PCI compliance fees: what's fair and what's padding

A PCI compliance fee is a charge from your payment processor tied to PCI DSS, the card industry's data security standard. It usually comes in one of two forms: a regular fee, monthly or yearly, for compliance tools or services, and a non-compliance fee that's charged when you haven't shown you're compliant. The first can be fair. The second is usually avoidable.

This guide sticks to the fees. For the standard itself, go to the source: the PCI Security Standards Council's merchant resources.

What is a PCI compliance fee?

It's whatever your processor decides to charge under that name, which is why it's worth reading closely. On statements you'll see versions like these:

Non-validation fees aren't something processors invented out of thin air. Amex's Merchant Operating Guide says "American Express and your Merchant Services Provider may have the right to impose non-validation fees on you and terminate Card acceptance" if you don't meet the requirements or fail to provide the mandatory validation documentation by the deadline (American Express Merchant Operating Guide). What your processor charges, and when, comes from your agreement.

To find these fees, look past the processing section of your statement to the account or monthly fees area, and search for "PCI," "compliance," "validation" and "regulatory." A fee billed once a year shows up on only one statement, so check a full year of them. Our guide to reading a merchant statement shows where each section usually sits.

Who requires PCI compliance, and who sets the fees?

The PCI Security Standards Council writes the standards. It doesn't enforce them, and it doesn't fine anyone. In the Council's words, "Compliance and enforcement of PCI Standards is the role of the payment brands and acquiring banks, not the PCI SSC." It also says it "does not receive copies of compliance assessment reports, nor is it involved in and has no information about penalties or fines for non-compliance" (PCI SSC).

The card brands push the job down to the banks that sign up merchants. Visa says "acquirers must ensure that their merchants validate at the appropriate level and obtain the required compliance validation documentation from their merchants" (Visa). Your processor works with that acquiring bank, so your processor is usually the one asking for your paperwork, and the one charging you when it doesn't arrive.

The upshot: the Council doesn't set these fees, so the amount on your statement is your processor's price, and you're allowed to question it. The standard and the questionnaires are the same whether you're in Atlanta or Minneapolis. What changes the paperwork is how you take cards.

What do you actually have to do?

For most small merchants, proving compliance comes down to two things: a yearly self-assessment questionnaire, and quarterly scans if your setup requires them. Confirm the details with your processor. The Council tells merchants to take questions about "compliance validation and reporting requirements" to their acquirer or the payment brands they do business with (PCI SSC).

Size matters here too. Visa says merchant levels are based on "the corporate entity's total volume of Visa transactions (inclusive of credit, debit and prepaid)" (Visa), so a growing business can move into a level with different validation requirements. Your processor should tell you if that happens, and our guide to PCI compliance levels lists each card network's thresholds.

The self-assessment questionnaire

SAQs are "validation tools for use by SAQ-eligible merchants and service providers to perform and report the results of their PCI DSS self-assessments," according to the Council's merchant resources, and each one "was created to support a specific type of environment" (PCI SSC FAQ). The right SAQ depends on how you take cards:

That table paraphrases the eligibility sections of the Council's own questionnaires: the PCI DSS v4.0.1 versions of SAQ A-EP, SAQ B-IP, SAQ C-VT, SAQ P2PE and SAQ D for Merchants, and the v4.0 versions of SAQ B and SAQ C. The SPoC questionnaire goes with a standard the Council is retiring, with a sunset period that runs to October 31, 2026. The Council has also announced updates for merchants validating to SAQ A, so confirm your SAQ with your processor before you start.

Quarterly external scans

Some SAQs require scans by an Approved Scanning Vendor (ASV). PCI DSS Requirement 11.3.2 "requires evidence of passing external scans, performed by an ASV, at least once every three months" (PCI SSC), and the Council notes that SAQ A merchants are now completing that requirement for the first time.

The Council's summary of the v4 SAQs says the SAQ A scan requirement applies to merchant websites that redirect payment transactions to a third-party provider, or that embed a provider's payment page or form, such as an iframe (PCI SSC). If you sell through online payments with a hosted or embedded checkout, ask whether scans now apply to you, and whether your PCI fee covers them.

Which PCI fees are reasonable, and which are padding?

