What Is PCI DSS Compliance? A Plain-English Merchant Guide

On this page 7 sections

1. What Is PCI Compliance? PCI DSS and Who Enforces It
2. The Four PCI Compliance Levels for Merchants
3. Which PCI SAQ (Self-Assessment Questionnaire) You Need
4. How to Stop PCI Non-Compliance Fees on Your Statement
5. Example: A Small Shop Completing Its First SAQ
6. PCI DSS Updates: What to Ask Your Provider
7. Next Steps

Key takeaways

• PCI DSS is a card industry security standard that card brands enforce through your processor, not a government agency.
• Most small merchants fall into the lowest compliance level and validate each year with a self-assessment questionnaire (SAQ).
• Your SAQ type depends on how card data moves through your business, so start by mapping every way you take cards.
• A monthly PCI non-compliance fee usually means your validation is missing or expired, and completing your SAQ is the normal fix.

What is PCI compliance? It means your business follows the Payment Card Industry Data Security Standard (PCI DSS). PCI DSS is the set of security rules for any business that accepts, processes, stores or transmits card data. That includes a two-register boutique, an online store, a busy restaurant and a dental office that keeps cards on file. This guide covers who enforces the standard and how compliance levels work. It also shows how to find the self-assessment questionnaire (SAQ) that fits your setup and how to deal with a non-compliance fee on your monthly statement.

This article is general information, not legal or security advice. Requirements, thresholds and forms change. Confirm current details with your payment provider, the PCI Security Standards Council and a qualified security professional.

What Is PCI Compliance? PCI DSS and Who Enforces It

PCI DSS is written and maintained by the PCI Security Standards Council, an industry body created by the major payment card brands. The Council sets the standard but does not enforce it.

Enforcement runs through contracts:

• Card brands require the banks that sponsor merchants (acquirers) to keep those merchants compliant.
• Acquirers and processors pass that obligation to you through your merchant agreement.
• You validate compliance each year, usually through an online portal your provider gives you.

PCI DSS is not a federal law. Your merchant agreement almost certainly requires it, though. Falling out of compliance can lead to fees. After a data breach, it can also lead to assessments, forensic investigation costs and liability for fraud losses.

Some states also have their own data security and breach notification laws, and a few reference PCI DSS directly. Check the rules where you operate. For an example of state-specific card rules, see our guide to Florida credit card surcharge law.

Medical and dental practices have to deal with both PCI DSS and HIPAA, which are separate frameworks. HIPAA covers patient health information. PCI covers card data. Meeting one does not satisfy the other.

The Four PCI Compliance Levels for Merchants

Card brands group merchants into PCI compliance levels, generally numbered 1 through 4. Your level depends mostly on your annual card transaction volume. Each brand sets its own thresholds, and your acquirer tells you which level applies to you. Get current thresholds from your provider, not from figures you find online.

In general terms:

• Level 1 covers the largest merchants by volume. A card brand can also move a merchant into this level after a breach. Validation typically involves a formal annual assessment by an independent, qualified security assessor.
• Levels 2 and 3 cover large and mid-sized merchants. Depending on brand and acquirer rules, validation may be a self-assessment or a more formal review.
• Level 4 covers most small businesses. Validation is usually an annual SAQ, plus quarterly external vulnerability scans if your setup requires them.

If you run a single retail store, a neighborhood restaurant or a small medical practice, you are most likely in the lowest level. A card brand or your acquirer can still ask for more than the minimum, especially after a security incident.

Which PCI SAQ (Self-Assessment Questionnaire) You Need

A PCI SAQ is a checklist you complete, followed by a signed attestation that your answers are accurate. The Council publishes several SAQ versions. Each is labeled with letters and fits a particular payment setup.

Choosing the right one matters:

• Too simple: Your validation may not hold up if something goes wrong.
• Too complex: You end up answering hundreds of questions that don't apply to you.

Start by mapping how card data enters your business across every channel: in-person, online and keyed. The table below shows how common setups generally line up with questionnaire scope. Your provider's portal, or the Council's own guidance on choosing an SAQ, will confirm the exact form.

Each SAQ opens with eligibility criteria. Read them carefully. If you don't meet every criterion, that SAQ doesn't apply to you.

Channel Tips for Common Industries

• Retail stores: A countertop terminal that sends encrypted data straight to the processor usually keeps your scope small. If your POS system connects to inventory or loyalty software, ask how card data moves between those systems.
• E-commerce stores: How your checkout is built matters most. A hosted or redirect checkout usually keeps you in a simpler questionnaire than a payment form you built yourself. Your payment gateway provider can tell you which integration method you use.
• Restaurants and bars: Pay-at-the-table handhelds keep the card in the guest's view, which helps both security and scope. Keep card numbers off order tickets and tab sheets.
• Medical and dental offices: Scope tends to grow with card-on-file payment plans and phone payments. Never write card numbers on intake forms or in patient notes. Use tokenized card-on-file tools that keep the actual card number with your processor.

