To determine what level of PCI compliance is required, we must first break up companies into merchants and service providers as the agreement is different for the two.