PCI Compliance for California Businesses: Levels, SAQs, and Fines

PCI compliance for California businesses is one of those obligations that most owners sign off on once a year without fully understanding what they attested to. The Payment Card Industry Data Security Standard (PCI DSS) is not a state or federal law. It is a contractual requirement that flows from Visa, Mastercard, Discover and American Express through your acquiring bank and processor to you. But in California, a breach of card data quickly becomes a legal matter under the state's breach-notification statute and CCPA/CPRA. This guide explains merchant levels, self-assessment questionnaires, what non-compliance actually costs, and how to make the whole thing smaller.

What PCI DSS actually requires

PCI DSS is a set of security requirements covering networks, systems, access controls, monitoring and policies for any environment that stores, processes or transmits cardholder data. The current major version is 4.x, with requirements that became mandatory in 2025; check the current version with your processor. The standard applies to every merchant that accepts cards, from a single terminal at a taco truck in Fresno to a Los Angeles e-commerce company. What differs is how you prove compliance.

Merchant levels: set by volume

Each card brand defines merchant levels by annual transaction count, and the levels determine whether you self-assess or bring in an outside assessor. In broad terms:

• Level 1: over six million transactions per year on a single brand, or any merchant the brand designates after a breach. Requires an annual on-site assessment by a Qualified Security Assessor and a Report on Compliance.
• Level 2: roughly one to six million transactions. Annual self-assessment questionnaire, sometimes with an assessor depending on the brand.
• Level 3: roughly 20,000 to one million e-commerce transactions. Annual SAQ and quarterly network scans if applicable.
• Level 4: everyone else. Annual SAQ and scans as applicable.

The exact thresholds vary by brand and change occasionally, so confirm with your processor. Most California small and mid-sized businesses are Level 4 or 3.

SAQs: set by how you accept cards

The self-assessment questionnaire type depends on your acceptance channels, and choosing the right one matters because the difference between a 20-question form and a 300-question form is real. Common types:

• SAQ A: e-commerce or mail/phone merchants who fully outsource card handling to a validated third party (for example, a hosted payment page or hosted fields), with no card data touching your systems.
• SAQ A-EP: e-commerce merchants whose website affects the security of the payment page even though a third party processes the card.
• SAQ B and B-IP: standalone dial-out or IP-connected terminals with no electronic card storage.
• SAQ P2PE: merchants using a validated point-to-point encryption solution.
• SAQ C and C-VT: payment applications or virtual terminals on internet-connected systems.
• SAQ D: everyone else, including anyone who stores card data. This is the long one.

The strategy is obvious once you see the list: keep card data out of your environment and qualify for the shortest SAQ. Hosted checkout, tokenization for cards on file, and terminals that encrypt at the point of interaction are how most businesses get there. Our guide to PCI Compliance for High-Risk Merchants covers the version of this for merchants under closer scrutiny.

What non-compliance actually costs

There are two different cost buckets. The first is routine: most processors charge a monthly PCI non-compliance fee when a merchant fails to complete the annual attestation, on top of a regular PCI program fee. It is avoidable and irritating. The second is the breach scenario: a forensic investigation by a PCI Forensic Investigator at your expense, fines and assessments levied by the card brands on your acquirer and passed to you under your merchant agreement, the cost of reissuing compromised cards, and potential termination and MATCH listing. Those numbers scale with the size of the breach and are not something anyone can quote in advance.

Where California law overlaps

PCI is contractual, but a breach in California triggers statutory obligations. The state's breach-notification law requires notice to affected residents when unencrypted personal information, which includes payment card numbers with access codes, is compromised. CCPA/CPRA gives consumers a private right of action for certain data breaches resulting from a failure to maintain reasonable security, which is a meaningful litigation exposure for any business over the applicable thresholds. Reasonable security is not defined by PCI, but PCI compliance is commonly cited as evidence of it. Confirm your specific obligations with counsel; the point is that PCI failures in California are not just a processor problem.

A practical compliance routine

1. Map every place a card number could touch: terminals, website, phone orders, saved cards, paper forms, email.
2. Eliminate as many as possible: hosted pages, tokenization, no writing numbers on paper, no card numbers in email.
3. Confirm your SAQ type with your processor and complete it on a fixed date each year.
4. Run quarterly external scans if your SAQ requires them.
5. Train staff: phone-order desks and front counters are where numbers leak.
6. Keep the attestation on file and calendar the renewal so the non-compliance fee never appears.

PCI compliance for a California business is less about passing a test than about deciding how much card data you are willing to be responsible for. The answer for most businesses is as little as possible. Shrink the scope, pick the right SAQ, complete it on schedule, and treat California's breach and privacy laws as the reason the effort is worth it.