PCI has 4 Tiers or levels

Level 1

Any merchant (regardless of acceptance channel) processing over 6,000,000 Visa or MasterCard transactions per year. Any merchant that has suffered a hack or an attack that resulted in an account data compromise. Any merchant that either Visa or MasterCard, in their sole discretion, determine should meet the Level 1 merchant requirements to minimize risk to the system

Level 2

Any merchant (regardless of acceptance channel) processing

1,000,000 to 6,000,000 Visa or MasterCard transactions per year.

Level 3

Any merchant processing 20,000 to 1,000,000 Visa or MasterCard ecommerce transactions per year.

Level 4

Any merchant processing fewer than 20,000 Visa or MasterCard ecommerce transactions per year, and all other merchants (regardless of acceptance channel) processing up to 1,000,000 Visa or MasterCard transactions per year.