This has been rumored for a while, and turned out to be true. Here is a relevant updated table from the Mastercard site:
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgr_jdqcuuwWajw1pM9-Hjv-MpP9vfXtmCWoYSZCsb1WokIbrf0fETFPAx8D8cbdCEPoseztcKtND85iO8T_BC8XL0rySX9AWRmaF8uxPKITM5RJ1xbaR2japQ2XCSBw4TjU6Av/s320/PCI-levels.jpg)
Obviously, awesome news for security! Now folks who are hell-bent on not having any concerns for customer data will need to deceive an actual live QSA rather than simply lie on their SAQ...