Are you classified as a merchant? If so, what level (1, 2, 3, 4)?

This question is asking whether your organization is classified as a 'merchant' under the Payment Card Industry Data Security Standard (PCI DSS), and if so, what merchant level you fall under. A 'merchant' in PCI DSS terms is any entity that accepts payment cards (credit/debit cards) as payment for goods or services. The merchant levels (1-4) are determined primarily by the volume of card transactions processed annually: - Level 1: Merchants processing over 6 million card transactions annually - Level 2: Merchants processing 1-6 million card transactions annually - Level 3: Merchants processing 20,000-1 million e-commerce transactions annually - Level 4: Merchants processing fewer than 20,000 e-commerce transactions or up to 1 million regular transactions annually This question is being asked in a security assessment because different merchant levels have different PCI DSS compliance requirements. Higher transaction volumes (Level 1) require more rigorous security controls and validation procedures, including mandatory annual on-site assessments by a Qualified Security Assessor (QSA). Lower levels may self-assess using the Self-Assessment Questionnaire (SAQ). When answering this question, you should: 1. Clearly state whether your organization accepts payment cards 2. If yes, specify your merchant level based on transaction volume 3. Mention any relevant compliance validations you maintain (e.g., ROC, SAQ) 4. If you're not a merchant but still handle card data (e.g., as a service provider), clarify that distinction