How a card enters your system affects both your risk and your cost. Our guide to card-present vs. card-not-present transactions explains how.

How to Stop PCI Non-Compliance Fees on Your Statement

Many processors charge a monthly PCI non-compliance fee to merchants who haven't validated. Some also charge a separate annual PCI program fee. Names, amounts and policies vary by provider, so check your merchant agreement for the details.

On your statement, the charge may be labeled "PCI non-compliance," "non-validation fee" or something similar. It usually means one of three things:

1. You never completed your SAQ.
2. Your SAQ expired. Validation is generally annual.
3. You completed the SAQ, but a required step is missing, such as a vulnerability scan or the signed attestation.

To resolve it:

1. Find your PCI portal. Your provider usually sends login details. If you can't find them, ask support to resend them.
2. Map your payment channels using the table above.
3. Answer the SAQ honestly. Checking "yes" for steps you haven't taken defeats the purpose and can create liability if you are breached.
4. Fix the gaps. Common fixes include changing default passwords, updating terminal software and writing a basic security policy.
5. Run any required scans. Some SAQs require external vulnerability scans by an approved scanning vendor. Your questionnaire will say whether this applies to you.
6. Sign and submit the attestation, and keep a copy.
7. Check your next statement. If the fee is still there, ask your provider when your validation takes effect and whether any charges can be reviewed.

Before you sign with a provider, ask how PCI fees and validation support work. That question is on our list of how to choose a merchant service provider.

Example: A Small Shop Completing Its First SAQ

This is an illustrative scenario, not a real customer.

A gift shop with two registers and a small online store spots a non-compliance line item on its statement. The owner logs into the processor's PCI portal and maps each channel:

• In-store: Two standalone chip terminals connect to the processor over the shop's internet and don't link to any other system. The portal points to a short, terminal-focused questionnaire.
• Online: The store's platform uses a hosted checkout, so card data never touches the shop's website. That points to the simplest e-commerce questionnaire.
• Phone orders: Staff had been writing card numbers on sticky notes and keying them in later. This is a real gap.

Acquirers handle multiple channels differently, so the owner asks the provider whether to submit one questionnaire or one per channel. Then the owner makes these fixes:

• Shreds the old notes and has staff enter phone orders directly while the customer is still on the line.
• Changes the Wi-Fi router's default admin password and moves the terminals to a network separate from guest Wi-Fi.
• Writes a one-page policy covering who can use the terminals and how to report suspicious activity.
• Trains staff to verify anyone who claims to be a "terminal technician." Our piece on social engineering lessons for merchants explains why that matters.

After signing the attestation, the owner sets a calendar reminder for next year's renewal and checks the following statement to confirm the fee is gone.

PCI DSS Updates: What to Ask Your Provider

The Council revises PCI DSS from time to time. You don't need to track every revision yourself. Your provider's portal should present the questionnaire version currently in effect.

When you renew, ask your provider:

• Which version of the standard and SAQ your validation uses.
• Whether any requirements changed for your setup since last year.
• Whether eligibility for your SAQ type has changed, especially if you sell online. Checkout pages draw particular attention because attackers target them with skimming code.

Whatever the version, these practices help you stay secure.

To reduce your PCI scope:

• Keep card data out of your environment with tokenization and validated point-to-point encryption.
• Don't store full card numbers on paper, in spreadsheets or in notes fields.

To lower your overall risk:

• Reduce fraud with EMV chip terminals in person and authentication such as 3D Secure for online card payments.
• Use strong, unique passwords and turn on multi-factor authentication wherever your systems support it.
• Keep terminals, POS software and website plugins up to date.
• Train staff to recognize phishing and impersonation attempts.

For background on chip security, see what EMV is and how the liability shift works.

Next Steps

PCI compliance is manageable once you know your level, your SAQ type and your renewal date. This week:

• Find your PCI portal login.
• List every way you take cards.
• Check your last statement for a non-compliance line item.

If you are also reviewing your equipment or payment setup, MannyPay offers POS systems, terminals, virtual terminals and online gateways for both low- and high-risk businesses. You can request a free quote from MannyPay, and a specialist will respond within one business day.

ME

About the author

MannyPay Editorial Team

Beyond the Swipe's editorial desk researches the publication's guides and news and cites its sources in every article. Articles reviewed by a named MannyPay editor carry that editor's byline.

This article is for general educational purposes and is not legal, tax or financial advice. Card network rules and state laws change; confirm current requirements for your business.