PCI compliance requirements are divided into four levels, and the level a business falls under is determined by the number of payment card transactions it processes annually. The levels are based on the annual volume of payment card transactions processed by a business, as follows: Level 1: Businesses that process over 6 million payment card transactions annually or those that have been identified as high risk by the payment card brands. Level 2: Businesses that process between 1 and 6 million payment card transactions annually. Level 3: Businesses that process between 20,000 and 1 million payment card transactions annually. Level 4: Businesses that process fewer than 20,000 payment card transactions annually. The higher the level, the more stringent the PCI compliance requirements and the more rigorous the audit process. For example, Level 1 businesses are subject to an annual on-site audit conducted by a Qualified Security Assessor (QSA), while Level 4 businesses may be able to self-assess their compliance using a PCI DSS self-assessment questionnaire (SAQ). It is important for businesses to determine their level of PCI compliance and ensure they are meeting all relevant requirements to protect payment card data and avoid penalties for non-compliance.