Somewhere on your processing statement there is a line item you have probably never questioned. It is small enough to ignore and vague enough to skip — and it can drain hundreds a year from the business. The PCI line item comes in two flavors, and confusing them costs money: the compliance fee (a legitimate annual program charge) and the non-compliance fee (a monthly penalty for not completing your annual Self-Assessment Questionnaire).
Two different fees, one confusing line item
| PCI compliance fee | PCI non-compliance fee | |
|---|---|---|
| What it is | A program fee covering compliance support, scans, and reporting | A penalty for not completing the annual SAQ |
| Typical range | $79–$120 per year ($8–$10/month) | $19.95–$49.95 per month ($239–$600/year) |
| Goes away if… | You negotiate it or switch to a processor that bundles it | You complete the SAQ |
What the compliance fee actually covers
The compliance program fee funds the infrastructure that keeps a small merchant compliant without building it in-house: the self-assessment questionnaire platform, periodic vulnerability scans, reporting, and in some programs data-breach insurance. A reasonable annual program costs $70 to $120 a year. If you are paying $100 a month for "PCI compliance," ask exactly what services justify ten times the going rate.
The non-compliance penalty: the one that stings
The penalty version — often labeled "PCI Non-Compliance" or "Security Fee" — appears when the merchant hasn't completed the annual Self-Assessment Questionnaire. Typical range: $19.95 to $49.95 a month, which is up to $600 a year for skipping one questionnaire. Some processors never remind you it's due; others bury the compliance portal so deep that merchants give up. Either way, the charge keeps billing until the SAQ is done.
Who charges what
| Processor | PCI fee position |
|---|---|
| Square | $0 — included in service |
| PayPal | $8–$10/month ($96–$120/year) |
| Moneris (preferred plan) | $0.00/month PCI fee on the listed rate sheet |
| Typical third-party processor | $79–$120/year program fee; $19.95–$49.95/month non-compliance penalty |
The annual picture: a compliant merchant on a typical program pays $79–$120 a year. The same merchant skipping the SAQ pays the program fee plus $239–$600 a year in penalties. Completing one questionnaire eliminates the penalty entirely — the best hourly rate in your back office.
Verify your SAQ status: the procedure
- Find the line item. Pull your last two processing statements and search for "PCI," "compliance," or "security fee." Note whether it bills monthly or annually and the exact label.
- Call your processor and ask three questions: "Am I currently marked PCI compliant?", "Which SAQ type applies to my setup?", and "Where is the compliance portal?" Write down the answers.
- Log in to the compliance portal. Most processors use a third-party portal (ControlScan, Trustwave, SecurityMetrics). If the rep can't point you to one, escalate — a partner invested in your account would have flagged this on day one.
- Complete the SAQ. Log in and work through the questionnaire your processor assigned — it covers how card data flows through your business. Answer honestly; your processor's support line can clarify any question you're unsure about.
- Confirm the status flip. Ask the processor to confirm your account now shows compliant, and ask which billing cycle the penalty drops off.
- Check the next statement. Verify the penalty line is gone and note the date. If it persists after confirmed compliance, dispute it in writing.
What success looks like: your processor confirms "compliant" status, the next statement shows no non-compliance line item, and the annual program fee (if any) is the only PCI line remaining. Put the SAQ renewal date in your calendar — the penalty comes back if the questionnaire lapses.
FAQ
Is the PCI compliance fee a scam?
Not inherently — it funds scans, the SAQ platform, reporting, and sometimes breach insurance. But anything far above $79–$120 a year deserves a hard question, and the non-compliance penalty version is always worth killing by completing the questionnaire.
How often do I need to complete the SAQ?
Annually. Let it lapse and the non-compliance penalty typically returns on the next billing cycle.
Can I get the compliance fee removed entirely?
Sometimes. Some processors (Square, and Moneris on certain plans) charge $0. Others bundle it into processing. Ask yours — and if they won't budge, the fee belongs on your comparison sheet at the next renewal.