PCI non-compliance fees: what they are and how to avoid them

Few fees annoy store owners more than this one, mostly because it's avoidable. A PCI non-compliance fee is a charge some processors add to your statement when you haven't confirmed that your business meets the card industry's data security standards. You usually stop paying it by completing a short annual questionnaire and any required security scans.

Here's what's behind it and how to get it off your statement.

What is PCI compliance?

PCI stands for Payment Card Industry. The PCI Security Standards Council publishes the PCI Data Security Standard, known as PCI DSS, a set of rules for any business that accepts, stores, or transmits card data.

The rules cover practical things. Protect card data. Don't store what you don't need. Use secure equipment. Control who has access to your systems. Keep software updated.

Card networks require merchants to follow these standards, and they expect acquiring banks to make sure their merchants do. That's where the fee comes from.

Wikipedia's page on the Payment Card Industry Data Security Standard gives a readable overview of the standard's history and structure.

Why does the fee show up?

Your processor needs to show that its merchants are validating compliance. Validation usually means filling out a Self-Assessment Questionnaire, or SAQ, once a year. Some businesses also need quarterly network scans by an approved vendor, depending on how they take cards.

If you haven't completed your SAQ, many processors charge a monthly fee until you do. It's meant to push merchants toward completing it and to cover the processor's added risk.

Here's a hypothetical. Say a processor charged a $20 monthly non-compliance fee, and you went a full year without completing the questionnaire. That's $240 for paperwork that might have taken an hour.

Some processors also charge a separate annual PCI program fee for access to their compliance tools. That's different from the non-compliance fee. Your statement should label them separately, and your agreement should explain both.

How do you stop paying it?

Most small stores can clear it in a few steps.

1. Find out which SAQ applies to you. Your processor's compliance portal usually asks a few questions and picks the right form. A store using a chip terminal connected to a processor often has one of the shorter versions.
2. Complete the questionnaire honestly. It asks yes-or-no questions about how you handle card data.
3. Run any required scans. If your setup needs them, the portal will say so and usually connects you to a scanning vendor.
4. Submit and keep a copy. Save the confirmation and the date.
5. Put a reminder on your calendar for next year.

If you answer "no" to a question, fix the issue or ask your processor what to do. The point is to actually be secure, not just to check boxes.

What habits keep you compliant all year?

The questionnaire is a snapshot. Your daily habits are what keep you safe.

Use a secure, up-to-date card reader. Chip and tap readers built to current standards handle card data better than old swipe-only devices.

Never write card numbers down or store them on paper or in a spreadsheet.

Give each employee their own POS login. Remove access when someone leaves.

Keep your payment devices on a private network, not the guest Wi-Fi.

Let your reader and POS install updates when prompted.

If your equipment is old, ask about an upgrade. NRS Pay offers a free card reader with signup. You can see the NRS Pay equipment page or ask the NRS Pay team how PCI validation works on their accounts.