What PCI is, and who is behind it
PCI stands for the Payment Card Industry Data Security Standard, usually written PCI DSS. It is a set of security rules for anyone who stores, processes or sends card data. It is written by the PCI Security Standards Council, which calls itself "a global forum that brings together payments industry stakeholders" [1]. The current version is PCI DSS v4.0.1, a limited revision of version 4.0 [1].
The Council's founding members are American Express, Discover, JCB International, Mastercard and Visa, and each runs its own compliance program [2]. Size does not exempt you. The Council says PCI DSS is "intended for all entities involved in payment processing, including merchants, regardless of their size or transaction volume" [2]. It also notes that small merchants usually have simpler setups, which means less work to comply.
Three roles, three jobs
The PCI Security Standards Council writes the standard. It does not enforce it [3].
The card brands decide who must validate and set any fines [4].
Your acquirer (your processor's bank) collects your validation and passes costs to you under your contract [5][10].
Why your processor charges a PCI fee at all
Visa puts the duty on its member banks, and they pass it down. Visa's rules require each member to make sure its merchants comply with PCI DSS and to "report and verify to Visa, at least every 6 months, its Merchants' status of PCI DSS compliance" [6]. If Visa finds a member deficient in protecting card data, it may impose a non-compliance assessment on the member [6].
That cost flows to you by contract. The First Data and Wells Fargo program guide we read says you agree to pay "all fees, fines and other charges imposed on us by a Payment Network with respect to your acts or omissions" [10]. The PCI fee on your statement is the processor's way of paying for its compliance program, and the non-compliance fee is its way of pushing merchants to file.
Compliance can also touch your rates at the very top end. Visa's lowest retail credit interchange tiers (its performance thresholds) list PCI compliance as a requirement, alongside volume minimums in the billions of dollars [7]. Those tiers are for the largest retailers, but they show how seriously the networks treat it.
PCI compliance fee vs PCI non-compliance fee
| PCI compliance fee | PCI non-compliance fee | |
|---|---|---|
| When it is charged | Monthly or yearly, whether or not you have filed | Every billing cycle until you submit proof of compliance [8] |
| What it pays for | The processor's compliance program: the SAQ portal, scanning tools, reminders | Nothing new; it is a penalty to get the paperwork in |
| Can you avoid it? | Only by choosing a processor that does not charge one, such as Helcim at $0 [9] | Yes: file your SAQ and any required scans [8] |
| What to ask | What exactly does this fee include? | What deadline did I miss, and what do I submit? |
Stripe's guide says acquiring banks typically charge between $25 and $50 a month for non-compliance, and that unresolved cases can lead to fines of $5,000 to $100,000 a month after six months [8]. Those larger figures are network fines assessed on the acquirer; whether and how they reach you depends on your contract [10]. The everyday cost for most small shops is the monthly fee, and at $25 to $50 a month it adds up to $300 to $600 a year for a form that, with a hosted checkout, Stripe says often takes under an hour [8].
How to stop a PCI non-compliance fee
- Ask your processor which validation it needs from you. The Council says merchants should ask the acquiring bank they have an agreement with whether they must validate and how [5].
- Find your SAQ type. Stripe's guide notes there are several, and that a business using a fully hosted checkout where card data never touches its own systems usually qualifies for SAQ A, the shortest form [8].
- Reduce what touches your systems first. A PCI-listed point-to-point encryption (P2PE) solution "can significantly reduce" the requirements that apply, although it does not remove PCI entirely [2].
- Complete the questionnaire honestly and run any required vulnerability scans through an Approved Scanning Vendor [8].
- Sign the Attestation of Compliance and upload it to your processor's portal. Ask for written confirmation that the fee stops next cycle.
- Put a yearly reminder on your calendar. In the program guide we read, the American Express data security section asks merchants to validate "annually and quarterly" [10].
If you cannot meet every requirement yet, do not just stop answering. The American Express data security section of the program guide we read asks a non-compliant merchant to submit an action plan and set a remediation date "not to exceed 12 months" [10]. A plan on file is far better than silence.
What PCI actually asks of a small business
For most small merchants, PCI comes down to a few habits. Visa's rules list data merchants must never store after a sale is approved, including the full contents of the magnetic stripe, the security code on the back of the card (CVV2) and PINs [6]. Beyond that:
- Use terminals and payment apps your processor certifies, and keep their software updated.
- Let the processor or gateway hold card numbers. Do not write them down or keep them in spreadsheets or email.
- Change default passwords on your router, POS and terminals, and give each employee their own login.
- Keep the payment network separate from guest Wi-Fi.
- If anything looks wrong, call your processor the same day.
Fewer places where card data lives means a shorter questionnaire and a smaller risk. That is the cheapest PCI plan there is.
Count PCI costs when you compare processors
A low rate with a PCI program fee, a non-compliance fee you keep paying, and a separate scanning fee can cost more than a slightly higher rate with none. When you compare offers, ask each processor three questions: is there a PCI fee and how much, is there a non-compliance fee and how much, and what tools do you give me to file?
BatchOut, our own processing service, lists every monthly fee, PCI included, when it reviews a statement. Our guides to reading a merchant statement and lowering processing fees show where these lines hide.