The PCI Non-Compliance Fee and How to Stop Paying It

Somewhere on your statement there may be a line labeled PCI non-compliance, PCI penalty or something similar, often a few dozen dollars a month. It can run for years without anyone noticing. In many cases, it exists for one reason: nobody completed the annual security questionnaire the processor asked for.

That does not necessarily mean your business is insecure. It means your provider has no record that you validated it. The charge is a lever to prompt action, and understanding it lets you remove the cost and, more importantly, close an actual gap.

What PCI compliance actually is

PCI DSS is the Payment Card Industry Data Security Standard, a set of security requirements created by the card networks for any business that stores, processes or transmits card data. Acquirers are responsible for making sure their merchants meet it, so they pass an annual validation requirement down to you.

For most small businesses, validation means completing a self-assessment questionnaire, called an SAQ, and sometimes a network scan, then submitting an attestation that your answers are true. The details depend on how you accept cards.

Two different charges that get confused

Statements frequently include two separate lines that sound alike but are not. The first is a PCI program or compliance fee, which pays for the provider's portal, scanning or support. The second is a non-compliance fee, which is a penalty charged when you have not completed validation.

You may owe the first without owing the second. If you see both, you might be paying for a program you are not using.

Be cautious with any provider that bills a non-compliance fee but offers no way to complete validation, or whose portal links no longer work. If you cannot reach a working process, contact your processor in writing, keep a record and ask for a waiver while the problem is fixed. Merchants are sometimes charged for failing a process the provider itself has not kept running.

It also helps to separate the penalty from the actual security work. Even with a clean attestation, good habits matter: keep terminals updated, restrict who can access payment systems, change default passwords and avoid storing card numbers anywhere, including spreadsheets, notebooks and emails.

Why it appears

Non-compliance fees are most often triggered by an incomplete annual questionnaire. Other causes include a failed vulnerability scan for merchants who need one, an expired attestation or a questionnaire submitted for the wrong type of business.

Many merchants never received the request. It may have gone to an old email, been buried in a statement message or arrived from an unfamiliar portal. By the time the fee appears, months may have passed.

• No questionnaire submitted for the current year.
• Attestation expired after twelve months.
• Wrong questionnaire chosen for how you accept cards.
• Failed or missing external vulnerability scan where one is required.
• Login credentials for the compliance portal were never set up or were lost.

Picking the right questionnaire

The SAQ you complete depends on how you handle card data. Merchants who accept cards only through a validated, encrypted point-to-point terminal, or who outsource all online payments to a hosted page, usually face shorter questionnaires. Merchants who key cards into a virtual terminal on their own computer or whose websites handle card data directly face longer ones.

Choosing the shortest form is tempting but wrong if it does not match your setup. Answer based on how card data actually moves through your business, and ask your provider or a qualified security professional if you are unsure. Your equipment choices matter: an encrypted terminal that never exposes card data to your network can simplify your compliance.

How to stop paying the fee

The process is usually straightforward. Gather your credentials and the steps below, then work through them in one sitting.

1. Find the fee on your statement and note its exact name and amount.
2. Ask your processor which portal or vendor handles your validation and request login access.
3. Identify how you accept cards: terminal, POS, website, phone or mobile.
4. Complete the matching SAQ honestly and fix any gaps it reveals.
5. Run the external vulnerability scan if your setup requires one.
6. Sign and submit the attestation, then keep a copy.
7. Ask in writing that the non-compliance fee be removed going forward, and ask whether past charges can be credited.

Keeping it from coming back

Set a calendar reminder about eleven months out to renew. Keep your attestation, scan results and a short note describing your card-handling process in one folder. Train staff not to write down or photograph card numbers, and keep software and devices updated.

Say you are paying a $30 monthly non-compliance fee. That is $360 a year, plus the underlying program fee if there is one. An hour of validation can end the penalty, which is a better trade than paying it for years.

MCCPS offers PCI compliance help and can walk you through the questionnaire, and its free statement analysis will flag compliance-related charges. Rules and requirements are set by the card networks and your acquirer and may change, so follow the instructions your provider gives you.

This article is general information, not legal, tax or compliance advice. Card-network and state rules change — confirm current requirements before acting. Savings depend on your individual statement analysis.