PCI DSS fines and penalties generally start at $5,000 to $10,000 per month for a merchant that misses validation deadlines and can climb toward $100,000 per month the longer non-compliance drags on. When an actual breach exposes cardholder data, per-card assessments of roughly $50 to $90 stack on top, along with mandatory forensic investigations, card reissuance charges, and potential government enforcement. These are not regulatory fines. They are contractual assessments that flow from the card brands through the acquiring bank and land on the merchant.
Who Actually Charges You
The PCI Security Standards Council writes the standard but has no authority to fine anyone. Visa’s own program materials say the PCI SSC owns and manages PCI DSS, while Visa independently manages “all data security compliance enforcement and validation initiatives.”1Visa. Account Information Security (AIS) Program and PCI Mastercard, American Express, and Discover run parallel enforcement programs with their own assessment schedules.
The chain works like this. A card brand assesses a fine against the acquiring bank that underwrites the merchant. The acquirer passes the cost through under indemnity language built into the merchant services agreement, which typically authorizes the acquirer to “debit Merchant’s Account for all fees, costs, charges, and other liabilities.”2U.S. Securities and Exchange Commission. Merchant Processing Agreement By the time the merchant sees the charge, it has already been deducted from settlement funds or invoiced. There is rarely a negotiation. The acquirer treats it as a pass-through cost.
Monthly Non-Compliance Assessments
A merchant does not need to suffer a breach to start accumulating penalties. Missing a validation deadline, skipping a quarterly vulnerability scan, or failing to complete a required Self-Assessment Questionnaire triggers monthly non-compliance assessments. Card brands usually start these at the lower end, around $5,000 to $10,000 per month, and escalate them. After several months without remediation, monthly charges can climb to $50,000 or more, with reports of $100,000 per month for large merchants that ignore the issue.
The exact schedule is not public. Card brands treat their assessment structures as confidential and disclose them only through agreements with acquiring banks. What is consistent across the industry is the escalation pattern. The longer a merchant waits, the more expensive it gets. Assessments keep accruing until the merchant provides a passing Report on Compliance or Self-Assessment Questionnaire, verified by a Qualified Security Assessor or Approved Scanning Vendor. For a mid-sized business that puts off remediation for a year, accumulated non-compliance assessments alone can exceed $100,000 before any data is stolen.
Per-Card Penalties After a Breach
When a breach compromises cardholder data, the numbers change scale. Card brands impose per-card assessments based on the number of accounts exposed, with industry-reported figures placing them in the range of $50 to $90 per card. The exact amount depends on the severity of the security failure and the card brand.
The math gets punishing fast. A breach exposing 10,000 cardholders at $75 per card produces a $750,000 assessment. A breach involving 100,000 records crosses into the millions. These per-card fees sit on top of any monthly non-compliance assessments already running. Visa’s rules state that if a merchant “does not comply with the PCI DSS or fails to rectify a security issue,” the acquirer bears the assessment from Visa and is responsible for payment.1Visa. Account Information Security (AIS) Program and PCI The acquirer then passes every dollar to the merchant. For smaller businesses without significant reserves, a breach of moderate size can be an extinction-level event.
Forensic Investigation and Card Reissuance
A confirmed or suspected breach triggers a mandatory forensic investigation by a PCI Forensic Investigator, a firm specifically qualified by the PCI Security Standards Council to analyze payment card compromises. The card brands decide whether a PFI engagement is required and can mandate which firm conducts it.3PCI Security Standards Council. PCI Forensic Investigators The merchant pays for the entire process.
PFI engagements typically start around $25,000 for straightforward environments and can exceed $200,000 for complex networks with multiple locations, legacy systems, or unclear data flows. Investigators examine server logs, payment applications, network architecture, and physical hardware to determine how the breach occurred and whether the vulnerability is fully closed.4PCI Security Standards Council. PCI Forensic Investigator Program Guide Refusing to cooperate or delaying the investigation can result in immediate termination of processing privileges, which for most businesses means they cannot operate.
