What Is the PCI Non-Compliance Fee on My Statement?

By the TouchSuite payments team · Updated 2026-11-02

A PCI non-compliance fee is a monthly charge your processor adds when its records show you haven't validated compliance with the Payment Card Industry Data Security Standard (PCI DSS), usually because an annual questionnaire or a required quarterly scan was never submitted. It is not a government fine or a card brand penalty, and in most cases it stops once you complete validation in your processor's PCI portal.

Key takeaways

The PCI non-compliance fee is set by your processor under your merchant agreement. It is not interchange, not a card brand assessment, and not a card brand fine.
It is triggered by missing validation paperwork (a Self-Assessment Questionnaire, an Attestation of Compliance, or a required scan), not by a finding that your business is insecure.
Because it is a flat dollar amount, it raises a small merchant's effective rate far more than a large merchant's. At an example fee of $39.95, a business processing $4,000 a month pays about 1% of volume for this one line.
To make it stop, log in to your processor's PCI portal, choose the SAQ that matches how you take cards, run any required scan, submit, and save your AOC.
Validation is annual, so set a reminder before the renewal date. A lapsed validation can quietly restart the fee.

What the fee actually is, and who charges it

PCI DSS is the security standard maintained by the PCI Security Standards Council, which the major card brands founded. Every business that accepts cards agrees to follow it through its merchant agreement. Most small and mid-sized merchants prove compliance once a year by completing a Self-Assessment Questionnaire (SAQ) and signing an Attestation of Compliance (AOC). Some setups also require quarterly external vulnerability scans by an Approved Scanning Vendor (ASV).

Your processor has to answer to its sponsoring bank for which of its merchants have validated. When its records show you haven't, it adds a line to your statement. The usual reasons are that you never started, your annual validation lapsed, or a required scan failed or wasn't run. The line may read 'PCI Non-Compliance,' 'PCI Non-Validation,' 'Non-Receipt of PCI Validation,' or something similar, and it typically repeats every month until the portal shows you as validated.

You'll find it among the processor fees or 'other fees,' not with interchange or assessments. That placement matters. Interchange goes to the card-issuing bank and assessments go to the card brands, and the networks set both. The non-compliance fee is set by your processor, so its amount and terms come from your contract, not from the card brands.

The part most articles get wrong

Many explanations describe this fee as a card brand fine or a penalty for weak security. Both descriptions are misleading. The card brands can fine acquiring banks, mainly after a data breach, and those amounts may be passed down to you under your merchant agreement. That is a separate event. The monthly non-compliance fee is a processor charge triggered by missing validation records.

This means a business with tight security can pay the fee every month simply because nobody clicked submit in the portal. A business that has never thought about security stops paying it the day a questionnaire is filed. The fee measures paperwork, not risk. So the fix is rarely buying security software. For a simple setup, it is often a single sitting in your processor's portal, plus a scan if your setup requires one.

The reverse is also true: filing the SAQ does not make you secure. Answering 'yes' to controls you don't actually have creates a signed record you'll have to stand behind if a breach happens. Answer honestly. If an answer is 'no,' fix the gap or ask your processor what remediation it accepts.

There is often a second, related line: a 'PCI compliance' or 'PCI program' fee, charged monthly or annually whether or not you've validated. Some merchants pay both at once. The program fee usually covers portal access and sometimes scanning or breach coverage. The non-compliance fee is the extra charge for not finishing the process.

What it is really costing you: worked examples

Because the fee is a flat dollar amount, it hits smaller merchants hardest when you measure it against volume. The examples below are made up and assume a fee of $39.95 per month. The amount in your contract may be different.

Example A is a boutique processing $18,000 a month. The fee works out to $39.95 ÷ $18,000 = about 0.22% added to its effective rate, or $479.40 over a year. If the boutique's other fees put it at an assumed 2.55% before this line, it is really paying about 2.77%.

Example B is a food truck processing $4,000 a month. Here the fee is $39.95 ÷ $4,000 = roughly 1.00% of volume. That single line adds a full percentage point on top of interchange, assessments, and markup. The annual cost is the same $479.40, but on far less revenue.

Example C is a dental office whose validation lapsed. It validated two years ago, then missed the annual renewal date. If the fee ran for 14 months before anyone noticed, the office paid $559.30 (14 × $39.95), plus any PCI program fee it was also being charged. Ask for a credit, but don't count on one, because refunds are at the processor's discretion.

Estimates are based on published industry averages and are not a quote. Actual rates depend on card mix, ticket size, industry, and underwriting.

Run your own numbers

Tick the fees on your processing statement and see your real effective rate and which charges deserve a question.

Open the free Hidden Fee Finder: Merchant Statement Checker Book a 15-minute call

How to make the fee stop

Step 1: Find your processor's PCI portal. The login is usually in your welcome email or printed on the statement. If you can't find it, call support and ask who administers your PCI program and how to get portal access for your merchant ID.

