Visa Changes CISP/PCI Merchant Definitions

Evan Schuman reports for eWeek on changes by Visa USA effective July 18th to the merchant levels for its Cardholder Information Security Program. The article reports that Visa has changed the definition of Level 2 so that it applies to all merchants not just ecommerce merchants. Level 2 is defined as any merchant processing 1,000,000 to 6,000,000 Visa transactions per year. Level 1 continues to apply to all merchants regardless of acceptance channel while Levels 3 and 4 continue to apply only to ecommerce merchants. According to the table on the Visa web site, merchants newly included in the Level 2 definition will have until Sept. 30, 2007 to be validated as complying with the PCI Data Security Standard.