A PCI non-compliance fee is a monthly charge your payment processor or acquiring bank adds when it has no current record that you have validated PCI DSS compliance. In practice, that usually means you haven’t submitted this year’s self-assessment questionnaire (SAQ) and attestation, or a required quarterly vulnerability scan, through their portal. It is not a fine from the PCI Security Standards Council (PCI SSC). The Council says it does not manage compliance programs or impose penalties. The fee comes from your merchant agreement.
The usual way to remove it is to find out which SAQ your acquirer expects, complete it and sign the attestation in their compliance portal, pass any required scans, and then ask for the fee to stop. Many processors also charge a separate PCI compliance or program fee that continues even after you validate. Knowing which line you’re looking at is the first step. This post covers both, with published fee ranges, and ends with a section for MSPs that want to offer this as a service. It is general information, not legal advice. Your merchant agreement sets the actual terms.
Why is there a PCI fee on my merchant statement?
The card brands require acquirers to manage their merchants’ PCI DSS compliance, and acquirers pass that work, and its cost, down to merchants through the merchant agreement. Two kinds of line item are common:
- PCI compliance fee (also called a PCI program, PCI service or annual PCI fee). It pays for the processor’s compliance program, usually an online portal for the SAQ and, where required, vulnerability scans. Many processors charge it whether or not you are compliant.
- PCI non-compliance fee. It is charged only when you haven’t validated by the deadline, and it repeats every month until you do. On statements it can appear as “PCI non-validation,” “non-receipt of PCI validation” or “non-PCI chg,” according to CardFellow.
Not every processor charges either fee. Merchant Maverick’s 2024 comparison lists several providers, including Square, Stripe and PayPal, that it says charge neither.
How much is a PCI non-compliance fee?
There is no standard amount, and PCI SSC doesn’t set one. These are the published figures we found:
| Source | What it reports |
|---|---|
| Merchant Maverick (updated Aug 2024) | Non-compliance fees average about $20–$30/month. Examples: CardConnect $29.95/month, TSYS $94.95/month, Flagship $30/month |
| CardFellow | Typically $10–$30/month, up to $100/month. Statement examples from $9.95 to $65.00 |
| Stripe | Acquiring banks typically start at $25–$50/month |
| SecureTrust (Jul 2026) | Processor non-compliance fees of $10–$300/month; “no set or universal rates” |
| Checkout.com’s published terms | $150/month (Level 4) up to $600/month (Level 1), after a 60-day grace period |
For a small US merchant, the commonly cited range is about $20 to $100 a month. The PCI compliance (program) fee is usually smaller and charged once a year. Merchant Maverick puts the average at about $120 a year and lists examples from $99.50 to $259.99 a year.
Over a year, a $30 monthly non-compliance fee adds up to $360. That is often more than the program fee and more than the time it takes to complete a short SAQ.
What is the difference between a PCI compliance fee and a non-compliance fee?
| PCI compliance / program fee | PCI non-compliance fee | |
|---|---|---|
| When it’s charged | Usually annually, sometimes monthly | Monthly, after a validation deadline is missed |
| Does validating stop it? | Usually not; it’s part of your pricing | Usually yes, from the next billing cycle once accepted |
| What it pays for | The processor’s portal, scan service and program administration | Nothing extra. It’s a charge for missing validation |
| Who sets it | Your processor or acquirer, per your merchant agreement | Your processor or acquirer, per your merchant agreement |
| Can you negotiate it? | Sometimes, at signing or renewal | You can often stop it by validating, and ask for recent charges to be credited |
Neither fee is a card-brand fine. Card-brand fines are separate, are generally tied to breaches or serious unresolved failures, and are assessed against the acquirer, which may pass them on under the merchant agreement.
How do I remove a PCI non-compliance fee?
This sequence works with most US acquirers:
- Find the portal. Your statement, welcome email or processor’s support site will name it. Many acquirers use a PCI program vendor, so the portal may carry another company’s name. Checkout.com, for example, uses ZeroRisk.
- Confirm which SAQ they expect. The portal often suggests one from a short questionnaire about how you take cards. Check that suggestion against the actual eligibility criteria. Our guide to which PCI SAQ you need walks through each type.
