What Are the Service Provider Levels

It’s important to note that a merchant that accepts payment cards as payment for goods and/or services can also be a service provider if the goods and/or services sold result in the storing, processing or transmitting of cardholder data (CHD) on behalf of other merchants or service providers.  For example, an Internet service provider (ISP) is a merchant that accepts payments for the provision of Internet access i.e., its own services, but may also be considered a service provider if it provides hosting services to merchants processing their own payments.

Service providers, on the other hand, don’t always know that they are service providers and consequently, are not aware of their responsibilities.  As we said above, a service provider is a business entity that is not a payment brand, directly involved in the processing, storing or transmitting of CHD on behalf of another entity.

The processes involved in the validation of compliance for service providers vary according to payment card brand.  Validation and reporting requirements for service providers are defined according to the service provider level (i.e,. the transaction volume and/or type of service provider).

Visa, Mastercard, American Express, UnionPay and Discover categorise service providers according to these criteria.  Additionally, these same brands have two or more distinct service provider levels that are defined by transaction volume.  JCB does not categorise service providers according to transaction volume.

In general, there are 2 ways in which a service provider can validate its PCI compliance:

If a service provider processes, stores and/or transmits transactions for JCB, or if the service provider processes, stores and/or transmits more than 300,000 Visa, Mastercard, American Express, UnionPay or Discover transactions, it is considered a Level 1 service provider.  These Level 1 service providers must obtain an annual RoC, prepared by a QSA, and undergo quarterly vulnerability scanning by an ASV.

If the service provider processes, stores and/or transmits fewer than 300,000 Visa, Mastercard, American Express, UnionPay or Discover transactions, it is considered a Level 2 service provider.  These service providers must validate their PCI compliance by preparing SAQ D (variant specific to service providers) and undergo quarterly vulnerability scans by an ASV.

So, hopefully, that has provided some much-needed clarity.  The key point is to understand what you are i.e., a merchant or service provider, and then your transaction levels per brand.  It is important that you don’t just look at the volume of transactions you are doing today.  What are your growth plans?  Do you expect to fall into the next bracket next year?  If yes, focus your compliance programme on the next level up.

‍