This is something that is often confused. There are no ‘levels’ of compliance, an organisation is either compliant or non-compliant to the requirements of PCI DSS. The ‘levels’ are based on the number of transactions an organisation processes annually, and these levels vary depending on the card brand, and whether you are a merchant, service provider, or both. So, a ‘Level 1 Compliant’ merchant is simply a merchant that has been assessed to be compliant by a QSA that has a large number of transactions. For example, Visa defines a Level 1 merchant as processing over 6 million Visa transactions, across all channels, and a Level 1 Service provider as storing, processing, or transmitting over 300,000 transactions per year.