A PCI non-compliance fee is a charge your payment processor or merchant services provider may add when its records show that you have not completed required payment-security validation. To stop paying it, confirm what is missing, complete the appropriate requirements, and get written confirmation that your account is validated and the fee will stop.
What does PCI non-compliance mean?
PCI DSS stands for Payment Card Industry Data Security Standard. It sets security requirements for businesses that store, process, or transmit payment card data. Even a small business using a payment terminal or an online checkout generally has PCI responsibilities, although the requirements and validation process depend on how it accepts payments.
A non-compliance charge often means your provider is missing documentation, such as an annual questionnaire or required scan results. It does not necessarily mean someone found a breach. However, missing paperwork and actual security gaps are different problems, and you need to address whichever applies.
Paying the fee does not make your business compliant, provide security protection, or replace the required work.
Who charges the fee?
The fee generally comes from your processor or merchant services provider—not directly from the PCI Security Standards Council. Its amount, timing, and removal conditions depend on your provider’s agreement and policies. There is no single universal PCI non-compliance fee that every business must pay.
On your statement, look for labels such as “PCI non-compliance,” “PCI non-validation,” or “security non-compliance.” A separate “PCI compliance” or “security program” fee may pay for a provider’s compliance service and may remain even after you complete validation. Ask the provider to explain each line item rather than assuming they are interchangeable.
Step 1: Find out exactly what is missing
Contact the provider listed on your merchant statement and ask for its PCI support team. Have your merchant account number and recent statements ready. Ask these questions:
- What specific requirement is causing this fee?
- Which PCI questionnaire and supporting documents apply to my setup?
- Do I need external vulnerability scans?
- Which portal or service should I use to submit everything?
- What deadline must I meet to avoid the next charge?
- Do separate locations or merchant accounts need separate validation?
Request written instructions. If you already completed the process, ask whether the results were linked to the correct merchant account. A submission in one portal does not always mean your processor’s billing system has recognized it.
Step 2: Complete the right validation process
Many small businesses validate using a Self-Assessment Questionnaire, or SAQ, along with an Attestation of Compliance. The correct SAQ depends on your payment environment: a standalone terminal, a website, and a system that stores card information can have different requirements. Some businesses need a different assessment route, so confirm rather than guessing.
Describe your setup accurately, including phone payments, online sales, connected systems, and any saved card information. Using a third-party payment service can reduce your responsibilities, but it does not automatically eliminate them.
Do not simply check “yes” to every security question. If a requirement is not met, fix the underlying issue before attesting that it is. That might involve updating software, changing access controls, or working with your website or IT provider.
If external vulnerability scanning is required, use a PCI Approved Scanning Vendor. These scans are generally required at least quarterly, with additional scanning in certain circumstances. Failed scans can require fixes and rescanning. Your provider should explain which systems are in scope and what evidence it needs.
Step 3: Confirm the fee will actually stop
Once you have submitted everything, save the acceptance notice, validation date, and any support case number. Ask the provider to confirm that your status is current—not merely that it received your documents.
Then ask for the effective date of fee removal. Billing cutoffs may affect whether another charge appears, so get a specific answer about your next statement. Review that statement and follow up if the charge continues.
You can also request a credit for earlier fees, especially if you completed validation on time or the provider failed to update your account. A refund is not automatic. Eligibility depends on your agreement, the circumstances, and the provider’s policies.
How to keep the fee from coming back
PCI compliance is ongoing, not a one-time certificate purchase. Annual validation is common, and required scans or other security tasks may have shorter schedules. Payment system changes can also affect your requirements.
- Set reminders before your validation and scan deadlines.
- Keep your provider’s contact email current so notices reach you.
- Assign one person to track submissions and confirmation messages.
- Revisit your requirements when you change terminals, checkout software, or payment methods.
- Check monthly statements for returning or unfamiliar fees.
Should you switch processors?
If your provider cannot explain the charge or makes validation unnecessarily confusing, comparing providers is reasonable. But switching does not eliminate PCI responsibilities. Ask any new provider about its validation support, compliance-related fees, and total processing costs. Specific validation procedures can vary by card brand, acquiring bank, and payment setup.
Want help understanding what you are paying? Get a free statement analysis from Swipe Saver to review your PCI-related charges and overall processing costs, and see whether its interchange-at-cost membership pricing could fit your business.