You open your card processing statement and see a line you don't recognize: "PCI non-compliance." It shows up month after month. Many owners pay it for years without knowing what it is, or that it can usually be stopped.
What does PCI mean?
PCI DSS is the Payment Card Industry Data Security Standard. It's a set of security rules for any business that accepts, processes or stores card data. The PCI Security Standards Council publishes it, and it applies to businesses of every size.
What PCI DSS asks of your business depends on how you take cards, and your provider can tell you which requirements apply. Common basics include using secure, up-to-date card equipment, never writing down or storing full card numbers, keeping your Wi-Fi and devices locked down, and limiting who can access payment systems.
What is the non-compliance fee?
Your provider is expected to make sure the businesses it serves follow PCI rules. Many providers ask you to confirm your compliance on a regular schedule, often each year, usually by completing a Self-Assessment Questionnaire (SAQ). Depending on how you take cards, a regular network scan may be required too.
If your provider doesn't have a current, completed questionnaire on file for you, many charge a monthly non-compliance fee until you finish it. It's a provider fee, not a government fine. The name varies: you may see "PCI non-compliance," "non-validation" or something similar.
Don't confuse it with a separate "PCI compliance" or "PCI program" fee. Some providers charge that whether or not you've completed anything. Ask what each PCI line on your statement is for.
Why do so many owners pay it?
- Nobody told them a questionnaire was required.
- The login to the provider's compliance portal was lost or never set up.
- They completed it once, but it expired and nobody renewed it.
- They switched equipment and the record never got updated.
How do you make it stop?
- Find the line. Look at your latest statement for any fee with "PCI" in its name and note what each one is called.
- Call your provider. Ask: "Which questionnaire applies to my business, where do I complete it, and is a scan required for my setup?"
- Complete it honestly. Answer based on how your business really takes cards. If a question doesn't make sense, ask your provider before you answer.
- Keep proof. Save a copy of the completed questionnaire and any scan report, with the date.
- Check the next statement. Confirm the non-compliance fee is gone. If it's still there, ask why and when it will stop.
- Set a reminder. Put the renewal date on your calendar so it doesn't lapse again.
What should you ask your provider?
- What is each PCI-related fee on my statement, and what do I need to do to stop any of them?
- Which questionnaire fits how I take cards (terminal, online, phone or tap-to-pay)?
- When does my compliance expire, and will you remind me before it does?
- Can you help me fill it out if I get stuck?
Frequently asked questions
Is a PCI non-compliance fee a government fine?
No. It's a fee your card processing provider charges, not a government fine. Many providers charge it monthly until they have a current, completed security questionnaire on file for your business.
How do I stop paying a PCI non-compliance fee?
Ask your provider which Self-Assessment Questionnaire (SAQ) applies to how you take cards and whether a scan is required. Complete it honestly, keep proof, and check your next statement to confirm the fee is gone.
Is a PCI non-compliance fee the same as a PCI compliance fee?
No. Some providers charge a separate "PCI compliance" or "PCI program" fee whether or not you've completed anything. Ask your provider what each PCI line on your statement is for.
How often do I need to confirm PCI compliance?
Many providers ask you to confirm it on a regular schedule, often each year. Ask your provider when yours expires, and put the renewal date on your calendar so it doesn't lapse.
Does PCI DSS apply to small businesses?
Yes. PCI DSS applies to any business that accepts, processes or stores card data, of every size. What it asks of your business depends on how you take cards.
How we approach it at Keepwell
When we review a statement, we point out every PCI line and explain what it's for. If something looks avoidable, we'll tell you what to ask your provider. A review may show other fees worth a second look. Results vary.
Want us to look at your statement? Upload it at keepwellpayments.com/upload for a free, no-obligation review.
Sources
- PCI Security Standards Council, "PCI DSS": pcisecuritystandards.org/standards/pci-dss/ (opens in a new tab)
- PCI Security Standards Council, "Merchant resources" (SAQs and small merchants): pcisecuritystandards.org/merchants/ (opens in a new tab)
Keepwell Payments, LLC is an independent payments agency, not a bank or payment processor. Each merchant account is set up with a payment processor we partner with and its sponsor bank, named in writing before you sign. Merchant accounts are subject to approval. Results vary by business. This article is general information, not financial, legal or security advice.