PCI compliance is required for every business that accepts cards — but it should cost far less than your processor charges.
PCI compliance is required for every business that accepts credit cards. But the monthly fees processors charge for it are often wildly inflated. Here's what you actually need to know — and do.
PCI DSS stands for Payment Card Industry Data Security Standard. It's a set of security requirements created by the major card networks — Visa, Mastercard, American Express, Discover, and JCB — to protect cardholder data and reduce payment card fraud.
Any business that accepts, stores, transmits, or processes credit or debit card data must comply with PCI DSS. This isn't optional — it's a contractual requirement in your merchant agreement. However, the process of achieving compliance is far simpler than most business owners realize, especially for small businesses.
Every business that accepts credit or debit cards — regardless of size, volume, or industry. If you take a credit card payment, PCI compliance applies to you.
Businesses are divided into four "merchant levels" based on annual transaction volume. The vast majority of small businesses fall into Level 4 — fewer than 20,000 Visa e-commerce transactions and up to 1 million total Visa transactions per year. Level 4 merchants have the simplest compliance requirements.
At Level 4, compliance typically consists of completing an annual Self-Assessment Questionnaire (SAQ) and ensuring your network passes a quarterly vulnerability scan if you accept payments online or over an IP-connected terminal. For many retail businesses with a standard card terminal, no network scan is required at all.
The SAQ is the primary compliance tool for small businesses. It's a self-administered checklist of security questions covering how you handle cardholder data. There are several versions — the one that applies to your business depends on how you accept payments.
This is where it gets frustrating. Processors have turned PCI compliance into a significant revenue stream, charging fees that bear little relationship to the actual cost of compliance administration. Here's what to look for:
Some processors charge a modest monthly fee that covers access to their online compliance portal, the SAQ submission process, and basic support. If the fee is $5–$15/month and you actively use their compliance tools, this may be reasonable. Ask your processor exactly what this fee covers.
This is the big one. If you haven't completed your annual SAQ, your processor charges a monthly penalty — sometimes as high as $99/month — until you do. This fee compounds month after month until the questionnaire is complete. Many merchants pay this fee for years without knowing why or how to stop it.
The fix takes 15 minutes and is free. Log into your processor's merchant portal and complete the SAQ. The non-compliance fee disappears on your next statement.
Some processors enroll merchants in third-party security programs or breach insurance coverage and charge monthly fees for these services. While breach protection can have value, these programs are often sold without clear disclosure and priced above market alternatives. Review exactly what you're enrolled in and what you're getting for the fee.
Beyond the monthly non-compliance fee your processor charges, there are broader consequences for failing to maintain PCI compliance:
Data breach liability: If your business suffers a data breach and you were not PCI compliant at the time, you face significantly increased liability — including fines from the card networks, the cost of forensic investigation, and potential liability for fraudulent charges made with stolen card data.
Increased fines from card networks: In a breach scenario, non-compliant merchants can face fines of $5,000–$100,000 per month from card networks until compliance is achieved, plus assessments for fraud losses.
Account termination: Processors can terminate your merchant account for persistent non-compliance, especially in the event of a breach.
The good news: for small businesses operating with standard terminals and following basic security practices (not writing down card numbers, using a chip-capable terminal, keeping terminal software updated), achieving and maintaining PCI compliance is straightforward — and the monthly fees your processor charges to "help" you do it are rarely worth the cost.
Submit your merchant statement and we'll identify every PCI-related charge, tell you whether it's legitimate, and show you how much you could eliminate immediately.
📄 Get My Free Audit →