After a breach, issuing banks must cancel compromised cards and send replacements. The operational cost of producing the card, mailing it, and staffing call centers gets passed from the card brand to the acquirer and then to the merchant. Reissuance runs $5 to $15 per card depending on card type, with premium metal cards at the top of that range. On a breach involving 50,000 cardholders, reissuance alone adds $250,000 to $750,000 on top of everything else.
Losing the Ability to Process Cards
The most severe consequence is not a fine. It is losing the ability to accept credit cards at all. Mastercard maintains a database called MATCH (Member Alert to Control High-Risk Merchants) that functions as a blacklist for terminated merchants. Reason Code 12 is specifically designated for “PCI DSS Non-Compliance,” meaning a merchant terminated for security failures gets flagged in a database that every acquiring bank checks before approving a new merchant account.5Stripe. High Risk Merchant Lists
Once listed, the merchant’s business name, principals, and partners all appear in the database and stay searchable for five years. Acquirers with acquiring activity must maintain MATCH access and submit termination records within five days of the decision to terminate.6Mastercard Developers. MATCH Pro Getting a new merchant account while on MATCH is very difficult. Some high-risk processors will take on MATCH-listed merchants, but they charge substantially higher fees and impose restrictive contract terms. For a retail business that depends on card payments, five years on MATCH can be fatal even if the initial fines are survivable.
Government Actions and Class Actions on Top
PCI DSS is a private industry standard, not a law. Failing to secure payment data can still trigger separate government enforcement that compounds the card brand penalties.
The Federal Trade Commission uses Section 5 of the FTC Act to pursue companies whose data security practices amount to unfair or deceptive acts. The agency does not enforce PCI DSS directly, but a business that suffers a breach may face an FTC investigation on top of card brand assessments. The 2017 Equifax breach produced a settlement of up to $425 million for affected consumers.7Federal Trade Commission. Equifax Data Breach Settlement FTC consent orders typically require a comprehensive information security program and years of independent auditing.
All 50 states have breach notification laws, many with per-violation penalties for failing to notify or for inadequate data protection. California’s Consumer Privacy Act allows statutory damages of $100 to $750 per consumer per incident in data breach lawsuits. A merchant may simultaneously face card brand assessments, FTC scrutiny, state attorney general investigations, and private class actions under state consumer protection statutes.
Consumer litigation sits entirely outside the PCI penalty framework. T-Mobile settled for $350 million after a breach affecting 76 million customers. Capital One paid $190 million for a breach involving more than 100 million customers. Aggregate defense costs and settlement amounts in major breaches can dwarf the card brand assessments themselves.
Whether Insurance Will Cover Any of This
Many businesses assume cyber liability insurance covers PCI fines. The coverage is less straightforward than most policyholders expect. Standard cyber policies frequently exclude PCI DSS fines and assessments entirely, or cap them under a sublimit that falls well short of actual exposure. Insurers are especially likely to exclude or sublimit PCI coverage when the business cannot demonstrate it was compliant at the time of the breach. Some policies also contain contractual liability exclusions that deny claims for costs arising from contractual obligations to an acquiring bank, which is exactly how PCI assessments reach merchants.
To get meaningful coverage, confirm that the policy explicitly names PCI DSS fines and assessments as a covered loss category, check whether that coverage is subject to a sublimit below the aggregate limit, and verify that contractual liability exclusions will not void coverage for acquirer pass-through assessments. Finding these gaps after a breach is one of the more expensive surprises in commercial insurance.
Compliance Cost Compared to the Penalty Exposure
The financial case for compliance is one-sided. Annual compliance costs for small businesses processing under 20,000 transactions typically run under $10,000, covering a Self-Assessment Questionnaire, quarterly vulnerability scans, and basic security controls. Larger enterprises with complex environments may spend $70,000 or more on QSA-led assessments and infrastructure upgrades. Those numbers sit next to breach costs that routinely reach six or seven figures once per-card assessments, forensic fees, reissuance, litigation, and potential loss of processing are counted together.