Short answer
PCI DSS is the security standard for businesses that accept cards. Many providers charge a monthly PCI compliance fee for helping you complete the annual questionnaire, and a much higher non-compliance fee if you have not. The fee is set by your provider, not the card schemes, so it can often be reduced or removed by completing the questionnaire.
Part of Fees and pricing models. Start with the main guide: Interchange plus vs blended vs flat rate: which pricing model costs less?
Key takeaways
- PCI DSS is the card industry security standard. Every business that takes cards is expected to follow it.
- Providers charge a monthly PCI fee, and often a higher non-compliance fee until you have completed your self-assessment.
- The fees are set by your provider's contract, not by the card schemes.
- Which questionnaire (SAQ) you complete depends on how you take cards, not how much you take.
- Completing the questionnaire usually stops the non-compliance fee, so check your status first.
Few lines on a card statement cause as much confusion as the PCI charge. It appears every month, it is often small, and then one month it is several times larger with no explanation. Business owners ask what it is for, whether they have to pay it and why it suddenly went up.
This guide answers those questions. It explains what PCI DSS is, why providers charge for it, how the monthly fee and the non-compliance fee differ, how to work out which questionnaire applies to you and how to complete it. The aim is simple: to make sure you are paying for compliance once, not twice.
What is PCI DSS?
The requirements exist to protect card details from theft. They apply to every business that accepts cards, from a market stall with a handheld reader to a national retailer. What a business has to do depends on how it takes cards and how much risk its setup carries.
The current version is PCI DSS v4.0.1, which became the only valid version from 31 December 2024. Small businesses are generally not audited by an outside assessor. Instead they complete a self-assessment questionnaire, known as an SAQ, once a year.
Where do PCI fees come from?
PCI DSS itself is not a fee. The charge on your bill comes from your provider's contract. Providers are responsible for making sure the businesses they sign up are compliant, so they run a programme to collect each year's questionnaire and, in many cases, charge for it.
There are usually two kinds of charge.
| Charge | What it is | Typical pattern | Can it be removed? |
|---|---|---|---|
| PCI compliance fee | A monthly fee for access to the provider's compliance portal and support | Small, fixed, every month | Sometimes negotiable, or removed if you complete the questionnaire elsewhere |
| PCI non-compliance fee | A higher monthly charge applied while your questionnaire is out of date or incomplete | Larger, may start after a deadline | Usually yes, once you complete the questionnaire |
The amounts are set by each provider. Your contract or price schedule will list them. We do not give typical figures here because they vary widely, and an out-of-date number is worse than none.
Illustrative amounts: a £5.00 monthly compliance fee and a £30.00 monthly non-compliance fee. Check your own price schedule.
On these illustrative figures, a business that has not completed its questionnaire pays £300 a year more than it needs to. That is why checking your status is worth five minutes.
How does a non-compliance fee creep in?
Many businesses never notice the non-compliance fee starting, because the sequence is gradual.
- Account opensYou are asked to complete a questionnaire within a set number of days.
- Reminders sentEmails or letters arrive, often to an address nobody checks.
- Deadline passesThe provider marks the account as non-compliant.
- Higher fee startsA non-compliance line appears on the statement, often alongside the normal PCI fee.
- Annual renewalThe questionnaire expires, and the cycle can repeat.
The exact timings are set by your provider.
The charge can also begin because the questionnaire expired, not because it was never done. Compliance has to be renewed each year. Our guide to hidden fees on a merchant statement lists where else extra charges tend to hide.
Which PCI questionnaire applies to you?
The SAQ you complete depends on how you take card payments, not on how much you take. There are several versions. The most relevant ones for small businesses are described below. Your provider's portal normally asks a few questions and picks the right one.
| SAQ | Who it is for |
|---|---|
| SAQ A | Card-not-present businesses (online, phone, mail order) that have fully outsourced card handling to a compliant provider |
| SAQ B | Businesses using imprint machines or standalone dial-out terminals only, with no electronic storage of card data |
| SAQ B-IP | Businesses using standalone, PCI-approved terminals connected over the internet |
| SAQ P2PE | Businesses using a PCI-listed point-to-point encryption solution for their terminals |
| Other versions | Businesses with more complex setups, such as integrated tills or their own payment pages |
If you use a standard card machine from your provider, you will usually end up with one of the terminal-based questionnaires. If you take payments online through a hosted payment page, you will usually complete SAQ A. Merchants who take payments through more than one channel may need to complete more than one.