Our rule of thumb: a PCI fee is reasonable when you can name what it bought, and padding when you can't. A good program is easy to find, tells you which SAQ it expects, reminds you before deadlines and confirms when your validation is accepted. If yours does none of that, the fee is paying for a logo. Our page on credit card processing fees lists PCI fees with the other extra charges worth checking.

Usually reasonable:

• A clearly disclosed annual or monthly fee that gets you a working SAQ portal and someone who answers questions.
• Scan fees, when your SAQ requires ASV scans and the fee actually covers them.
• A non-compliance fee that stops the month you validate, after you were told the deadline. Amex's guide says your provider "will notify you separately of the applicable deadline for each annual and quarterly reporting period."

Usually padding:

• A PCI fee with nothing behind it: no portal, no scans, no help.
• A compliance fee and a non-compliance fee in the same month, with no help to fix the problem.
• A non-compliance fee that keeps appearing after you submitted your validation.
• Scan fees you can't connect to an actual scan report.
• A new "regulatory" or "compliance" line that showed up without notice or explanation.

Here's what the penalty costs in practice, with made-up numbers. Say your statement shows a $99 annual PCI fee and a $29.95 monthly non-compliance fee that ran for 10 months. The non-compliance fees total $299.50, about three times the annual fee, and they bought nothing that filing the questionnaire wouldn't have fixed. Together, the two fees come to $398.50. If your processor bills them per merchant account and you have three locations, that's $1,195.50 for the year.

What usually triggers a PCI non-compliance fee?

These are the gaps that let a non-compliance fee start, or keep it running:

• Assuming your processor handles it. Using a processor's terminal or checkout doesn't file your validation for you. The questionnaire and its attestation are yours to complete and submit.
• Filing the wrong SAQ. If the questionnaire doesn't match how you take cards, your validation may not hold up. Use the table above and confirm it with your processor.
• Forgetting the renewal. Validation is a yearly job, and where scans are required, they're quarterly.
• Missing a scan. If your SAQ includes Requirement 11.3.2, a skipped quarter means you aren't meeting it for that period.
• Changing how you take cards without updating anything. Adding online sales, a new terminal or phone orders can change which SAQ applies.
• Opening another location or merchant account. Ask whether each account needs its own validation, because a second account can mean a second set of fees.

How do you stop paying PCI non-compliance fees?

1. Find the fee on your statement and note the month it started.
2. Ask your processor how to submit your validation and which SAQ they expect from you.
3. Check that SAQ against how you take cards, using the table above.
4. Complete the SAQ and its attestation of compliance, the signed statement that goes with it.
5. If your SAQ requires quarterly external scans, schedule them with a PCI SSC Approved Scanning Vendor and keep the passing reports.
6. Submit everything and get written confirmation with the date.
7. Check your next statement. If the fee is still there, ask for it to be reversed.
8. Put next year's renewal on your calendar. Validation isn't a one-time job; Amex's guide refers to deadlines for "each annual and quarterly reporting period."

Two longer-term fixes help too. Taking card data off your own systems, with a hosted checkout online or P2PE terminals in store, can move you to an SAQ written for that setup. And if you key phone orders on a virtual terminal, SAQ C-VT covers that case, provided you meet its conditions and your provider's virtual terminal is PCI DSS validated, so ask.

What should you ask a processor about PCI fees?

• What is the PCI fee, how often is it charged, and what exactly does it include?
• Are ASV scans included if my SAQ needs them?
• Which SAQ do you expect from me, and how do I submit it?
• What is the non-compliance fee, when does it start, and how much notice will I get?
• Does the non-compliance fee stop the month I validate, and will you refund fees charged after I submitted?
• Is any PCI fee charged per location or per merchant account?
• Who helps me if I get stuck on the questionnaire?

On that last question: we offer PCI compliance support, and every Clearo client has a dedicated rep to call. Whoever you choose, get the answers to all seven in writing before you sign.

The next step

Pull your last few statements and add up every line with "PCI" or "compliance" in it. If you're paying a non-compliance fee, file your validation this month. Then send us a statement for a free statement review and we'll flag every compliance-related fee and what it costs you a year. Questions about the questionnaire? Contact us. Our guides to hidden fees in credit card processing and the cheapest credit card processing cover the rest of your statement.