What is a PCI non-compliance fee?
It’s a monthly charge some card machine providers add when they have no record that your business has done its yearly card security check. Do the check, make sure your provider has it, and the charge should stop.
What PCI means
PCI DSS stands for Payment Card Industry Data Security Standard. It’s a set of security rules for keeping card details safe, and every business that takes cards is expected to follow it. That includes a small shop with one card machine.
The rules are written by the PCI Security Standards Council, a body the card industry set up. The council doesn’t check individual businesses. Your provider does the checking, and the fee comes from your provider.
How a small business shows it follows the rules
For a small business, the check is a yearly self-assessment questionnaire, shortened to SAQ. It asks how you take payments and how you keep card details safe.
There are different versions of the questionnaire for different set-ups. A card machine on its own is the simplest case. Taking payments online or over the phone adds more. Some set-ups also need a regular security scan. Your provider can tell you which version is yours.
Your provider may run the questionnaire through its own website, or through a partner company that does it for them.
Why you’re being charged
The fee means your provider has no up-to-date record that you’ve done the check. That can happen when:
- the account is new and the first questionnaire is due
- the reminder went to an old email address
- the questionnaire was started but never submitted
- last year’s ran out and wasn’t renewed
Providers don’t all use the same name for it. Look for “PCI non-compliance fee”, “non-compliance charge” or “non-validation fee”.
Two different lines can say PCI
Some statements show a PCI compliance fee, sometimes called a PCI management, programme or service fee. That pays for the provider’s PCI service, such as the online questionnaire, and it can be part of the deal.
A PCI non-compliance fee is different. It’s charged because the check hasn’t been done, or hasn’t reached your provider. That’s the one that should stop.
How to make it stop
- Find your provider’s PCI website. The details may be in your welcome email or pack. If not, ask your provider for them.
- Fill in the questionnaire. Answer for how you really take payments. If a question isn’t clear, ask your provider to explain it.
- Submit it, and keep the confirmation.
- Check your next statement. If the fee is still there, ask your provider why.
Once your provider has the completed check, the fee should stop from then on. Months charged before you did it may not be refunded.
Worth doing anyway
The fee is a nudge. The rules behind it exist to keep your customers’ card details safe, and that matters more than the fee.
For the rest of the statement, see how to read your card machine statement.