PCI compliance fees and PCI non-compliance fees: who sets them and how to compare them in an offer

Who writes the standard, who enforces it, who charges the fee

Three different parties are involved, and search results often blur them. The PCI Security Standards Council writes and maintains PCI DSS, the security standard for businesses that store, process or transmit card data. On its own website the Council answers the question of enforcement directly: it does not enforce compliance and does not monitor how its standards are put in place. Whether a business has to comply, and how it proves it, is decided by the organisations that run compliance programmes, such as a payment brand or an acquirer.

The card networks then put the duty on their members. Visa’s rules, in the edition of 24 October 2026, require a member to make sure its merchants comply with PCI DSS and to write the merchant’s responsibilities, and the liabilities for failing to meet Visa’s standards, into its merchant agreements. The acquirer must also report its merchants’ compliance status to Visa at least every six months.

The fee you see on a statement comes from the third party: your provider. Visa’s non-compliance assessments under its Account Information Security Program are addressed to members, and the edition sets no merchant fee for PCI compliance or non-compliance. Any monthly or annual PCI charge, and any charge for not validating, is the provider’s own term in its agreement with you.

Why this matters more in high-risk processing

PCI status is not only a line on a statement. Mastercard’s MATCH Pro specification, version 3.0.17, lists “PCI Data Security Standard Noncompliance” as reason code 12, one of the reasons an acquirer may record when it ends a merchant relationship. The same specification provides termination inquiries, through which acquirers search that database for a merchant, so a listing can surface when the business applies elsewhere.

Visa’s rules also tie data security to the acquirer’s own exposure: if Visa finds that a member, its agent or a merchant was deficient or negligent in protecting account or transaction information, it may impose a non-compliance assessment on the member or require immediate corrective action (section 12.5.1.2). A provider that carries that exposure for higher-risk merchants has a reason to watch PCI status closely and to write firm terms about it.

How to compare PCI terms between offers

• Is there a PCI compliance fee at all, and is it monthly, annual or both?
• Is there a separate non-compliance fee, and exactly what triggers it: a missing validation document, a missed deadline, or a failed scan?
• When does the non-compliance fee stop, and is any of it refunded once you validate?
• What validation does the provider ask for from a business of your size and set-up, and how often?
• Does the provider offer its own validation tool or scanning service, is it required or optional, and is its price inside the PCI fee or on top of it?
• If you use a hosted payment page or a gateway that handles the card data, does the provider treat that as reducing what you must validate, and does the fee change?
• Can the fee change during the contract, and how much notice is given?

Put the answers next to each other the way you would the processing rate. A low rate with a high non-compliance fee that starts after a short grace period can cost more over a year than a slightly higher rate with no PCI charges. The bank examiners’ handbook on merchant processing says a bank’s merchant agreement should disclose all fees, so each of these points should be answerable from the agreement itself.

On Zolution, every proposal states its fees, reserve, settlement delay, payout schedule and conditions in the same fields, and a provider can state a PCI fee in its additional fees, so you can set offers side by side. Zolution is a free marketplace (Zolution Standard membership costs nothing); it processes no payments, holds no funds and approves nobody.

Questions, answered