Almost every merchant statement has a PCI line. Here is what it covers, who charges it, and how to make the non-compliance fee go away.
Almost every merchant statement we look at has some kind of PCI line on it. It might say PCI compliance fee, PCI program fee, annual compliance fee, or PCI non-compliance fee. Most owners pay it every month or every year without knowing what it is, whether they have to pay it, or how to make the bigger one go away.
Quality Merchant Services is an authorized sales agent for Real Merchant Services. We review statements for free, and PCI charges are one of the easiest places to find money you are paying for nothing. This guide explains what PCI is, what these fees usually cover, and what to check on your own statement.
PCI stands for the Payment Card Industry Data Security Standard, usually shortened to PCI DSS. It is a set of security rules for any business that accepts, processes, or stores card data. The standard is managed by the PCI Security Standards Council, which was formed by the major card brands.
Here is the part that surprises people: the council does not send small merchants a bill. The PCI fees on your statement are generally charged by your processor or the bank behind your merchant account. Your merchant agreement is what requires you to stay compliant, and your processor decides what, if anything, to charge for its compliance program.
This is a recurring charge, monthly or yearly, for the processor’s compliance program. Depending on the provider, it may include access to an online portal where you fill out your questionnaire, security scans if your setup needs them, and sometimes a breach protection or data security product.
Some processors charge it, some bundle it into other fees, and some do not charge it at all. Ask what yours covers. If you cannot get a clear answer, that is useful information too.
This is the one to watch. Many processors add a separate monthly fee if you have not completed your annual PCI validation. It often keeps running quietly every month until someone finishes the questionnaire, and it is usually not small compared to the compliance fee.
In most cases the fix is not complicated: log into your processor’s PCI portal, complete the questionnaire that matches how you take cards, and confirm the fee comes off your next statement.
Most small merchants do not need an outside auditor. Compliance usually means filling out a Self-Assessment Questionnaire, or SAQ, once a year. Which version you fill out depends on how you accept cards. A business that only takes cards on a standalone terminal answers far fewer questions than one that runs its own online checkout.
Some setups also need a quarterly network scan from an approved scanning vendor. Your processor’s portal will usually tell you if that applies to you.
The questions themselves are mostly common sense:
Modern chip and tap terminals, and hosted online checkouts where card numbers never touch your own server, generally make compliance much simpler. See Best Payment Terminals for Small Businesses in 2026.
The monthly charge is the part you see. The bigger reason to take PCI seriously is what happens if card data is stolen from your business. Merchants that suffer a breach can face costs passed down through the processor, along with investigation work and a lot of lost time. A few minutes of basic security and an honest questionnaire are worth it.
PCI fees are rarely the biggest cost on a statement, but they are a good test of how transparent your processor is. If the small fees are confusing, the bigger ones usually are too. See 5 Signs You Are Paying Too Much for Credit Card Processing and What Is Interchange Pricing and Why Does It Matter?
Dual pricing changes who covers the cost of card processing, not the security rules. You still accept cards, so PCI still applies. What it can change is the total you pay for processing each month. With clearly posted cash and card prices, and within card-brand and state rules, many small businesses bring their net processing cost close to zero. Gas stations have used dual pricing for decades and customers rarely complain. Learn more in our dual pricing guide, Cash Discount vs Dual Pricing, and Is Zero Fee Credit Card Processing Legal?
Send us your latest merchant statements through the form on our contact page. Payments is a largely unregulated industry, so our team of analysts will look over your statement to make sure there are no discrepancies, including PCI and non-compliance fees you may not need to be paying, and walk you through what each charge is for. If a Real Merchant Services program would actually save you money, we will show you the math. If your current setup is fine, we will tell you that.
No fee to review. No fake guaranteed savings percentage. No pressure to sign. We serve businesses nationwide from Kalispell, Montana.
Not sure what the PCI fees on your statement are for? Send your latest statement and we will tell you what you are paying and why.
Get My Free Analysis →