PCI Compliance for Small Merchants: SAQs, Fees and Scope

Key takeaways

PCI cost formulas

Fee names vary: you may see PCI program, compliance, non-validation or non-compliance fees. Check your statement and merchant agreement for the exact labels and amounts.

Worked example (illustrative numbers)

A retailer with two stores and an online shop has three merchant accounts and hasn't completed its SAQs. All numbers are illustrative only, not quoted fees.

• Monthly non-compliance fee on each account: $29.95
• Annual non-compliance cost = $29.95 × 12 × 3 = $1,078.20
• Annual PCI program fee on each account: $99; total = $99 × 3 = $297
• Total annual PCI-related fees before compliance = $1,078.20 + $297 = $1,375.20
• After completing SAQs, non-compliance fees stop: monthly fees avoided = $29.95 × 3 = $89.85
• Moving the online shop to hosted checkout costs an illustrative $300 in setup time
• Payback = $300 ÷ $89.85 ≈ 3.3 months

Illustrative numbers only. Your costs depend on your provider, card mix and how you accept payments.

What PCI DSS is

The Payment Card Industry Data Security Standard (PCI DSS) is a set of security requirements maintained by the PCI Security Standards Council, an organization founded by the major card brands. It covers how card data is protected: secure networks, protecting stored data, access control, monitoring, testing and written security policies.

The council writes the standard, but it does not enforce it. Each card brand sets its own compliance program, and your processor or acquiring bank decides what you must submit and when. That is why the answer to "what do I need to do?" should come from your processor and the card brands' current rules, not from a general article. PCI DSS is a security standard, not a law; separate state data-breach and privacy laws may also apply, so talk to your attorney about those.

Source: PCI Security Standards Council: Standards

Merchant levels at a high level

Card brands group merchants into levels, generally by annual transaction count. Most small businesses fall into the lowest level, which usually means an annual self-assessment rather than an on-site audit by an outside assessor. Some processors also require periodic external vulnerability scans for merchants with internet-facing payment systems. Level thresholds and validation rules are set by each card brand and can change, so confirm your level with your processor.

Source: Visa: Regulations and fees for small businesses

Self-assessment questionnaires (SAQs), explained simply

The PCI Security Standards Council publishes several SAQ types. Which one fits depends on how card data moves through your business. At a high level:

• SAQ A: card-not-present merchants that fully outsource payment pages to a validated third party, so card data never touches their systems.
• SAQ A-EP: e-commerce merchants whose website affects the payment page but doesn't receive card data directly.
• SAQ B and B-IP: merchants using standalone dial-up or IP-connected terminals not connected to other systems.
• SAQ C-VT: merchants that key transactions one at a time into a provider's web-based virtual terminal.
• SAQ C: merchants with payment applications connected to the internet, such as some POS setups.
• SAQ P2PE: merchants using a validated point-to-point encryption solution.
• SAQ D: everyone else, including businesses that store card data electronically. It is the longest.

Source: PCI SSC: Document library (Self-Assessment Questionnaires)

PCI and non-compliance fees on your statement

Many providers charge an annual or monthly PCI program fee for access to their compliance portal and scanning tools. Separately, if you don't complete your SAQ or required scans by the deadline, many add a monthly non-compliance or non-validation fee until you do. These fees are set by your provider, not by the PCI council, and the amounts vary.

Look for these lines on your merchant statement. If you see a non-compliance fee, ask your provider what is missing, complete it and ask when the fee will stop. If a fee is unclear, ask for an explanation in writing.

How to reduce PCI scope with hosted checkout

Scope is every system, person and process that touches card data. Shrinking it lowers your risk and usually shortens your SAQ:

• Use a hosted payment page or payment link so customers type card numbers on the provider's page, not yours
• Use tokenization for card-on-file billing instead of storing card numbers
• Use validated encrypting terminals, and keep them off networks that run other office systems
• Never write down, email or text card numbers; stop taking card numbers by email entirely
• Remove old spreadsheets, paper forms or files that contain card data
• Limit who can access payment systems and use unique logins

What to ask your processor

• Which merchant level am I, and which SAQ type do you expect from me?
• Do I need quarterly external vulnerability scans?
• What PCI and non-compliance fees apply, in dollars, and when do they start and stop?
• Does my POS, gateway or terminal reduce my scope, and is it validated?
• What support do you provide to complete the SAQ?
• What happens to my account and fees if there is a data breach?

Common mistakes

• Assuming a small business is exempt from PCI DSS
• Picking the shortest SAQ without checking it matches how you actually take cards
• Paying non-compliance fees for months without asking what is missing
• Taking card numbers by email, phone notes or paper forms
• Treating PCI compliance as a one-time task instead of an annual cycle
• Treating PCI DSS as the only rule: state breach and privacy laws may also apply, so talk to your attorney

Official sources to check

Rules change. Check current rules at the source and talk to your advisor before you act.

• PCI Security Standards Council: Standards
• PCI SSC: Document library (Self-Assessment Questionnaires)
• PCI SSC: Resources for small merchants
• Visa: Regulations and fees for small businesses
• FTC: Cybersecurity for small business

Common questions