PCI compliance fees: who charges them, and how to stop the non-compliance fee

Who charges what

The short answer first. A PCI non-compliance fee on a merchant statement comes from the acquirer or processor under its card-brand program, never from the PCI Security Standards Council. The Council says so twice: “Enforcement of compliance with PCI Standards and determination of any non-compliance penalties are carried out by the individual payment brands and not by the PCI SSC,” and it “has no information about penalties or fines for non-compliance.” Calling the Council about the line on your statement gets you nowhere.

The brands do not bill you directly either. Visa's rules say Visa may assess the acquirer, and “the issuer or acquirer … must not represent that Visa has imposed any assessment on the service provider or merchant.” Your acquirer is the bank that “processes payment card transactions for merchants”, and Visa puts the job of checking you on it: “Acquirers must ensure that their merchants validate at the appropriate level.” The fee you see is your processor's, in your processor's terms.

The Council's own page goes one step further for the people you hire: “Fees and charges are agreed upon between the entity and the assessor company. PCI SSC does not set or have any influence over fees and charges for services provided.” If you want the full map of who runs what, read what PCI compliance is.

The PCI lines on a statement

Statements do not use one shared name. Look for any line with “PCI” in it, then sort it into one of three kinds. The wording in the middle column is each provider's own, from its own page.

The scan line can arrive two ways. The Council's ASV Program Guide says the scan customer “typically either pays these fees directly to the ASV, or to the scan customer's acquirer or other aggregating entity (if the acquirer or other aggregating entity has a contract with the ASV on behalf of a group of merchants).” So a processor's PCI portal may bundle the scan into its recurring PCI fee. Whether you need scans at all depends on your SAQ; the ASV scan guide sorts that out.

Why the non-compliance fee appears

In the processor terms we read, the trigger is paperwork: your processor has no current validation from you on file. It is not a finding that card data leaked. It means the questionnaire, the scans or the signed attestation did not reach the people who bill you by their date.

Stax publishes its rule in plain words, which makes it a useful example of how the clock runs:

• Stax, help docs

  “Merchants have 90 days from when their new merchant account is APPROVED with Stax to become PCI compliant.”

  Stax: PCI compliance

• Stax, help docs

  “If the merchant does not become compliant within 90 days of enrolling, they will be charged the PCI Non-Compliance Fee monthly until compliance is achieved.”

  Stax: PCI compliance

• Stax, help docs

  “If no action is taken, a failed scan can result in a merchant becoming non-compliant and billed for PCI Non-Compliance.”

  Stax: PCI compliance

Stax's docs state no amount for the fee, and neither do we. Other processors set their own grace period and their own name for the line; Clover's guide puts it this way: “each service provider has a right to set penalty rates at their own discretion.” The usual triggers look like this:

The one-year and three-month periods are Stax's own description (“Completing the questionnaire produces a PCI Certificate that is valid for one year. Vulnerability scans will only be valid for three months.”). The routing by merchant ID is from the same page, which sends merchants to different PCI portals depending on how their merchant ID begins.

How to get the non-compliance fee removed

Visa bills the acquirer, not you, and the Council has no part in fees, so there is nobody above your processor to appeal to. The fee stops when your processor records you as compliant, so the route is the validation itself, finished and delivered.

1. Validate

Confirm the SAQ you file. Before you start, confirm with the organization you submit it to (usually your acquirer, the merchant bank) that you are eligible for it. The SAQ type finder narrows it down, and the PCI compliance checklist lists what that SAQ asks. If your SAQ has external scans, PCI DSS 11.3.2 requires external vulnerability scans at least once every three months by an ASV approved by PCI SSC. SAQ A for v4.x includes them for merchants whose pages redirect to, or embed, a processor's payment page. SAQ A-EP carries 139 requirements; check the scan questions in your SAQ A-EP form or ask your acquirer.

2. Submit the AOC

The Attestation of Compliance is “the official PCI SSC form for merchants and service providers to attest to the results of a PCI DSS assessment, as documented in a Self-Assessment Questionnaire (SAQ) or Report on Compliance (ROC).” Sign it and send it, with any passing scan report, where your processor tells you. For scans the Council's guide is explicit: “Scan customers should contact their acquiring bank or each Participating Payment Brand to determine to whom results should be submitted.”

3. Ask the processor

Ask, in writing, for three things: confirmation that your validation is on file, the fee gone from the next statement, and an answer on whether the months already billed can be credited. That last one is the processor's decision under its own terms; asking costs nothing.

Not sure which step is holding the fee? Answer these in order:

Avoiding PCI fees

The non-compliance fee is the avoidable one: validate before your processor's date and it never starts. The recurring PCI fee is a different matter. It is part of what a processor charges, and some say they charge none. Here is what some of them say, in their own words:

• Square, payment security page

  “No expensive audits, assessments, or noncompliance fees.”

  Square: Payment security

• Square, PCI article (the condition)

  “Provided you use Square for all storage, processing, and transmission of your customers’ card data, you don’t need to take any steps to validate your PCI compliance to Square, and you don’t need to pay any PCI-compliance fees.”

  Square: PCI Compliance: Everything You Need to Know

• Helcim, pricing FAQ

  Lists “PCI compliance fees” among the “typical hidden fees” it does not charge.

  Helcim: Pricing

• Clover, PCI guide

  “Of course, there are direct PCI compliance fees – normally calculated and charged by your payment processor.”

  Clover: What is PCI compliance?

Those are the providers' claims, not ours. Square's holds only on its condition, and the standard adds its own line in Requirement 12.8.1: “The use of a PCI DSS compliant TPSP does not make an entity PCI DSS compliant, nor does it remove the entity's responsibility for its own PCI DSS compliance.” No PCI fee is not the same as no PCI duty. The Square guide and the Helcim and Square comparison read both claims against the rule.

Two other levers are worth a question. A smaller scope means a shorter SAQ, and a shorter SAQ gets filed on time; the PCI scope checker shows what you could take out. And Visa's Technology Innovation Program can remove the requirement to verify PCI DSS compliance “when at least 75% of yearly transactions originate through EMV chip-enabled terminals, a validated point-to-point encryption solution or integrated industry-standard tokenization solution meeting EMVCo Tokenization Specification.” Eligibility is Visa's and the acquirer's call.

Where fee amounts are published

This site prints no fee amounts: the figures belong to each provider and change with its terms. Where a figure is published, here is where to read it yourself.

How a brand assessment on the bank becomes a line on your statement is the processor's business. Square's own PCI article puts it bluntly: “The banks often pass this cost along to the merchant.” That is why the only figure that matters for you is the one on your own statement.

Quick reference

Questions