Evan Schuman's StorefrontBacktalk

The latest PCI compliance stats—which were released by Visa on Friday (Feb. 24)—show almost no meaningful change from the prior report (released last September), with Level 1s holding at 98 percent, Level 2s holding at 91 percent, Level 3s growing slightly from 57 percent to 58 percent and Level 4s still secretly holding at “moderate.”

The Level 3 figures are somewhat interesting, in that Visa only started to report those figures as of last summer. Its first report put Level 3 compliance at 60 percent (as of June 30, 2011), which dropped three months later (September 30) to 57 percent. The latest December 31 figures show a slight recovery to 58 percent. Given that even 60 percent was disappointing for PCI compliance, Level 3s clearly need more work.

The 60 retailers using VisaNet Processor (Direct Connection) saw that group’s compliance drop slightly, from 100 percent to 98 percent, while its population size dropped trivially from 61 (as of September 30, 2011) to 60 (as of December 31, 2011).

Agent (Downstream) compliance sharply increased during the identical timeframe, from 83 percent to 93 percent, as its population size grew from 1,262 to 1,367. Increasing in compliance sharply at the same time as the population grows more than 8 percent is a double PCI win.

The Level 1 population dropped ever so slightly—from 407 in September to 404 in December—and the Level 2 population grew by six merchants—from 1,060 to 1,066. Level 3s also improved their compliance—albeit slightly—while the population increased by exactly 100 merchants, from 3,049 to 3,149. Level 4 population numbers do not appear to be meaningful; Visa consistently reports the figure as “~5,000,” with no indication of how much wiggle room ~ gives.

Level 1 chains process more than six million Visa transactions a year, Level 2s process from one to six million and Level 4s process fewer than one million such transactions, while Level 3s handle 20,000 to one million online Visa transactions a year.