If you have a line on your processing statement that says PCI non-compliance, non-validation, or something close to it, you are not alone. It is one of the most common fees I find when I go through statements, and many owners have been paying it for years without knowing what it is.
The good news: for most small businesses it is avoidable, and stopping it usually takes less time than you would expect.
What is PCI DSS?
PCI DSS (the Payment Card Industry Data Security Standard) is a set of security requirements for any business that accepts, processes, stores, or transmits card data. It is maintained by the PCI Security Standards Council, which was founded by the major card brands.
The current version is PCI DSS 4.0.1, published in June 2024. Version 4.0 was retired at the end of 2024, and the newer requirements that had been phased in became effective on March 31, 2025.
The card brands require merchants to comply, and your processor is responsible for making sure its merchants do. For most small businesses, proving compliance means filling out a yearly self-assessment questionnaire (SAQ) and, for some setups, passing quarterly network scans.
What the PCI non-compliance fee is
It is a charge your processor adds when it does not have a current, completed PCI validation on file for your account. It is not a government fine and it is not charged by the card brands directly. Your processor sets the amount, and it is usually a flat monthly charge.
Amounts vary a lot from one processor to another, and it quietly adds up over a year. Your merchant agreement or fee schedule should list the exact amount.
Some processors call it a non-validation fee or a non-receipt fee instead. If you are not sure which line it is, look for "PCI" in the fee section of your statement.
PCI compliance fee vs PCI non-compliance fee
These are two different charges, and many statements have both.
- PCI compliance or program fee: a monthly or annual charge many processors bill everyone, usually described as covering a compliance portal, scanning tools, or support. You may still pay it after you are compliant.
- PCI non-compliance fee: an extra charge only for accounts without a current validation on file. This is the one you can make go away by completing your SAQ.
Which SAQ do small businesses usually need?
There are several SAQs, and the right one depends on how you take cards. These are the ones most small merchants end up with:
- SAQ A: online or phone businesses that fully hand off card handling to a PCI compliant third party, for example a hosted checkout page, and never handle card data themselves.
- SAQ B: businesses using only imprint machines or standalone terminals that dial out over a phone line, not connected to the internet.
- SAQ B-IP: businesses using standalone, PCI-approved payment terminals that connect to the processor over the internet, without relying on a computer or tablet to do it.
- SAQ C-VT: businesses that key in one transaction at a time into a web-based virtual terminal hosted by a PCI compliant provider, on a computer used for nothing that stores card data.
- SAQ P2PE: businesses whose terminals are part of a validated, PCI-listed point-to-point encryption solution, so they never have access to unencrypted card data.
Your processor or acquiring bank makes the final call on which SAQ applies to you. If your setup mixes methods (for example, a POS on a tablet plus online orders), the answer can be different.
Do I need quarterly scans?
Some SAQs require external vulnerability scans at least once every three months, run by a PCI Approved Scanning Vendor (ASV). Whether you need them depends on your SAQ and setup. Businesses with internet-facing systems, such as a website involved in payments, are the ones most likely to need them. A business with only a dial-out terminal generally does not.
Your SAQ will tell you if scans apply. If they do, a missed scan can trigger the non-compliance fee even after you have filed your questionnaire, so it is worth setting a reminder.
How to stop paying the fee
- Find the PCI line on your statement and note the amount and the name your processor uses for it.
- Call your processor and ask which SAQ they have you down for, and where to complete it (usually an online portal).
- Complete the SAQ honestly. If a question does not match how you take cards, stop and ask, because the wrong SAQ will not hold up.
- Set up quarterly scans if your SAQ requires them.
- Check your next statement or two to confirm the fee is gone, and put a reminder on your calendar to renew every year.
What to ask your processor
- Do you have a current PCI validation on file for my account, and when does it expire?
- Which SAQ do you have me assigned to, and why?
- Does my SAQ require quarterly scans? Who runs them?
- What is the PCI compliance fee for, and is it separate from the non-compliance fee?
- Once I am validated, when will the non-compliance fee stop?
Want help getting it off your statement?
PCI compliance is part of what I help businesses with. I will figure out which questionnaire fits how you actually take cards, walk through it with you instead of just sending a link, and make sure it is on record so the fee stops. You can read more on my PCI compliance page under Solutions.
If you are not sure whether you are paying this fee, or what else is on your statement, send it to me for a free statement analysis. I will point out every fee, including the PCI ones, and explain what can come off.
Sources: PCI Security Standards Council (pcisecuritystandards.org) for PCI DSS v4.0.1 and the SAQ eligibility criteria. Your processor's agreement controls the actual fee amounts.