An organization’s ‘level’ depends on how many payment card transactions they handle.
Level One is for those processing over six million transactions per year. Level One merchants and service providers must be annually assessed by a competent third party or QSA
Level 2: Merchants that process one to six million transactions annually
Level 3: Merchants that process 20,000 to one million transactions annually
Level 4: Merchants that process fewer than 20,000 transactions annually.