PCI Compliance Fees Explained: What You Pay and What You Must Do
What PCI DSS requires of small merchants, why processors charge PCI program and non-compliance fees, how self-assessment questionnaires work and how to avoid penalties.
PCI compliance means following the Payment Card Industry Data Security Standard (PCI DSS), a set of security requirements for any business that accepts, stores, processes or transmits card data. The standard itself is set by the PCI Security Standards Council, not by your processor, but processors collect the proof of your compliance and many charge a monthly or annual PCI program fee, plus a larger non-compliance fee if you do not complete your annual validation. Completing the questionnaire on time is usually the cheapest fix, and choosing payment tools that keep card data away from your systems makes it far simpler.
Who sets the rules and who charges the fee
The card brands, including Visa, Mastercard, Discover, American Express and JCB, founded the PCI Security Standards Council, which publishes PCI DSS. Merchants must comply under their agreements with the acquirer. The standard is not a federal law, although some states reference it in data-security or breach laws. Fees come from your processor or ISO for the tools and reporting it provides, and for penalties it applies, which are set by your contract, not by the Council.
That is why PCI charges differ widely. One provider may offer free compliance tools, another may charge a monthly fee for a portal, and a third may charge a penalty if you do not log in and finish the questionnaire.
The standard in 2026
PCI DSS version 4.0 replaced 3.2.1, and the Council published a limited revision, version 4.0.1. The older version was retired in 2024, and a group of new requirements that were optional "future-dated" items in 4.0 became mandatory on March 31, 2025. These include additional requirements around authentication, scripts on payment pages and risk assessment, which matter mainly for e-commerce merchants. If you use a hosted checkout from a compliant provider, many of these are handled by the provider, but you should confirm in the provider's documentation and on the PCI Council's website.
Merchant levels and validation
Card brands classify merchants into levels, usually by annual transaction count. Most small businesses fall in the lowest level, which generally requires an annual self-assessment questionnaire (SAQ) and, where required, a network vulnerability scan by an approved scanning vendor. Larger merchants may need a report on compliance by a qualified security assessor. Your acquirer tells you which level applies to you.
Which questionnaire applies
The SAQ type depends on how you accept payments. This simplified table shows the general idea.
| How you accept cards | Typical SAQ | Notes |
|---|---|---|
| Standalone terminal with validated point-to-point encryption | SAQ P2PE | Shortest, fewest requirements |
| Dial-out or internet terminal not connected to other systems | SAQ B or B-IP | Moderate length |
| Fully outsourced e-commerce checkout, such as a redirect or iframe | SAQ A | Short, but you must confirm the page is truly hosted by the provider |
| E-commerce page where your site influences the payment page | SAQ A-EP | More requirements |
| Card data stored or processed on your systems | SAQ D | Longest and most costly |
Use the provider's guided wizard, and ask your processor which one you need. Choosing the wrong SAQ is a common cause of rejected validation.
Typical fee structures
Processors commonly charge in some combination of these ways:
- PCI program fee: a monthly or annual charge for access to a compliance portal, scanning or insurance-like coverage.
- PCI non-compliance fee: a higher monthly charge applied while your validation is not complete.
- Scan fees: for external vulnerability scans, if required.
- Data breach coverage: sometimes bundled as a benefit, sometimes with significant exclusions.
The amounts vary by provider and contract, so read the fee schedule. Some merchants pay both the program fee and the non-compliance fee at the same time because they never finished the questionnaire.
Worked example: the cost of ignoring it
A retailer pays a $15 monthly PCI program fee. It never completes the questionnaire, so the processor adds a $40 monthly non-compliance fee. Over a year the retailer pays 12 x $15 + 12 x $40 = $660. If it completes the questionnaire, which might take an hour or two, the non-compliance fee stops, reducing the cost to $180 a year. The $480 difference is large compared with the time involved. These amounts are illustrative.
How to become compliant, step by step
- Ask your processor what level and SAQ apply, what the portal is and what deadline you have.
- Inventory how you take cards: terminals, websites, apps, paper forms, stored data.
- Reduce your scope. Use validated terminals with encryption, hosted checkout and tokenization so card numbers never touch your systems. Do not write card numbers on paper or store them in spreadsheets.
- Complete the questionnaire honestly and have an authorized person sign the attestation.
- Run scans if required, and fix findings.
- Document policies: basic security policies, access controls, a list of devices and who may use them.
- Keep software updated: terminals, operating systems, website platforms and plugins.
- Repeat every year and after significant changes in how you accept payments.
Security basics worth doing regardless of the fee
- Unique passwords and multi-factor authentication for payment portals and email.
- Restricting who can issue refunds.
- Inspecting terminals for tampering.
- Training staff to recognize phishing and social engineering.
- Never giving card data by email or text.
Compliance is not the same as being breached-proof
A completed questionnaire is a self-assessment. It shows you took required steps, but it does not guarantee that you cannot be breached. If a breach occurs, you may face forensic investigation costs, fines from card brands passed through your processor, card reissuance costs and legal exposure. Keeping systems simple and outsourcing sensitive functions to certified providers is the strongest protection.
Questions to ask your processor
- What PCI fees do you charge, and what triggers the non-compliance fee?
- Do you provide a portal and support to complete the SAQ?
- Is my terminal validated, and is it point-to-point encrypted?
- Is there a data breach protection benefit, and what does it exclude?
- Can I waive the program fee if I complete validation on my own?
Add the answers to the pre-signing checklist, and look for related fees when you read your merchant statement.
When to get help
If you store card data, run a custom checkout or handle high volume, consult a qualified security assessor or IT security professional. If you have a suspected breach, contact your processor right away and follow its incident procedure, and consider legal counsel.
Frequently asked questions
Is PCI compliance required by law?
It is a contractual requirement through your merchant agreement and card-brand rules, though some state laws refer to it. Not complying can lead to fees and account consequences.
Do I need PCI compliance if I use a hosted checkout?
Yes, but your requirements are usually lighter, often a short questionnaire. Confirm which one applies with your provider.
Can I avoid the PCI fee?
Sometimes, by completing validation or choosing a provider that does not charge a program fee. Compare the fees in the contract.
Sources
- PCI Security Standards Council — PCI DSS standard, SAQs and guidance for small merchants
- Federal Trade Commission — data security guidance for small businesses
- Visa — merchant security program information
- Mastercard — site data protection program information