Under Mastercard's new rules concerning merchant level definitions, apparently companies that were previously level 4 merchants (and did not have to do a PCI assessment unless requested by their acquiring bank) have been converted to level 3 merchants (which do need to conduct at least a self assessment).   More details here.Mastercard announces fine regime for PCI non-compliance:  details here from Branden Williams of Verisign: LINK.