How much is a PCI non-compliance fee?

It varies by processor and is set in your merchant agreement. Check the fee schedule and your statement for the exact amount.

Can I get the fee refunded after I become compliant?

Some processors will stop the fee once you validate, but refunds of past fees are not guaranteed. Ask your processor and review your agreement.

Is a PCI fee the same as being non-compliant?

No. Some processors charge a regular PCI program fee even when you are compliant. A non-compliance fee is an additional charge for missing or expired validation.

Do I have to complete the questionnaire every year?

Most processors require validation annually. Check your processor's requirements and your anniversary date.

Payment ProcessingNovember 5, 20265 min read

PCI Non-Compliance Fees: What They Are and How to Avoid Them

A PCI non-compliance fee is a monthly charge from your processor when you have not validated compliance. It is usually avoidable.

By ONKORE Team

Illustration for PCI Non-Compliance Fees: What They Are and How to Avoid Them

What is a PCI non-compliance fee?

Merchants who accept cards are expected to follow the Payment Card Industry Data Security Standard (PCI DSS). Most processors ask you to confirm this each year by completing a self-assessment questionnaire (SAQ) and, in some cases, passing security scans.

If you have not completed that validation, many processors charge a recurring non-compliance fee until you do. It is a processor charge, set in your merchant agreement, so the amount and wording vary.

PCI fee versus non-compliance fee

These two are often confused:

| Fee | What it is | |-----|------------| | PCI compliance or program fee | A regular fee some processors charge for providing a compliance tool or support. It may appear every month even if you are compliant. | | PCI non-compliance fee | An additional charge applied when your validation is missing or out of date. |

If you see a PCI line on your statement, check which one it is.

Why it appears

You never completed the annual questionnaire
Your validation expired
A required scan failed or was not completed
Your business details changed and the questionnaire no longer matched

How to avoid it

Find your processor's compliance portal. Look for an email or statement note with a link, or ask support.
Choose the right questionnaire. The version you complete depends on how you accept cards. Using a terminal that keeps card data away from your systems generally leads to a shorter form than handling card data yourself.
Complete and submit it every year. Set a calendar reminder a few weeks before your anniversary date.
Run any required scans. If you have an internet-facing system that stores or processes card data, scans may be required.
Keep a copy of the attestation. Save the completion date and certificate.
Ask for the fee to be removed. After validating, contact your processor and ask them to stop the fee. Check the next statement.

Reduce your PCI scope

The less card data touches your systems, the simpler compliance is. Use hosted payment pages or tokenization, and use terminals that encrypt card data. See our PCI Center for guidance.