Security Rules and Procedures—Merchant Edition • 7 February 1 August 2023 means by which a Merchant may validate PCI DSS compliance if implementing secure technologies. The Acquirer must ensure, with respect to each of its Merchants, that “transition” from one PCI level to another (for example, the Merchant transitions from Level 4 to Level 3 due to Transaction volume increases), that such Merchant achieves compliance with the requirements of the applicable PCI level as soon as practical, but in any event not later than one year after the date of the event that results in or causes the Merchant to transition from one PCI level to another. All Level 1, Level 2, and Level 3 Merchants that use any third party-provided payment applications or payment software must validate that each payment application or payment software used is listed on the PCI Security Standards Council (SSC) website at www.pcisecuritystandards.org as compliant with either the Payment Card Industry Payment Application Data Security Standard (PCI PA- ¶ DSSPA-DSS) or the PCI Secure Software Standard, as applicable. Mastercard ¶ recommends that Merchants use a Qualified Integrator & Reseller (QIR) listed on ¶ the PCI SSC website to implement a PCI PA-DSS-compliant payment application, ¶ as applicable. Mastercard recommends that Merchants using third party-provided payment ¶ software ensure the payment software vendor complies with the PCI Secure SLC ¶ Standard. Mastercard recommends that any Merchant that performs or provides 3-D Secure ¶ (3DS) functions as defined in the EMV 3-D Secure Protocol and Core Functions ¶ Specification comply with the PCI 3DS Core Security Standard and use approved ¶ 3DS Software Development Kits (SDKs) listed on the PCI SSC website, as ¶ applicable. Level 1 Merchants A Merchant that meets any one or more of the following criteria is deemed to be a ¶ Level 1 Level 1 Merchant and must validate compliance with the PCI DSS: • Any Merchant having greater than six million total combined Mastercard and ¶ Maestro Transactions annually, • Any Merchant meeting the Level 1 criteria of Visa, and • Any Merchant that Mastercard, in its sole discretion, determines should meet ¶ the Level 1 the Level 1 Merchant requirements to minimize risk to the system, which may ¶ include any Merchant that has a confirmed ADC Event. To validate compliance, each Level 1 Merchant must successfully undergo an ¶ annual PCI DSS assessment resulting in the completion of a ROC conducted by a ¶ PCI SSC-approved Qualified Security Assessor (QSA) or PCI SSC-certified Internal ¶ Security Assessor (ISA). Level 2 Merchants Unless deemed to be a Level 1 Merchant, the following are deemed to be a Level 2 ¶ Merchant Merchant and must validate compliance with the PCI DSS: • Any Merchant with greater than one million but less than or equal to six million ¶ total combined Mastercard and Maestro Transactions annually, and • Any Merchant meeting the Level 2 criteria of Visa. Cybersecurity Standards and Programs Level 1 Merchants Security Rules and Procedures—Merchant Edition • 1 August 2023 To validate compliance, each Level 2 Merchant must successfully complete an ¶ annual SAQ. Level 2 Merchants completing SAQ A, SAQ A-EP or SAQ D must ¶ additionally engage a PCI SSC-approved SSC- approved QSA or PCI SSC-certified ISA for ¶ compliance validation. Level 2 Merchants may alternatively, at their own discretion, engage a PCI SSC- ¶ approved SSC-approved QSA or PCI SSC-certified ISA to complete a ROC instead of performing ¶ an SAQ. ¶ Cybersecurity Standards and Programs ¶ Level 1 Merchants ¶ Security Rules and Procedures—Merchant Edition • 7 February 2023 Level 3 Merchants Unless deemed to be a Level 1 or Level 2 Merchant, the following are deemed to be ¶ a Level 3 Merchant and must validate compliance with the PCI DSS: • Any Merchant with greater than 20,000 but less than or equal to one million ¶ total combined Mastercard and Maestro electronic commerce (e-commerce) ¶ Transactions annually, and • Any Merchant meeting the Level 3 criteria of Visa. To validate compliance, each Level 3 Merchant must successfully complete an ¶ annual SAQ. Level 3 Merchants may alternatively, at their own discretion, engage a PCI SSC- ¶ approved SSC-approved QSA to complete a ROC instead of performing an SAQ. Level 4 Merchants Any Merchant not deemed to be a Level 1, Level 2, or Level 3 Merchant is deemed ¶ to be a Level 4 Merchant. Compliance with the PCI DSS is required for a Level 4 ¶ Merchant, although validation of compliance is optional for a Level 4 Merchant. ¶ However, a validation of compliance is strongly recommended for Acquirers with ¶ respect to each Level 4 Merchant in order to reduce the risk of an ADC Event and ¶ for an Acquirer potentially to gain a partial waiver of related assessments. A Level 4 Merchant may validate compliance with the PCI DSS by successfully ¶ completing an annual SAQ. Level 4 Merchants may alternatively, at their own discretion, engage a PCI SSC- ¶ approved SSC-approved QSA to complete a ROC instead of performing an SAQ.