- Answer the SAQ truthfully and sign the attestation. The Attestation of Compliance (AOC) is your declaration, as the merchant, that you are eligible for that SAQ and that the answers are accurate. Don’t tick “in place” for controls you don’t have just to make the fee go away. If something isn’t in place, fix it or speak to your acquirer.
- Complete scans if your SAQ requires them. Several SAQs include quarterly external vulnerability scans by an Approved Scanning Vendor (Requirement 11.3.2). Under v4.x that includes SAQ A for e-commerce merchants whose site redirects to or embeds a provider’s payment page, per PCI SSC’s SAQ guidance. A missing or failed scan can keep the fee running even after the SAQ is filed.
- Upload a QSA’s AOC instead, if you have one. If a Qualified Security Assessor assessed you, most portals accept the resulting AOC.
- Ask for the fee to stop, and for recent charges to be credited. Fees often stop from the next billing cycle once validation is accepted. Checkout.com’s terms say exactly that. CardFellow and SecureTrust both suggest calling the processor to ask for the fee to be removed and for recent charges to be reviewed.
- Set a renewal reminder. Validation is annual and scans are quarterly. Most repeat fees come from merchants who validated once and then forgot.
If you can’t get validation accepted because your setup doesn’t fit any SAQ, the fee is a symptom. The fix is usually to change how you take cards, for example by moving to a hosted or iframe checkout, a P2PE terminal or a validated virtual terminal, so you qualify for a shorter SAQ.
How can MSPs turn PCI fees into a service?
For an MSP, PCI fees are an easy problem to spot and easy to solve, and the result is something the client can see. A merchant paying $30 a month in non-compliance fees can check the next statement to confirm the problem is fixed. A simple service looks like this:
- Find it. During onboarding or a quarterly review, ask clients for a recent merchant statement and look for PCI line items. Record the processor, the portal, the SAQ type and the renewal date for each.
- Fix it. Map each payment channel, collect provider AOCs, set up scans where required and prepare the SAQ answers with the client. The merchant reviews and signs the attestation. You prepare the work; you don’t attest on the merchant’s behalf.
- Keep it fixed. Track annual SAQ renewals and quarterly scan dates across your client base, and re-check eligibility whenever a client changes its website, checkout or terminals.
- Know your own position. If you manage systems that can affect a client’s payment security, the client’s acquirer or QSA may treat you as a service provider. PCI SSC’s FAQ 1578 says service providers use SAQ D for Service Providers and that a merchant SAQ isn’t enough evidence for customers. See MSP AOCs and service provider status.
Price the service on the outcome. Show the fee that stopped and the renewal calendar you keep, not hours spent on a questionnaire.
Frequently asked questions
Do I have to pay a PCI compliance fee?
If your merchant agreement includes one, generally yes. It is a contractual charge from your processor, not a legal or PCI SSC requirement, and some providers don’t charge it at all. You can sometimes negotiate it when signing or renewing. A non-compliance fee is different: you can usually stop it by completing your annual validation and any required scans.
Is a PCI non-compliance fee a fine from PCI SSC?
No. PCI SSC says it does not manage compliance programs or impose penalties for non-compliance. Non-compliance fees are set by your processor or acquirer under your merchant agreement. Card-brand fines are a separate matter: they are assessed through acquirers and are generally linked to breaches or serious failures, not to a late questionnaire.
How long does it take for the fee to stop after I complete my SAQ?
It depends on the processor. Typically the fee stops from the next billing cycle after your validation is accepted, and Checkout.com publishes exactly that rule. Allow time for the portal to review submissions and process any scans. If the fee is still on your next statement, call the processor, confirm your validation is on file and ask for the charge to be credited.
Why am I still charged after filing my SAQ?
Common reasons: a required quarterly external scan is missing or failed, the SAQ you filed doesn’t match how you actually take cards, the submission is under a different merchant ID, or the portal is still reviewing it. Some statements also show a separate PCI program fee that continues regardless of your status. Check each line item against your portal status.
Where CardSecurity fits
CardSecurity is building PCI compliance management for MSPs: SAQ questionnaires, evidence collection, policies and signed packs across many merchants. It is in early access and not generally available yet. CardSecurity doesn’t file attestations or certify compliance; the merchant attests and the acquirer decides. Learn more and join the PCI compliance early access, or see how CardSecurity works with MSPs.