page integration to a fully hosted checkout is the first conversation to have, and it is an engineering conversation rather than a procurement one. The trade-off is real: a hosted checkout gives you less control over the payment experience, and a redirect can move conversion. That is a number you already have and your assessor does not, which makes it the one piece of this decision you can actually calculate. For merchants held on SAQ D by card-on-file storage, whether for recurring billing, subscriptions or marketplace payouts, tokenisation is the equivalent lever: it moves the stored card data out of your environment, and what is out of scope is not assessed. What that costs to implement depends on your gateway and your engineering, and it is often already inside what you pay your gateway, so check before you buy it twice. More on scope reduction.

What a Level 2 quote is priced against

These are the seven variables the validation work is metered on. There are no dollar figures against them because every one is bought from a market that publishes no price, and a range here would be a guess at somebody else's undisclosed fee. Notice again that your transaction count is not among them: it decides that you are Level 2, and then it stops mattering.

The lines that are not in the proposal are worth reading before you sign one: remediation after gaps are found, which is often the largest line and is not always in the headline fee; your own staff's time collecting evidence, which never appears in the proposal; re-assessment if you fail and need a re-test; travel for multi-site fieldwork; and scope expansion mid-engagement when undocumented systems surface. More on what a QSA prices against.

What the standard fixes, on top of the questionnaire

The SAQ is not the whole obligation. PCI DSS sets a test set and a frequency for each of these, and it prices none of them. So read this as the quantity side of your quote: the standard fixes how often, your scope fixes how much.

Frequencies are read off PCI DSS v4.0.1. The segmentation row is the one most often misquoted, and if you are a merchant being quoted for twice-yearly segmentation testing, ask which requirement it is being quoted against before you pay for it.

Requirement 6.4.3, the newest real line for Level 2 e-commerce

Requirement 6.4.3 became mandatory on 31 March 2025 and applies to any e-commerce merchant whose website can affect the security of the payment page, which is to say every merchant on an in-page integration rather than a hosted one. It asks for three things about every script loaded on the payment page: a method to confirm each script is authorised, a method to assure the integrity of each script, and a written inventory with a business or technical justification for why each one is there. It is the newest genuinely new money on this list, because the other lines existed under v3.2.1 in some form.

What it costs you turns on your own script inventory rather than on any vendor's price, and no vendor in this category publishes one. Count the third-party tags your payment page loads: analytics, session replay, chat widgets, tag managers, ad pixels, A/B testing. Every one is a line of evidence you will justify and monitor every year, and several of them are on the page because nobody has removed them since a campaign two years ago. Removing a script is free and removes the evidence obligation with it, which makes the inventory itself the cheapest work available here and the right first step. Whether the monitoring that remains is bought or configured depends on what you already run, so check what your existing CDN or tooling subscription already covers before buying a second thing that does the same job. See what v4 added for the rest of the delta.

The acquirer conversation, which is worth having early

Your acquirer has contractual authority over its merchant book and can require more than the card brand rules do. It can require a full Report on Compliance from a Level 2 merchant that Mastercard's rules would let file a validated SAQ, and some do, based on industry sector, breach history, chargeback rates or processing pattern. That requirement is a term of your merchant agreement rather than a card brand rule, which is exactly why it is a conversation rather than a fact: what is contractual is negotiable in a way that a published rule is not.

So have it proactively, and have it before you budget rather than after. Ask three things in writing. Which validation path does the acquirer require of you specifically, an SAQ with QSA or ISA validation, or a full ROC? What evidence would move it from the second to the first, and is a clean compliance history, low chargeback rates and mature security documentation the kind of thing it weighs? And is any of the compliance tooling, the portal, or the scanning already included in what you pay it today, which is the question that most often turns up something already bought. The cost of the conversation is an hour with the acquirer's risk team. What it is worth depends entirely on which path you are on and what your own quotes say, which is why the only honest answer here is: get the path in writing first, then price both.

What non-compliance actually exposes a Level 2 merchant to

This is the part of the cost question with published figures behind it, and they do not work the way most pages claim. Card brand assessments are levied on your acquirer, not on you. Visa's rule is explicit that where a merchant has been deficient in securely maintaining account information, Visa may impose a non-compliance assessment on the Member. Mastercard's Table 2.2 assesses the Customer. Neither brand has a contract with you. What reaches you is set by the indemnity clause of your own merchant agreement, which is a private contract and the only document where your number exists. Read that clause while you are having the acquirer conversation above.

Source: Mastercard Security Rules and Procedures, Merchant Edition, 3 February 2026, section 2.2.5, Table 2.2. Read the column heading carefully: these are ceilings, per violation, per calendar year, and Mastercard's own wording is "up to". They are not monthly, they are not ranges, and they are assessed on the Customer, meaning your acquirer. Mastercard bands Level 1 and Level 2 merchants together, above the Level 3 band. Mastercard also states that noncompliance may result in merchant termination, which is the tail risk that appears on no fee schedule.

Visa publishes no routine schedule for PCI DSS non-compliance at all. Rule 12.5.1.1 routes that to the Account Information Security Program Guide, which Visa does not publish, so anyone quoting you a Visa PCI fine schedule is quoting something Visa has not printed. What Visa does publish is its breach-response assessments:

Sources: Visa, What To Do If Compromised, Visa Supplemental Requirements v10.0, effective 25 June 2026, section 9 for the assessment and section 8 for the investigation fee. These attach to the WTDIC breach-response requirements rather than to PCI DSS non-compliance generally. Visa sets Level 2 merchants at the same figure as Level 1 merchants and as issuers, acquirers and VisaNet processors. Separately, Rule 12.5.1.3 provides for an assessment of up to USD 100,000 per incident for failing to report a suspected or confirmed compromise to Visa within three calendar days. That is the one Visa penalty with a published ceiling, it is charged per incident, and the clock is short enough that the plan has to exist before the incident does. Figures last verified 17 July 2026; full detail on the penalties page.

One more published rule belongs here, because it is the one that changes a Level 2 merchant's obligations permanently. Mastercard may deem any merchant a Level 1 merchant at its sole discretion, expressly including any merchant with a confirmed Account Data Compromise event, whatever its transaction volume. For a merchant already at Level 2, that is not a distant scenario: it converts an annual SAQ into an annual Report on Compliance, and it arrives attached to a remediation programme with a 30 calendar day form and a compliance deadline on it. That is the real argument for doing the questionnaire properly rather than filing it. Source: Mastercard SPME, 3 February 2026, sections 2.2.2 and 2.2.6.