What Is a PCI Non-Compliance Fee?

What are PCI DSS and the SAQ?

PCI DSS is the PCI Data Security Standard. The PCI Security Standards Council describes it as a baseline of technical and operational requirements designed to protect payment account data, and says it is intended for all entities involved in payment processing, including merchants, regardless of their size or transaction volume. A self-assessment questionnaire, or SAQ, is how many small merchants report that they meet it: the Council describes SAQs as validation tools for eligible merchants and service providers to perform and report the results of their PCI DSS self-assessments, with several versions for different payment set-ups. The fee on your statement is tied to this validation step. It is charged when your provider has no record that you completed it.

Who charges a PCI non-compliance fee?

The PCI Security Standards Council manages PCI DSS, but its At a Glance document on the Council's role says enforcement of compliance and any non-compliance penalties are carried out by the individual payment brands, not by the Council, and that the Council has no information about penalties or fines. The brands, in turn, place the job on the acquirer. Visa's Core Rules (18 April 2026) require an acquirer to ensure that merchants with access to account or transaction information comply with PCI DSS, and to make sure its merchant agreements set out merchants' responsibilities and the liabilities for failing to meet Visa's standards. Visa's own non-compliance assessments are charged to its members, such as acquirers. The line on your statement is a different thing: a fee your provider chose to put in your agreement.

Why do processors charge a PCI non-compliance fee?

Because the acquirer answers to the card brands for its merchants' PCI status, a merchant with no validation on file is an open item on its books. Some providers attach a fee to that open item, both to cover their own compliance work and to give merchants a reason to submit their paperwork. Whether the fee exists on your account, what it is called and how much it is are all set by your provider, so there is no network rate to look up and no typical figure we can source. Check your own fee schedule.

How do I find a PCI non-compliance fee on my statement?

Look in the account fees or other fees section of your statement, not among the per-transaction charges. Labels vary by provider. Wording to look for includes PCI non-compliance, PCI non-validation, non-receipt of PCI validation, or PCI compliance penalty. If a line names PCI and you are not sure what it pays for, find the same name in your fee schedule and read what triggers it and what stops it. Check three recent statements so you can see the month it started.

How do I stop paying a PCI non-compliance fee?

First, ask your provider in writing which SAQ it expects from you and where to submit it. PCI SSC FAQ 1133 says there are several questionnaires for different set-ups, depending on how a business stores, processes or transmits cardholder data, and that merchants should ask their acquirer or the payment brands which one applies. Second, ask whether your SAQ needs external vulnerability scans. PCI SSC says an Approved Scanning Vendor (ASV) runs the external scans used to validate PCI DSS Requirement 11.3.2, and it keeps the list of approved vendors. Third, submit the SAQ and any passing scan reports, and keep the confirmation. Fourth, check your next statement. If the fee is still there, send the confirmation back and ask for the fee to be removed and for any charges after your submission date to be credited. Whether earlier months are refunded is your provider's decision, so ask, but do not count on it. Repeat on the schedule your provider sets.

Next steps: Send us a statement for a free analysis · Read our PCI compliance basics guide · Find out which SAQ applies to you

Is it the same as a PCI compliance fee or an annual fee?

A PCI non-compliance fee is triggered by missing validation and should end when you validate. A PCI compliance fee or PCI program fee is a different line in some agreements: it is charged whether or not you validate, and some providers say it pays for a compliance portal or tools. An annual fee is a general account fee that may have nothing to do with PCI. You may see one, two or all three on the same account. Paying any of them does not make you PCI compliant; only completing the validation your provider requires does that. Our hidden processing fees checklist covers the other account fees worth questioning.

How can CELER Merchants help you spot it?

CELER Merchants is an independent merchant services agent, not a processor or a bank. When you send us a statement for a free analysis, we label every fee line, including PCI-related ones, and tell you which lines look like non-compliance charges and which look like program or annual fees. If a non-compliance fee is on your statement, we can walk you through the questions to ask your provider to have it removed. If you also want to compare offers, we show you what other providers would charge, side by side. This is general information, not legal advice (October 17, 2026).