Compliance Assessment ToolThe PCI non-compliance fee on your statement: what it is and how to stop it
If your merchant statement shows a charge like "PCI non-compliance", "PCI non-validation" or "non-compliance fee", your payment processor hasn't received proof that your business completed its yearly card-security check. It usually keeps appearing every month until you do — and the fix is usually quicker than you'd think.
Step one is free
Describe how you take card payments in your own words and find out which PCI form your business needs. No IT knowledge needed.
Find my form — free →Why you're being charged
The card brands require every business that accepts cards to follow a security standard called PCI DSS, and they make payment processors responsible for checking that their merchants do. Smaller businesses prove it once a year with a Self-Assessment Questionnaire (SAQ) — a set of yes-or-no questions about how you handle card payments — and a signed Attestation of Compliance (AoC). If your processor doesn't have yours on file, many charge a monthly fee until it arrives.
How to stop it
- Find out which SAQ you need. It depends on how you take cards: a card machine, a website checkout, phone orders, or a phone or tablet reader. Which PCI SAQ do I need?
- Complete it and sign the AoC.
- If your SAQ requires it, arrange quarterly external scans from an Approved Scanning Vendor (ASV). Your SAQ tells you whether it applies.
- Send the SAQ and AoC to your processor the way they ask — an upload in their portal or by email.
- Check a later statement to confirm the fee has stopped. If it hasn't, ask your processor to confirm they've recorded your validation.
How we help
Compliance Assessment Tool handles steps 1 and 2. You describe how you take payments; we ask plain-English questions until we know which SAQ fits, then walk you through it one simple question at a time — things like "Does your card machine plug into a phone line, or into your internet or Wi-Fi?" You review your answers, sign, and download the official SAQ and Attestation of Compliance to send to your processor. Finding your SAQ is free; completing it is $25. We don't provide ASV scans.
Common questions
What is a PCI non-compliance fee?
A charge your payment processor adds to your merchant statement because it has not received proof that your business completed its yearly PCI security self-assessment. It usually repeats every month until you do.
How do I stop the PCI non-compliance fee?
Complete the right PCI Self-Assessment Questionnaire (SAQ) for how you take cards, sign the Attestation of Compliance (AoC), and send both to your payment processor the way they ask. Then check that the fee is gone from a later statement.
How much is the fee?
It is set by your processor and varies. Look for the line on your statement and the PCI section of your merchant agreement.
Is a PCI compliance fee the same as a non-compliance fee?
Not always. Some processors also charge a yearly "PCI fee" or "compliance program fee" whether or not you have validated. Completing your SAQ stops the non-compliance fee; it may not remove a program fee. Your merchant agreement says which applies.
Can I just ignore it?
You would keep paying it, and if card data is ever stolen, not having validated can make the aftermath harder and more expensive. Completing the SAQ is usually much quicker than people expect.
Will my processor accept an SAQ I complete somewhere else?
Many processors accept the official PCI SSC SAQ and Attestation of Compliance as a PDF upload or email; some require you to use their own portal. Ask yours how they want to receive it.
Do I have to do this every year?
Yes. PCI validation is annual, and some SAQs also require quarterly external scans by an Approved Scanning Vendor. Your SAQ says whether yours does.
This page is general information, not legal advice. Your merchant agreement and your payment processor determine the fees you are charged and how you must validate. Compliance Assessment Tool helps you complete a PCI DSS self-assessment; we are not a Qualified Security Assessor (QSA) and do not certify compliance.