A PCI fee is a charge your payment processor adds to your merchant statement for handling PCI (Payment Card Industry) security compliance on your account. It usually appears as a monthly or annual line item somewhere between $10 and $30 per month for merchants who have completed their annual security validation. Businesses that haven’t completed that validation pay substantially more. The important thing to understand before you accept the charge: Visa, Mastercard, and the other card networks don’t impose this fee. Your processor does, and it’s often negotiable or avoidable entirely.
Compliance Fee or Non-Compliance Fee
Your statement will show one of two PCI charges depending on whether your annual validation is current.
The compliance fee is the baseline charge for maintaining the portals, support, and tracking tools your processor uses to monitor your compliance status. It typically runs $10 to $30 per month, or roughly $100 to $250 per year. It’s an administrative cost: the processor hosts your self-assessment questionnaire and keeps a record of your certification.
The non-compliance fee is what hits when the processor’s records show you haven’t validated — usually because you never completed the annual self-assessment questionnaire or let your certification lapse. These penalties commonly run $20 to $100 per month and keep repeating every billing cycle until you complete the paperwork. Some processors also bump up your per-transaction rate while you’re non-compliant.
Plenty of merchants pay the penalty for months or years without realizing the questionnaire exists. Completing it typically takes 20 to 45 minutes for a small business, which makes the lost money especially frustrating once you discover the cause.
Why the Fee Is Negotiable
Visa and Mastercard do not charge merchants a PCI non-compliance fee. That line on your statement is entirely your processor’s decision, and the money goes to the processor. The card networks require that you comply with the PCI Data Security Standard as a condition of accepting their cards, but the fee labeled “PCI” is your processor’s own charge for facilitating (or penalizing) that compliance.
Because the fee isn’t a mandate, processors handle it inconsistently. Some charge monthly, some annually, some fold the cost into their overall processing rate, and some don’t charge a separate PCI fee at all. That variability is leverage. When you ask a processor to reduce or waive the fee, you’re not asking them to defy Visa; you’re asking them to adjust their own pricing.
PCI DSS itself is not a federal law. It’s a contractual requirement in your merchant processing agreement. Enforcement is private: card networks can fine your acquiring bank, and your processor can raise your fees, restrict your account, or cut off your ability to process cards.
How to Validate Compliance and Stop the Penalty
The fastest way to lower your PCI costs is to complete the Self-Assessment Questionnaire (SAQ). Most merchants paying non-compliance penalties simply haven’t filled out the form — they haven’t actually failed the security requirements.
Which questionnaire you need depends on how your business handles card data:
- SAQ A — e-commerce or phone/mail-order merchants that fully outsource all card data handling to a validated third-party provider.
- SAQ A-EP — e-commerce merchants whose sites don’t directly receive card data but could affect transaction security, such as a checkout that redirects to a processor’s hosted form.
- SAQ B — merchants using only imprint machines or standalone dial-out terminals with no electronic storage of card data.
- SAQ B-IP — merchants using standalone, approved payment terminals connected to the processor over IP, with no electronic storage.
- SAQ C-VT — merchants manually entering one transaction at a time through a web-based virtual terminal hosted by a validated third party.
- SAQ C — merchants with payment application systems connected to the internet, but no electronic storage of card data.
- SAQ P2PE — merchants using only hardware terminals managed through a validated Point-to-Point Encryption solution.
- SAQ D — the catch-all for anyone who doesn’t fit the categories above. The longest and most detailed version.
A small retailer using a modern countertop terminal from the processor is usually looking at SAQ B-IP or SAQ P2PE. An online store where customers enter card details on a processor-hosted checkout page typically falls under SAQ A. Picking the wrong one means your submission won’t count as valid compliance, so match it to how card data actually moves through your business.
After you finish the questionnaire, you sign an Attestation of Compliance stating that your answers are accurate. Some merchants also need quarterly network vulnerability scans run by an Approved Scanning Vendor, mainly those whose card data environment touches the internet. Budget scanning services generally cost $99 to $200 per quarter.
Most processors provide an online compliance portal where you fill out the SAQ, upload scan results if applicable, and submit your attestation. It typically takes one to two billing cycles for the processor to update your account and remove the non-compliance charge. Validation has to be renewed every year. If your certification lapses, the penalty comes back.
One note on merchant tiers: card networks classify businesses into four levels by annual transaction volume, and most small businesses are Level 4 (generally those processing fewer than 20,000 e-commerce transactions annually or otherwise falling below the higher thresholds). Mastercard does not require Level 4 merchants to validate compliance directly, but acquirers must maintain risk management programs covering those accounts.1Mastercard. Site Data Protection Program and PCI Your processor almost certainly requires the SAQ anyway and will keep charging the non-compliance fee until it’s done.
Ways to Reduce or Eliminate the PCI Fee Going Forward
Switch to a Payment Aggregator
Payment aggregators like Square and Stripe handle PCI compliance differently from traditional merchant account providers. Square does not charge a separate PCI compliance fee; compliance support is included at no extra cost.2Square. Learn About Square Fees Stripe operates as a PCI Level 1 service provider, and merchants using Stripe’s hosted payment tools shrink their own compliance scope and associated costs.3Stripe. PCI Compliance Cost: What Small, Midsize, and Large Companies Really Pay to Stay Compliant When the platform handles card data collection and storage for you, your validation often collapses down to SAQ A, the shortest questionnaire.
Negotiate With Your Current Processor
If you want to keep your existing merchant account, ask directly about reducing or waiving the PCI fee. Some processors will remove it for merchants with a clean compliance history. Others will match a competitor’s price if you can show a lower-cost alternative. Since the fee is the processor’s own charge, there’s room to negotiate.
Use P2PE-Certified Hardware
Point-to-Point Encryption terminals encrypt card data at the moment of the swipe or dip, so the data is unreadable to your systems. Using a validated P2PE solution qualifies you for SAQ P2PE, which cuts down the number of security requirements you have to document. P2PE-certified terminals usually cost $250 to $480 depending on model, plus a one-time encryption key injection fee around $35 and a monthly device management fee of roughly $25. The hardware can pay for itself if it moves you into a simpler compliance tier.
What’s at Stake Beyond the Monthly Fee
The monthly non-compliance charge is a nuisance. The real risk sits on the other side of a data breach, where being non-compliant turns an incident into a much larger financial event. Card networks can impose fines of up to $500,000 per incident on the acquiring bank, and those banks routinely pass penalties of $5,000 to $100,000 per month down to the merchant until compliance is restored.3Stripe. PCI Compliance Cost: What Small, Midsize, and Large Companies Really Pay to Stay Compliant
A breach also triggers forensic investigation costs, mandatory customer notification expenses, card reissuance fees charged by issuing banks, and potential lawsuits from affected cardholders. The global average cost of a data breach reached $4.88 million in recent years. Small businesses face lower totals than large enterprises, but a six-figure breach cost can be existential for a company doing a few hundred thousand dollars in annual revenue.
Cyber liability insurance can absorb some of this, but most policies require the business to have been PCI compliant at the time of the breach. An insurer that finds you weren’t compliant may deny coverage for PCI-related fines and penalties. Keeping your annual validation current isn’t only about the $30 line item on your statement; it’s about preserving the coverage that exists for exactly this kind of event.
Many states also have their own data breach notification laws with penalties ranging from $2,500 to $20,000 per violation, and some impose aggregate caps in the hundreds of thousands. Those penalties stack on top of anything the card networks impose, which is why ignoring a non-compliance notice on your statement is usually the wrong call even when the monthly amount feels small.