By Mark Brady, CSRSI Team Member

There appears to be some debate among some Card Processors about the card association requirements for Level 4 merchants to be PCI compliant.

Level 4 merchants are those that process less than 20,000 MasterCard or Visa e-commerce transactions annually and all other merchants processing up to 1 million MasterCard or Visa transactions annually.  Level 4 merchants include the lower volume card processing merchants in a processor’s portfolio.

Both MasterCard and Visa are very clear that all merchants, including Level 4 merchants, must be PCI compliant.  See the following from the Visa PCI web site:      

VISA CISP (PCI) Overview

PCI DSS compliance is required of all entities that store, process, or transmit Visa cardholder data, including financial institutions, merchants and service providers.

Additionally, in the same Visa site under the “merchant” heading:

Merchants

Acquirers are responsible for ensuring that all of their merchants comply with the PCI Data Security Standard (DSS) requirements.

As more and more card processors have discovered, the best way to ensure required PCI compliance is the completion of the Security Assessment Questionnaire and additionally, where required, a site scan.

The PCI Toolkit® is the best way for card processors to assist their merchants in completion of the Security Assessment Questionnaire.  The PCI Toolkit® is an interactive system which enables merchants to proceed at their own pace and provides the educational tools and policies required and necessary to complete PCI compliance accurately. The PCI Toolkit® documents individual merchants' (MID) compliance progress and stores the merchant compliance attestation for future reference.

The PCI ToolKit® is a service provided to banks, acquirers and payment processors, also known as ISOs, for their merchants. If you are interested to learn more, go to PCI ToolKit® to schedule your live Toolkit demo.