Step 2: Pick the right SAQ. The correct type depends on how card data moves through your business, not on your size, so confirm your choice with your processor. Common matches: SAQ A often fits an online checkout fully hosted by your payment provider. SAQ A-EP may fit a site that controls the page where payment fields load. SAQ B often fits standalone dial-up or cellular terminals, and SAQ B-IP fits standalone IP-connected terminals. SAQ C-VT fits keying cards into a web-based virtual terminal on an isolated computer. SAQ P2PE fits a validated point-to-point encryption solution. If you store card numbers yourself, you are typically pushed toward SAQ D, the longest questionnaire.

Step 3: Run the scan if your SAQ requires one. Setups with internet-facing systems in scope, such as A-EP, B-IP, C, and D, generally require passing quarterly ASV scans. A failed or missing scan can keep the fee on even after the questionnaire is complete.

Step 4: Submit, save the AOC, and check the next statement. Keep a PDF of your signed Attestation of Compliance. If the fee appears on the first full statement after your submission date, call with that date and ask for a reversal. Then set a calendar reminder a month before your anniversary date, since validation is annual and quarterly scans have their own due dates.

Check what else is hiding next to it

A PCI non-compliance fee is rarely the only flat charge on a statement that nobody has questioned. Statements also commonly carry: - annual fees - statement fees - monthly minimums - batch fees - per-item authorization fees - 'regulatory' or 'network' lines that are processor markup with a network-sounding name Holds and reserves don't appear as fees, but they reduce what lands in your bank account. Compare your deposits against gross sales, too.

Our free Hidden Fee Finder: Merchant Statement Checker (https://touchsuite.com/tools/hidden-fee-finder) lets you tick the fees you see on your statement and enter your monthly volume and total fees. It then shows your real effective rate and flags which charges deserve a question. The rate and flags appear on screen right away. If you want the full line-by-line breakdown with suggested wording for your processor, you can request it through a short form.

Use the tool with your actual statement in front of you. Pull out the PCI non-compliance line, the PCI program fee if there is one, and every other flat monthly fee, then divide the total by your volume. That figure shows how much of your cost is fixed overhead rather than the percentage rate everyone quotes.

What to ask your processor

Whether you call before or after you validate, a short conversation clears up most of this. Ask: - When did my validation lapse, and what is missing: the questionnaire, the scan, or both? - What is the exact fee amount, and where does it appear in my agreement? - Will you credit fees charged while I was unaware of the issue? - What does my PCI program fee include: scanning, support, or breach coverage? - Will changing my terminals or my checkout change my SAQ type?

If the answers are vague, or the fee continues after you've validated, note that when you next review your processor. If you'd like a second set of eyes on your full statement, talk to a payments specialist at https://touchsuite.com/contact. We'll walk through each line with you. We won't quote a specific rate until we've seen your volume, card mix, and industry.

Frequently asked questions

Is the PCI non-compliance fee a fine from Visa or Mastercard?

No. It is a fee your processor charges under your merchant agreement when it has no record of your PCI validation. The card brands can fine acquiring banks, mainly after breaches, and those fines may be passed to merchants, but that is separate from this monthly line.

Why am I paying both a PCI compliance fee and a PCI non-compliance fee?

Many processors charge a PCI program fee to every merchant for portal access and related services. They then add the non-compliance fee on top until you finish validation. Completing validation usually removes the second fee but not the first.

Can I get past PCI non-compliance fees refunded?

You can ask, and it's worth doing, especially if you were never told how to validate. Credits are at your processor's discretion, so have your submission date and AOC ready when you call.

If I use a hosted online checkout, am I automatically PCI compliant?

A hosted checkout can greatly reduce what you're responsible for and often qualifies you for the shortest questionnaire. You still have to submit that validation each year, or the fee can still appear.

Does paying the non-compliance fee protect me if there's a data breach?

No. Paying the fee doesn't count as compliance and doesn't provide breach coverage. Ask your processor whether its PCI program fee includes any breach coverage and what conditions apply.

How we put this together

The mechanics in this guide reflect how PCI validation generally works under the PCI Security Standards Council's published framework: SAQ types, Attestations of Compliance, and ASV scanning for in-scope internet-facing systems. They also reflect the standard split between interchange (set by the card brands and paid to issuers), card brand assessments, and processor-set fees. The $39.95 monthly fee, the 2.55% starting effective rate, and the merchant volumes are assumptions chosen for illustration, not reported averages or TouchSuite pricing. On your own statement and contract, verify the exact name and amount of the PCI fee, whether you also pay a PCI program fee, your validation due date, and which SAQ your processor has assigned you. SAQ eligibility and scan requirements change as the standard is revised (PCI DSS v4.x is current as of this writing), so confirm current requirements in your processor's portal. Estimates are based on published industry averages and are not a quote. Actual rates depend on card mix, ticket size, industry, and underwriting.