The number of Bitcoin network confirmations required for a particular transaction to be considered complete is determined by the BitPay account holder on a transaction-by-transaction basis.
Entities set the Risk/Speed of a transaction to "Low" (6 confirmations), "Medium" (3 confirmations), or "high" (1 confirmation) via the API when an invoice is created. The entity's default Risk/Speed setting for new transactions can also be changed in the merchant's settings after logging in.
For clarity, due to the way in which the Bitcoin network secures transactions, "speed" correlates directly with "risk" in that the entity is taking a (relatively) high risk by only waiting for a single confirmation before releasing the product or service. The entity can decrease its risk that the payment will become invalid by waiting for further confirmations that the rest of the network accepts the transaction. This is a choice the bitcoin acceptor must make, weighing the risk of losing the payment vs keeping the buyer happy (by giving him/her the product faster).