Level 4 PCI compliance cost 2026: small-merchant pricing read

The Level 4 definition and why it covers most merchants

Level 4 is defined by Visa and Mastercard as fewer than 20,000 e-commerce transactions per year, or up to 1 million total transactions per year across all channels. It is the largest merchant tier by count: the vast majority of merchants worldwide are Level 4. American Express, Discover, and JCB do not publish a separate Level 4 tier, so for most small merchants the Visa and Mastercard definition is the one that matters. Despite the low volume, a Level 4 merchant still has a real PCI obligation: an annual SAQ, quarterly ASV scanning where internet-facing systems are in scope, and an Attestation of Compliance.

The reason Level 4 compliance is usually cheap is that the obligation tracks the payment setup, not the transaction count, and most small merchants use a processor that absorbs the heavy scope. A merchant on Stripe Checkout, Square, or PayPal hosted qualifies for SAQ A, the shortest questionnaire, because cardholder data never touches the merchant's own systems. The cost question at Level 4 is almost entirely a question of which SAQ the payment setup forces, and the cheapest answer is nearly always a fully hosted checkout.

Full Level 4 cost decomposition

Anchored to processor PCI-fee schedules (Stripe and Square charge no PCI fee), bundled SAQ-plus-ASV product pricing from SMB providers, and the PCI SSC SAQ document set. Merchant-level thresholds per PCI SSC and the Visa/Mastercard merchant-level definitions.

Three concrete Level 4 scenarios

Scenario one. A solo e-commerce store on Shopify Payments with 8,000 transactions per year, all payments hosted by Shopify. Year-one total: $0 to $300. The merchant completes a short SAQ A through the acquirer portal (or a bundled product), no ASV scan is required because no in-scope internet-facing payment systems exist, and Shopify and the processor handle the rest. This is the practical floor for Level 4 and where most small online merchants land.

Scenario two. A small bricks-and-mortar cafe with 60,000 card-present transactions per year through a Square reader. Year-one total: $0 to $500. Square charges no PCI fee and provides the SAQ workflow; the merchant completes a short SAQ (typically SAQ A for Square's hosted model) and inspects the reader for tampering. The only realistic cost is time, plus an optional consultant review.

Scenario three. An independent retailer with 200,000 transactions per year across two locations using IP-connected terminals on a shared network, requiring SAQ B-IP and quarterly ASV scanning. Year-one total: $2,000 to $5,000. SAQ B-IP completion with optional consultant assist $500 to $2,000, quarterly ASV scanning $400 to $1,200, network segmentation tidy-up $1,000 to $2,000 in year one, plus terminal inspection process. This is the upper end of typical Level 4 spend, driven by the card-present network scope.

Level-4-specific cost levers

Three levers cover nearly all Level 4 cost reduction. First, move to a fully hosted checkout (Stripe Checkout, Square, PayPal, Shopify Payments) to qualify for SAQ A, the shortest and cheapest path; this is the highest-leverage move for any online Level 4 merchant on a custom setup. Second, complete the SAQ promptly to kill the monthly non-compliance fee. Third, right-size the SAQ: many small merchants complete a longer SAQ (C or even D) when their payment setup actually qualifies for a much shorter one, paying in both time and consultant fees for scope they do not have.

What almost no Level 4 merchant needs is a compliance-automation platform. A Vanta, Drata, Secureframe, or Sprinto subscription starts well above the entire Level 4 compliance budget. Automation platforms earn their keep on SAQ D scope and multi-framework programs, not on a small merchant's short SAQ A. For a Level 4 merchant, a bundled SAQ-plus-ASV product at $300 to $1,000 per year is the right tool.