PCI Compliance Fees: What You Owe and What to Contest
The difference between a PCI compliance fee and a PCI non-compliance fee, what the PCI standard asks of small merchants, and how to stop paying the penalty.
By Are You Losing Money editorial team · Updated · 5 min read
Short answer
PCI DSS is the card industry's data security standard, and every business that accepts cards must follow it. Processors often charge a yearly or monthly PCI program fee and add a larger monthly non-compliance fee when you have not completed your annual self-assessment questionnaire. Completing the questionnaire usually stops the non-compliance fee, and the program fee itself is often negotiable.
Key takeaways
- The PCI Security Standards Council writes the standard. It does not bill merchants; PCI fees on your statement are processor charges.
- A non-compliance fee is a penalty for a missing annual questionnaire, and it usually stops once you complete it.
- Most small merchants qualify for one of the shorter questionnaires, especially when card data never touches their own systems.
- Ask for the program fee to be waived when you negotiate. Many processors agree.
What PCI DSS is
PCI DSS stands for Payment Card Industry Data Security Standard. It is a set of security requirements for any business that stores, processes, or transmits card data. The standard is maintained by the PCI Security Standards Council, which was founded by the major card networks, and it is currently in its fourth major version.
Compliance is required by your merchant agreement, which ties you to the card network rules. Your processor is responsible for confirming that its merchants are compliant, and that responsibility is where the fees come from.
The PCI charges you may see
| Charge | What it is | How it appears |
|---|---|---|
| PCI program or compliance fee | The processor's charge for running its compliance program, portal, and scanning tools | A yearly charge or a small monthly fee |
| PCI non-compliance fee | A penalty for not completing your annual questionnaire or required scans | A monthly fee, often larger than the program fee |
| Breach protection or security plan | Optional coverage toward costs after a data breach | A monthly fee, sometimes added by default |
The Council does not charge merchants any of these. They are set by your processor, and the amounts vary widely from one processor to the next. Our list of statement fees worth questioning covers how they compare with other add-on charges.
The self-assessment questionnaire
Small and mid-size merchants prove compliance with a self-assessment questionnaire, known as an SAQ. There are several versions, and the right one depends on how card data moves through your business:
- SAQ A: for online businesses that send all card entry to a third-party payment page or hosted fields, so card data never touches their own servers.
- SAQ B: for merchants using standalone terminals that connect by phone line.
- SAQ B-IP: for merchants using standalone terminals that connect over the internet.
- SAQ C-VT: for merchants typing card numbers into a processor's web-based virtual terminal on an isolated computer.
- SAQ P2PE: for merchants using a validated point-to-point encryption solution.
- SAQ D: the full questionnaire, for anyone who does not fit a shorter version.
Some versions also require quarterly network scans by an approved scanning vendor. Your processor's compliance portal asks a few questions about your setup and point you to the right form. The PCI Council's document library has every version if you want to read one first.
How to stop paying the non-compliance fee
- Find your processor's PCI portal. Look for the login details in your welcome email or on the processor's website. Many processors use an outside compliance company to run the portal.
- Answer the setup questions accurately. They determine which questionnaire you get, and a wrong answer can leave you attesting to the wrong form.
- Complete the questionnaire and attestation. For a business with a modern terminal and no stored card data, this often takes less than an hour.
- Run any required scans. The portal will tell you if your questionnaire type requires them.
- Check your next statement. The non-compliance fee should stop. If it does not, call and ask for it to be removed.
- Ask for a refund of recent penalties. Processors do not always agree, but asking costs nothing, especially if you never received clear instructions.
Set a reminder for the same month next year. The questionnaire must be renewed annually, and the penalty returns if you miss the date.
Can you negotiate the PCI program fee?
Often, yes. The program fee is processor revenue, and processors waive it regularly for merchants who ask during a pricing review or who has a competing quote. Our plan for negotiating lower processing fees shows how to bundle it with your other requests.
Breach protection plans deserve a closer look too. If one appears on your statement and you did not choose it, ask what it covers and whether you can opt out. You may already have similar coverage through a business insurance policy.
Reduce your PCI scope and you reduce the work
The less card data touches your systems, the shorter your questionnaire. A few practical choices make a large difference:
- Use terminals that encrypt the card data from the moment the card is tapped or inserted.
- Online, use your processor's hosted payment page or hosted fields so card numbers never reach your server.
- Never store full card numbers in spreadsheets, notes, or email. Use your processor's tokenized card-on-file feature for repeat customers.
- Retire old terminals that no longer receive security updates.
These steps lower your risk of a breach, which is the real cost PCI exists to prevent. A breach can bring card network penalties, forensic investigation costs, and lost customer trust that far exceed any monthly fee.
Frequently asked questions
Does PCI compliance apply to small businesses?
Yes. Every business that accepts card payments must comply with PCI DSS, whatever its size. Smaller merchants validate with a self-assessment questionnaire instead of an outside audit.
Is the PCI fee on my statement a government fee?
No. PCI DSS is an industry standard, and the PCI Security Standards Council does not bill merchants. PCI program, non-compliance, and breach protection fees are charges set by your processor.
What happens if I ignore the non-compliance fee?
You keep paying it every month, and you remain out of compliance with your merchant agreement. If a breach happens while you are non-compliant, your exposure to penalties and investigation costs grows.
How long does the self-assessment questionnaire take?
For a small business using modern terminals or a hosted online checkout, often under an hour. The full SAQ D for businesses that handle card data on their own systems takes much longer.
Sources
Want a specialist to check your statement?
Leave your number and a specialist will review your processing statement for free, then walk you through what you pay. You never have to switch.