This question is best directed to your acquiring bank, as they will clearly set out their requirements for you to attest your compliance to PCI DSS. However, the basis for needing a ROC completed by a QSA is normally defined by the number of annual transactions you take per card brand. Each card brand has slightly different levels and requirements for merchants and service providers, so the requirements of each brand you accept should be consulted. Typically, though, Level 1 (and sometimes level 2) merchants, and Level 1 Service Providers, would need a Report on Compliance. Below that, merchants and service providers can usually self-assess. That said, many organisations use a QSA to assist with SAQ.