How do you complete the PCI questionnaire?
The process is more routine than it sounds, and most small businesses can finish it in under an hour.
- Log in to your provider's PCI portal. The details are usually in the welcome pack or on the statement.
- Answer the profile questions. How do you take cards? Do you store card numbers? Do you have a website that takes payment?
- Complete the questionnaire the portal selects. It is a series of yes or no questions about your security practices.
- Sign the attestation. This is a declaration that your answers are true.
- Run any scans required. Some setups, especially those with websites, require a vulnerability scan by an approved scanning vendor.
- Download and keep the certificate. Keep a copy and note the renewal date.
For SAQ A merchants under the current version of the standard, one source notes that the payment page may need to be scanned at least quarterly by an approved scanning vendor. Check the current requirements for your own questionnaire with your provider or the PCI Security Standards Council.
How do you get rid of a non-compliance fee?
If you are being charged a non-compliance fee, a sequence of steps usually works.
- Confirm you are being charged it. Look for "non-compliance", "non-validation" or similar on your statements.
- Ask your provider for your PCI status and the date it changed.
- Complete the questionnaire. Do it as soon as possible. Many providers remove the higher fee from the next billing cycle.
- Ask for a refund of recent charges. Not all providers agree, but it is worth asking, especially if you never received a reminder.
- Diary the renewal. Set a reminder for 11 months from the date you completed it.
If you complete the questionnaire and the non-compliance fee continues, ask for the portal record that shows the date you submitted it. Keep copies of everything.
Should you pay the monthly PCI fee at all?
The monthly compliance fee is for a service: the portal, the questionnaire and sometimes an insurance or breach-support add-on. Some businesses prefer to pay for the convenience. Others find it poor value, especially if they could complete the questionnaire directly on the PCI Council's own materials.
Questions worth asking:
- What exactly does the monthly fee include?
- Is there any breach cover or liability protection, and what are its limits?
- Can I complete the questionnaire without the portal and have the fee removed?
- Is the fee charged by the provider or passed on from a third party?
If the answers are vague, treat the fee as negotiable, in the same way as the statement or account fee described in monthly fees on a card machine bill.
What does PCI mean for your effective rate?
A monthly PCI charge is a fixed fee. On low turnover it adds a noticeable amount to your effective rate. A £5.00 charge on £3,000 of monthly turnover adds 0.17 percentage points. A £30.00 non-compliance charge on the same turnover adds 1.00 percentage point, which can more than double the cost of some deals. Always include both when you calculate the all-in rate, as shown in our guide to the effective rate.
For consultants
PCI charges are one of the quickest wins in a review. A merchant who is paying a non-compliance fee they did not know about can save money in a day, without switching anything. Pointing that out first, and helping them complete the questionnaire, is a goodwill gesture that builds trust. If you then propose a switch, the merchant is more likely to listen. The checkmyrates calculator has a field for the PCI charge on both sides of a comparison.
Frequently asked questions
What is a PCI compliance fee?
It is a monthly charge from your card provider for access to its compliance portal and support in completing your annual PCI questionnaire. The amount is set by your provider's contract.
What is a PCI non-compliance fee?
A higher charge applied when your PCI questionnaire is incomplete or out of date. It usually stops once you complete the questionnaire, though the exact process depends on your provider.
Do I have to pay for PCI compliance?
Compliance with the standard is expected of every business that takes cards. Paying a monthly fee to your provider is a contract term, not a requirement of the standard itself, so it can be queried or negotiated.
Which PCI questionnaire do I need?
It depends on how you take cards, not on how much you take. Businesses with standalone terminals usually complete an SAQ B variant, and online businesses with outsourced payment pages usually complete SAQ A. Your provider's portal should select the right one.
How often do I need to complete the questionnaire?
Every year. Diary the date you complete it so that the fee does not come back when it expires.
Can I get a refund of non-compliance fees?
Sometimes. Ask your provider, especially if you never received a reminder. Keep records of when you completed the questionnaire and when the charges started.
Sources and further reading
Figures in this guide are examples to show the method. Fees, rules and rates change, so check your own statement, contract and current rules before you decide. This is general information, not financial or legal advice.