PCI Compliance and Non-Compliance Fees Explained
Identify the PCI-related charge on your merchant statement, check your validation status and ask the right questions about stopping avoidable fees.
The short answer
A PCI programme fee and a non-compliance fee are different charges. One may pay for a provider’s support service; the other may arise when its required validation is missing or out of date. Paying either charge does not itself make your business compliant. Confirm the reason, required actions and billing consequences with your acquirer.
In this guide
Identify which charge you are paying
| Statement description | What to establish |
|---|---|
| PCI programme or management fee | What service is supplied, whether it is optional and whether it continues after validation. |
| PCI non-compliance or non-validation fee | What requirement is recorded as outstanding and when the charge can stop. |
| Security assessment or scanning charge | What work it covers, who supplies it and whether it is needed for your payment environment. |
The PCI Security Standards Council sets security standards; it does not run merchant compliance enforcement or impose non-compliance consequences. Payment brands and acquirers have their own arrangements. takepayments notes that an acquirer may apply monthly non-compliance charges.
Confirm the right validation route
PCI SSC advises merchants to ask their acquirer or payment brand about validation and reporting requirements. The appropriate self-assessment questionnaire depends on the payment environment and its eligibility conditions. Do not choose a shorter questionnaire simply because another business uses it.
- List every way you accept payments, including online checkout, telephone payments and terminals.
- Ask which questionnaire or assessment applies and whether scans or other evidence are required.
- Check which merchant accounts and locations the validation covers.
- Record the next review date and who will handle any change in your setup.
A provider’s secure equipment does not, by itself, establish that every part of your business is compliant. Address the actual security and reporting requirements, rather than treating the task as only a billing dispute.
Worked example: separating two recurring fees
Fictional statement. A business pays an £8 monthly PCI programme charge and a £25 monthly non-validation charge: £33 monthly or £396 annually.
Assume its provider confirms that accepted validation stops only the £25 charge from the next billing period. The ongoing bill becomes £8 monthly or £96 annually, a £300 annual reduction. This does not establish a right to recover earlier charges or remove the programme subscription.
If £100 of one-off external help is required, the first-year net cost reduction would be £200 on these assumptions. Completing security obligations still matters even where the direct fee saving is smaller.
A practical request to resolve the charge
Please identify the PCI-related charges on our account and explain which are programme fees and which relate to outstanding validation. Please confirm our recorded status, required actions, accepted evidence and the date any non-compliance charge will stop once the requirements are met. If our evidence is already valid, please review the charges and provide the outcome in writing.
Use the provider’s official route for security documentation. Ask for acknowledgement when evidence is accepted, retain the record and check the next bill. Do not assume that submitting a form and having it accepted are the same event.
Include the correct saving in a comparison
If you can remove a charge with your current provider, use that improved current position when assessing a switch. Otherwise the new provider may appear to save money that could also be saved by resolving the current account.
Enter the recurring charges you will actually pay and any confirmed one-off help in your cost budget. Keep reminders for revalidation and changes in how you take payments. Our additional charges guide helps check the rest of the bill.
Budget for the work, not only the PCI line on the bill
Ask the organisation requiring validation to confirm the applicable route for your payment environment. A questionnaire, vulnerability scanning or specialist assessment may involve different work and charges; they are not all automatically required of every merchant.
PCI SSC describes SAQs as validation tools for eligible environments and directs merchants to their acquirer or payment brand for validation requirements. Establish the required scope before accepting a generic compliance package.
Record the supplier service charge, any external assessment or scanning cost and internal administration separately. Confirm the actual contractual consequence of missing validation rather than treating a provider charge as a universal statutory fine. Address the security requirement even when a fee is waived.
Keep this work in the full ownership budget, with appropriate staff procedures and training.
Common questions
Does paying a PCI fee make me compliant?
No. A payment to a provider is not evidence that the relevant security requirements and validation steps have been met. Confirm your actual status with the organisation requiring validation.
Can every PCI charge be removed?
No. A programme or support charge may continue under your agreement. Ask what each fee covers and what conditions, if any, allow its removal.
Put your own figures to work.
Use the free calculator to organise your costs and keep a report. If something is unclear, you can ask for a free initial review.
No registration required. Calculator entries stay in your open browser page unless you choose to share a report in a review request.
Sources and how to use this guide
Primary references checked on 15 October 2026:
- PCI Security Standards Council: merchant resources and validation
- PCI SSC: who manages non-compliance consequences
- takepayments: PCI compliance and possible acquirer charges
Worked examples are original fictional scenarios, not customer results, market averages or provider quotations. Unless stated otherwise, they use a consistent VAT basis and include only the costs listed. Provider prices, eligibility and terms can change. Check your written agreement before deciding.
Our guides explain costs and comparison methods. They do not rank the whole market or claim hands-on product testing. Source links are references, not a claim of partnership. Read the calculation method and limitations, or about the service.