What's That PCI Compliance Fee on Your Statement?
Seen a 'PCI' or 'non-compliance' charge on your merchant statement? Here is what it is, why it appears, and how to stop paying it.
A lot of UK business owners first hear about PCI compliance when a mysterious 'PCI' or 'non-compliance' charge turns up on their card machine statement. It is one of the most common — and most avoidable — fees in card processing. Here is what it actually is.
Two different charges
It helps to separate two things that both get called a 'PCI fee':
- A PCI programme / compliance management fee — a small recurring charge from your acquirer for the tools and portal that help you stay compliant.
- A non-compliance fee — a penalty added when you have NOT validated your PCI compliance. This is the one you want to eliminate.
Why the non-compliance fee appears
If you have not completed your annual Self-Assessment Questionnaire and filed it with your acquirer, you are technically non-compliant — and most acquirers apply a monthly penalty until you validate. It can range from a few pounds to £40+ a month depending on the provider. Over a year, that often costs more than becoming compliant in the first place.
How to stop paying it
The non-compliance fee disappears once you validate your compliance. That means completing the correct SAQ for your setup, passing any required scan, and filing with your acquirer. For what compliance should actually cost versus these penalties, see how much PCI compliance costs in the UK.
If you would rather not deal with portals and paperwork, a fully managed PCI service validates your compliance for you — usually within 24 hours — and stops the non-compliance charges at source. Not sure where you stand? Run a free assessment.
Related Guides
The PCI DSS Requirements UK Businesses Fail Most Often
Almost every compliance failure we see falls into the same ten areas — and eight of them are paperwork and habits rather than technology. Here is where UK merchants actually come unstuck under PCI DSS v4.x.
Read ArticlePatching and Vulnerability Scans: How Fast Is Fast Enough?
PCI DSS gives you a month to install a critical patch. Cyber Essentials gives you fourteen days. Attackers are now exploiting some vulnerabilities before a patch exists at all. Here is what you actually have to do, and a routine that fits a small business.
Read ArticleFrom Firewalls to "Network Security Controls": What PCI DSS v4 Changed
PCI DSS v4 stopped talking about firewalls and started talking about network security controls. Here is what the rename actually means, and which of Requirement 1's rules a small UK merchant genuinely has to satisfy.
Read Article