Are you classified as a merchant? If so, what level (1, 2, 3, 4)?

Your standing under PCI DSS is at issue: whether you are classified as a merchant and, if so, which merchant level (1, 2, 3, or 4) applies to you.

A 'merchant' in PCI DSS terms is any entity that accepts payment cards (credit/debit cards) as payment for goods or services. The merchant levels (1-4) are determined primarily by the volume of card transactions processed annually:

- Level 1: Merchants processing over 6 million card transactions annually
- Level 2: Merchants processing 1-6 million card transactions annually
- Level 3: Merchants processing 20,000-1 million e-commerce transactions annually
- Level 4: Merchants processing fewer than 20,000 e-commerce transactions or up to 1 million regular transactions annually

This question is being asked in a security assessment because different merchant levels have different PCI DSS compliance requirements. Higher transaction volumes (Level 1) require more rigorous security controls and validation procedures, including mandatory annual on-site assessments by a Qualified Security Assessor (QSA). Lower levels may self-assess using the Self-Assessment Questionnaire (SAQ).

When answering this question, you should:

1. Clearly state whether your organization accepts payment cards
2. If yes, specify your merchant level based on transaction volume
3. Mention any relevant compliance validations you maintain (e.g., ROC, SAQ)
4. If you're not a merchant but still handle card data (e.g., as a service provider), clarify that distinction