Level 3 PCI compliance cost 2026: e-commerce SAQ pricing read

The Level 3 e-commerce-specific definition

Level 3 is the only PCI level defined by channel-specific transaction volume. Visa and Mastercard set it as 20,000 to 1 million e-commerce-channel transactions per year. A merchant with 500,000 in-person transactions and 50,000 e-commerce transactions is Level 3 for PCI purposes. A merchant with 100,000 in-person and 0 e-commerce transactions is Level 4 even though total volume is higher than the Level 3 floor. The e-commerce-channel definition matters because the Level 3 compliance obligation is essentially an e-commerce checkout security exercise rather than a payment-environment-wide exercise.

This channel-specific framing makes Level 3 the level most affected by PCI v4.0 changes targeting e-commerce specifically. Requirement 6.4.3 (payment-page script management), which became mandatory in March 2025, applies to any e-commerce merchant whose website can affect the security of the payment page. This includes all SAQ A-EP merchants, which is to say most Level 3 merchants with custom checkout integration. The compliance evidence requires either a payment-page script monitoring tool or extensive manual evidence collection, and this is the single new cost item for Level 3 merchants in 2026 versus prior years.

For merchants whose e-commerce volume is approaching but not yet exceeding 1 million transactions per year, the planning conversation is when the upgrade to Level 2 triggers. Acquirers vary on how strictly they enforce the threshold; some upgrade designation at the first quarter showing the merchant has crossed, others wait for the annual review. Confirm the upgrade trigger with your acquirer if Level 2 designation is on the horizon.

Full Level 3 cost decomposition

Anchored to Vendr aggregated buyer data, public consulting rate cards, and Req 6.4.3 tooling product pricing from c/side, Jscrambler, and Source Defense.

Three concrete Level 3 scenarios

Scenario one. A Shopify store with 200,000 transactions per year, all payments through Shopify Payments (hosted), no custom payment page integration. Year-one total: $300 to $800. SAQ A through the SecurityMetrics bundled product, ASV scanning bundled, no Req 6.4.3 obligation because the payment page is hosted by Shopify outside the merchant's PCI scope. This is the practical floor for a Level 3 merchant on hosted checkout.

Scenario two. A direct-to-consumer brand with 500,000 transactions per year, custom Next.js storefront with Stripe Elements integration, requires SAQ A-EP and PCI v4.0 Req 6.4.3 compliance. Year-one total: $12,000 to $22,000. SAQ A-EP completion with consultant assist $5,000 to $8,000, ASV scanning $1,000, external pen test $7,000 to $10,000 (required for SAQ A-EP), script monitoring tooling deployment $3,000, year-one remediation $2,000 to $5,000.

Scenario three. A digital-goods marketplace with 800,000 transactions per year, custom checkout integrating multiple payment methods (Stripe, PayPal, Apple Pay, Google Pay), payment-page complexity requires both SAQ A-EP scope and significant Req 6.4.3 evidence collection. Year-one total: $20,000 to $35,000. SAQ A-EP completion $8,000 to $12,000, ASV scanning $1,500, external pen test $10,000 to $15,000, script monitoring with enterprise tier deployment $5,000, year-one remediation $5,000 to $10,000.

Level-3-specific cost levers

Three levers materially change Level 3 economics. First, the SAQ A migration discussed above. The cost gap between SAQ A and SAQ A-EP is roughly 3 to 4x, and the migration is usually a 4 to 8 week development effort. For Level 3 merchants currently on SAQ A-EP, this is the first conversation to have.

Second, the bundled SAQ-plus-ASV product through SecurityMetrics or a similar SMB-focused PCI provider. For Level 3 SAQ A merchants, the bundled product at $200 to $500 per year is the cheapest legitimate compliance path. For SAQ A-EP merchants, the bundled approach is less common because SAQ A-EP completion typically requires consulting depth that the SMB portal products do not provide.

Third, payment-page script monitoring tool selection. For SAQ A-EP merchants required to deploy a Req 6.4.3 tool, the market includes pure-play products (c/side, Jscrambler, Source Defense at $3,000 to $8,000 per year), CDN-integrated alternatives (Cloudflare Page Shield, Akamai Script Manager included with CDN subscriptions), and enterprise script integrity platforms. Evaluating these options carefully can save $2,000 to $5,000 per year in tooling cost. Buyers already on Cloudflare for CDN should evaluate Page Shield first; the additional cost is often minimal.