Level 3 PCI compliance cost: what actually sets the bill

The Level 3 e-commerce-specific definition

Mastercard's Level 3 is the only merchant level defined by channel-specific volume: more than 20,000 but up to one million combined Mastercard and Maestro e-commerce transactions annually. A merchant with 500,000 in-person and 50,000 e-commerce transactions is Mastercard Level 3 on the e-commerce count. A merchant with 100,000 in-person and no e-commerce transactions is Mastercard Level 4 despite the higher total. That channel-specific definition is the point: at this tier the compliance obligation is essentially an e-commerce checkout security exercise rather than a payment-environment-wide one, which is also why Requirement 6.4.3 lands so heavily here. Visa's level 3 is a different animal since 25 April 2024, when Visa consolidated its levels 3 and 4 into one tier covering 1 to 1,000,000 transactions a year, with no channel test at all.

The practical consequence is that the same merchant holds two different Level 3 identities at once, and only one of them has a floor under it. If your e-commerce volume sits below 20,000 you are a Visa level 3 merchant and a Mastercard Level 4 merchant simultaneously, which is not a contradiction and does not change what PCI DSS asks of you. Visa said so in terms when it made the change: the consolidation "does not introduce any changes to the existing PCI DSS compliance requirements". What it does change is who you should be reading. Any advisor still sorting you by Visa level 4 is working from information that predates April 2024.

The other networks number this tier their own way, and two of them are worth checking against your own volumes. American Express places Level 3 at 10,000 to fewer than 50,000 American Express transactions a year, per its Data Security Operating Policy dated April 2026, and it keeps four levels rather than consolidating as Visa did. Its published rule is that Level 1 and Level 2 merchants must participate in the validation programme, while Level 3 and Level 4 merchants submit validation documentation only if American Express requires it at its discretion, though the obligation to actually comply with the standard applies regardless. Discover runs three levels rather than four, with Level 3 defined as all merchants below its 1 million transaction Level 2 band. JCB has no merchant levels at all, so no JCB row belongs in a level table however often you see one.

For merchants whose e-commerce volume is approaching but not yet exceeding one million transactions a year, the planning conversation is when the upgrade to Level 2 triggers. Acquirers vary on how strictly they enforce the threshold; some upgrade designation at the first quarter showing the merchant has crossed, others wait for the annual review. Confirm the upgrade trigger with your acquirer if Level 2 designation is on the horizon, because Mastercard requires a Level 2 merchant completing SAQ A, SAQ A-EP or SAQ D to engage a QSA or a certified ISA for validation. That rule, not the transaction count, is what actually changes when you cross.

SAQ A or SAQ A-EP: the fork that sets the job

Everything expensive about Level 3 follows from one architectural fact: whether your own website can affect the security of the payment page. If it cannot, because the customer is on a fully hosted payment page and card data never touches your systems, you are in SAQ A territory. If it can, you are in SAQ A-EP territory. Which side a given integration falls on is decided by the eligibility criteria printed in the front of each SAQ document rather than by the name of the product, and it is worth confirming in writing with your processor. Nobody publishes a fee for completing either questionnaire, so the honest way to size the gap is the one number the PCI SSC does publish: the count of requirements in the document itself.

Counts are the number of requirements in each SAQ document under v4.0.1, in the PCI SSC document library. Read yours before you scope anything, and confirm your payment flow against the eligibility criteria printed in the front of it. Since v4.0.1, SAQ A eligibility also requires confirming your site is not susceptible to script attacks, which is the change most likely to move a merchant who assumed SAQ A was automatic.

Roughly six times the controls is the shape of the decision, and it recurs annually. That is why the migration from an in-page integration to a fully hosted checkout is the first conversation to have at Level 3, and it is an engineering conversation rather than a procurement one. The trade-off is real: hosted checkout gives you less control over the payment experience, and a redirect can move conversion. That is a number you already have and your assessor does not, which makes it the one piece of this decision you can actually calculate. See the SAQ types guide for the full set, including the card-present questionnaires.

What a Level 3 quote is priced against

These are the lines a Level 3 programme actually has. There are no dollar figures against them because every one is bought from a market that publishes no price, and a range here would be a guess at somebody else's undisclosed fee. What is knowable is what each line is metered on, and which of them you can remove from your own bill by changing scope.

One published price exists anywhere near this table, and it is worth knowing precisely what it is. Intruder publishes penetration testing "Starting from $3,500 / test" (intruder.io/pricing, checked July 2026). That is a starting price for a scoped product from one vendor, not a market rate, and Intruder is not an Approved Scanning Vendor: its own site says so, and points at Tenable as the ASV behind its scanner. If you buy scanning expecting an ASV attestation, confirm who signs the report.

Requirement 6.4.3, the newest real line

Requirement 6.4.3 became mandatory on 31 March 2025 and applies to any e-commerce merchant whose website can affect the security of the payment page, which is to say every SAQ A-EP merchant. It asks for three things about every script loaded on the payment page: a method to confirm each script is authorised, a method to assure the integrity of each script, and a written inventory with a business or technical justification for why each one is there. It is the only requirement on this list that is genuinely new money for a Level 3 e-commerce merchant, because the others existed under v3.2.1 in some form.

What it costs you turns on your own script inventory rather than on any vendor's price. Count the third-party tags your payment page loads: analytics, session replay, chat widgets, tag managers, ad pixels, A/B testing. Every one is a line of evidence you will justify and monitor every year, and several of them are on the page because nobody has removed them since a campaign in 2023. Removing a script is free and removes the evidence obligation with it, which makes the inventory itself the cheapest work available here. Whether the monitoring is bought or configured depends on what you already run: teams already using a CDN with script visibility should check what their existing subscription covers before buying a second thing that does the same job.

What non-compliance actually exposes a Level 3 merchant to

This is the part of the cost question with published figures behind it, and they do not work the way most pages claim. Card brand assessments are levied on your acquirer, not on you. Visa's rule is explicit that where a merchant has been deficient in securely maintaining account information, Visa may impose the assessment on the Member. Neither brand has a contract with you. What reaches you is set by the indemnity clause of your own merchant agreement, which is a private contract and the only document where your number exists.

Source: Mastercard Security Rules and Procedures, Merchant Edition, 3 February 2026, section 2.2.5, Table 2.2. Read the column heading carefully: these are ceilings, per violation, per calendar year, and Mastercard's own wording is "up to". They are not monthly, they are not ranges, and they are assessed on the Customer, meaning your acquirer. Mastercard runs all four merchant levels; Table 2.2 sets Level 1 and Level 2 merchants at a higher band than Level 3.

Visa publishes no routine schedule for PCI DSS non-compliance at all. Rule 12.5.1.1 routes that to the Account Information Security Program Guide, which Visa does not publish, so anyone quoting you a Visa PCI fine schedule is quoting something Visa has not printed. What Visa does publish is its breach-response assessments, and for a Visa level 3 merchant they are tiered by volume:

Source: Visa, What To Do If Compromised, Visa Supplemental Requirements v10.0, effective 25 June 2026, section 9. These attach to the WTDIC breach-response requirements rather than to PCI DSS non-compliance generally. Separately, Rule 12.5.1.3 provides for an assessment of up to USD 100,000 per incident for failing to report a suspected or confirmed compromise to Visa within three calendar days. That is the one Visa penalty with a published ceiling, it is charged per incident, and the clock is short enough that the plan has to exist before the incident does. Figures last verified 17 July 2026; full detail on the penalties page.