U.S. merchant compliance with the Payment Card Industry Data Security Standard has changed little since last fall, according to data from Visa Inc.
Visa's compliance update for the fourth quarter, which was released Tuesday, showed that 96% of Level 1 merchants — those with 6 million or more Visa transactions per year — had been validated as PCI-compliant, down from 97% in the previous quarter.
The 360 Level I merchants generated half of Visa's transaction volume.
The compliance rate for Level 2 merchants, those with 1 million to 6 million transactions per year, was unchanged at 94%. There are 895 Level 2 merchants, which produced 13% of Visa's volume.
Visa said compliance among Level 3 merchants was "moderate," the same term it used in the third quarter. The Level 3 designation is for merchants that have 20,000 to 1 million online transactions per year. A Visa representative said it does not provide specific compliance rates for the group because the number of e-commerce companies fluctuates significantly from quarter to quarter. There were 2,524 Level 3 merchants in the fourth quarter and they produced less than 5% of Visa's volume.
Level 4 merchants, by far the largest group with an estimated 5 million merchants, also were steady at "moderate" compliance. They each have fewer than 1 million transactions per year, and collectively generated 32% of Visa's volume.
Visa has said that improving compliance among small merchants is an important goal.
It also said that compliance among the 75 processors that connect to its VisaNet authorization network fell to 91% from 97% in the third quarter.
