PCI compliance fees: what they are and why they show up on your statement

A PCI compliance fee is a recurring charge that a payment processor or acquiring bank adds to merchant accounts to cover the cost of verifying — or simply billing for — adherence to the Payment Card Industry Data Security Standard (PCI DSS). It usually appears monthly or annually as a separate line item, distinct from transaction fees or interchange.

The merchant pays it, always. It is baked into the cost of accepting card payments, whether the business processes ten transactions a month or ten thousand. The fee itself is set by the processor, not by the PCI Security Standards Council, which does not charge merchants directly.

What this fee is

A PCI compliance fee is money your processor or acquirer collects for administering, tracking or simply invoicing your PCI DSS compliance status. PCI DSS is a set of security requirements — encryption, access controls, network segmentation, logging — that any business handling card data must follow, enforced by the card networks (Visa, Mastercard, etc.) through their acquiring banks.

The name is frequently misleading. In many cases the fee does not fund a genuine compliance audit or scan; it is a flat administrative charge the processor levies regardless of whether it performs any verification work. Some processors label it PCI non-compliance fee, security fee or data security fee, and these can be different charges stacked on top of each other, not variants of the same thing. A non-compliance fee specifically punishes a merchant who hasn’t completed the required self-assessment or scan; a general compliance fee is charged to everyone, compliant or not.

How it is calculated

• Most commonly a flat monthly or annual fee, independent of sales volume
• Some processors charge it per merchant ID, so a business with multiple locations or storefronts pays multiple times
• A separate, usually larger, non-compliance fee can apply on top if the merchant hasn’t filed a Self-Assessment Questionnaire (SAQ) or passed a required vulnerability scan
• Occasionally bundled into a broader account/statement fee, making it hard to isolate on the bill
• Typical orders of magnitude seen across the market run from a few dollars a month for the baseline compliance fee to tens of dollars a month when non-compliance penalties are added — these are illustrative ranges, not quoted rates, and vary by processor and merchant category

When you get charged

• On a recurring monthly or annual cycle, regardless of transaction volume
• When you open a new merchant account, often starting from the first billing cycle
• When your business fails to complete the annual SAQ or required quarterly network scan — this typically triggers an additional non-compliance surcharge
• When you operate under multiple merchant IDs or sub-accounts, each one can be billed separately
• Sometimes even after you’ve switched processors, if the old account wasn’t formally closed and compliance tracking continued
• It repeats for as long as the merchant account stays open, not just once at signup

Can you avoid it

• Negotiable in some cases: processors serving larger-volume merchants will sometimes waive or reduce the flat fee as part of contract negotiation — ask explicitly, it is rarely offered upfront
• Avoidable by completing compliance steps: filing the SAQ and passing required scans on time removes the non-compliance penalty portion, though the base administrative fee may still apply
• Avoidable by choosing a provider that doesn’t itemize it: some modern payment platforms fold compliance costs into their overall pricing and don’t bill it as a separate line; this doesn’t mean compliance costs disappear, it means they’re priced in elsewhere
• Genuinely fixed in some contracts: smaller merchants on standard-rate plans often have no leverage to remove it and must treat it as a fixed cost of accepting cards
• Reducible by consolidating merchant IDs: fewer accounts can mean fewer separate fee instances, though this depends on the business structure and may not be feasible for multi-location operations

What it really costs over a year

Example: a small retailer on a processor charging an illustrative $10 per month in PCI compliance fees pays $120 a year, independent of how the business performs. If that same retailer misses its annual SAQ deadline and incurs an illustrative $20 monthly non-compliance surcharge for four months before resolving it, that adds $80, bringing the annual total to $200 for that year only.

When comparing two processors, don’t compare the headline PCI fee alone — compare the total annual cost of the account: transaction fees plus monthly account fees plus PCI compliance fees plus any statement or gateway fees. A processor advertising no PCI fee may charge higher per-transaction rates that cost more over a year of real volume. Build a simple annual total using your actual or projected transaction volume before deciding, rather than comparing isolated line items.

What to check before you commit

• Ask whether the PCI fee is flat or tied to merchant ID count, and whether it increases if you add locations
• Ask what specifically triggers the non-compliance surcharge and how much notice you get before it’s billed
• Ask whether completing the SAQ removes the fee entirely or only the penalty portion
• Ask whether the fee is disclosed in the written merchant agreement or only mentioned verbally — get it in writing
• Check the processor’s published fee schedule directly, since rates, thresholds and fee names change and the provider’s own schedule is the authoritative source, not third-party summaries including this one

Frequently asked questions

Is a PCI compliance fee the same as a PCI non-compliance fee? No. The compliance fee is a standing administrative charge billed to most or all merchants; the non-compliance fee is an additional penalty applied only when you haven’t completed required steps like the SAQ or a scan.

Can I get this fee refunded if I was never told about it? Check your merchant agreement first — if it was disclosed in the contract, a refund is unlikely, though some processors will credit it as a goodwill gesture if you push back. If it wasn’t disclosed, raise it as a dispute with the processor directly.

Does completing my SAQ make the fee go away completely? Usually only the non-compliance penalty portion. The base PCI compliance or administrative fee often continues regardless, since it’s billed as a standing cost of the account rather than a response to non-compliance.

Why does one of my locations get charged and another doesn’t? This usually comes down to separate merchant IDs. If each location has its own ID, each is tracked and billed independently for PCI compliance, even under the same parent business.

Should I switch processors just to avoid this fee? Not on this fee alone. Compare total annual cost including transaction rates, since a processor that doesn’t itemize a PCI fee may charge more elsewhere to cover the same underlying cost.