PCI Compliance Cost Calculator

What it tells you

PCI compliance cost is everything you pay in a year to accept cards under the standard: the fees your processor bills, any quarterly scans, outside help, software, your own staff's hours and the fixes in between. The calculator turns each line into a yearly figure, adds them, and shows the monthly equivalent and where the money goes.

What you owe depends on how you are asked to validate. “Compliance validation requirements are set by brands, acquirers, payment facilitators, etc.,” and your acquirer assigns your merchant level from your yearly card volume for each card brand. The merchant level calculator shows where you likely sit; a level that calls for a Report on Compliance moves the QSA line from optional to expected.

How to use this calculator

1. Pull a year of processor statements. Find the PCI program or compliance fee and any line named non-compliance; enter each with the period it is billed in.
2. Add the scan vendor's invoice under Scan fee. If you do not have a scan vendor yet, the ASV scanning vendors compared page lists who can run one.
3. Enter any quote from a QSA, consultant or penetration tester, and any software you pay for.
4. Count the hours you and your staff spend on PCI in a year, and what an hour costs you.
5. Add fixes: a failed scan, a firewall change, a new card reader. Copy or print the receipt for your files.

What your SAQ implies

Pick your validation type to see which lines usually apply. If you are not sure which SAQ is yours, PCI SAQ types explained walks through each one. Your acquirer has the final word on what it expects.

Worked example: a web shop on SAQ A

A small online shop sends shoppers to its processor's hosted payment page. That redirect setup fits SAQ A, which the Council counts at 27 requirements and which still includes the 11.3.2 external scans. Here is how each of its lines goes into the calculator. The amounts are the shop's own, so the example shows the arithmetic rather than a price.

For this shop the recurring lines are the statement fee, the scan windows and its own hours. A non-compliance line, if the processor ever billed one, would sit on top of all of it. Keeping the SAQ and scan dates in view is the cheap part: the PCI deadline calendar turns your last SAQ and last passing scan into the next dates.

Who sets each fee

No fee in this calculator comes from the standard itself. “Enforcement of compliance with PCI Standards and determination of any non-compliance penalties are carried out by the individual payment brands and not by the PCI SSC,” and the Council “has no information about penalties or fines for non-compliance.” A PCI non-compliance fee on a merchant statement comes from the acquirer or processor under its card-brand program, never from the PCI Security Standards Council. Visa's rules go further: “the issuer or acquirer … must not represent that Visa has imposed any assessment on the service provider or merchant.”

How a processor bills it is in its own terms. Stax, for one, writes: “If the merchant does not become compliant within 90 days of enrolling, they will be charged the PCI Non-Compliance Fee monthly until compliance is achieved.” Enter a fee like that per month. Our guide to PCI compliance fees and the non-compliance fee reads a statement line by line.

Some processors bill no PCI line at all. Square says: “Provided you use Square for all storage, processing, and transmission of your customers' card data, you don't need to take any steps to validate your PCI compliance to Square, and you don't need to pay any PCI-compliance fees.” On that path the lines left are your own: staff time, any scans your acquirer asks for, and fixes. That is Square's claim, with its condition; Requirement 12.8.1 below still says a compliant provider does not make you compliant. Is Square PCI compliant? sets the two side by side.

Where the rules say so

The recurring lines come from requirements with a clock on them. Each names its source, read on 2026-10-22. Whether a requirement is in your questionnaire depends on your SAQ type; the SAQ type finder names yours.

• Req. 11.3.2

  External vulnerability scans at least once every three months by an ASV approved by PCI SSC.

  ASV Program Guide §1.1

• Req. 11.3.2.1

  External scans also run after any significant change; these need qualified, independent staff but not an ASV.

  Prioritized Approach Tool

• ASV-PG §6.2

  A passing scan has no vulnerability scored 4.0 or higher on CVSS. Fix the failures and rescan until a report passes.

  ASV Program Guide §6.2, §6.3.2

• Req. 11.4.2, 11.4.3

  Internal and external penetration tests “At least once every 12 months” and after any significant change, by a qualified, independent tester (not required to be a QSA or ASV).

  Prioritized Approach Tool

• Req. 12.6

  Staff are trained “Upon hire and at least once every 12 months.”

  Prioritized Approach Tool

• Req. 12.8.1

  “The use of a PCI DSS compliant TPSP does not make an entity PCI DSS compliant, nor does it remove the entity's responsibility for its own PCI DSS compliance.”

  Prioritized Approach Tool

What the result means

A big Staff time share usually means the paperwork is the cost; a platform from our PCI compliance software comparison is worth pricing against those hours. A big QSA or consultant share is worth checking against what each kind of firm may do. Any non-compliance share is money for nothing: ask your processor what it needs from you, then send it.