It's likely they would need on-site visits from a QSA if they wanted to go all the way into this. Valve would fall into the Level 1 compliance category. Self-re

It's likely they would need on-site visits from a QSA if they wanted to go all the way into this. Valve would fall into the Level 1 compliance category. Self-reporting won't work for that kind of transaction volume.