The short answer
PCI compliance means following the Payment Card Industry Data Security Standard, known as PCI DSS. The PCI Security Standards Council says it “provides a baseline of technical and operational requirements designed to protect payment account data” (PCI Security Standards Council).
If you take card payments, it applies to you. If your provider handles the card data, the Council’s guidance points mainly to a self-assessment questionnaire and some checks on that provider.
Who has to comply
The Council says PCI DSS applies to “All entities that store, process, or transmit cardholder data” (PCI SSC). The Council’s list includes retailers, processors, acquiring banks, card issuers and service providers.
What if your provider handles all the card data? The Council answers this directly. It says PCI DSS “is intended for any entity that stores, processes, or transmits cardholder data,” and that using a third party “does not remove the merchant’s responsibility to ensure account data is properly protected by the third party.” It adds: “Merchants are still required to validate PCI DSS compliance, typically through a Self-Assessment Questionnaire” (PCI SSC FAQ).
So a provider that handles the card numbers makes your job much smaller. It doesn’t make it go away.
Who sets the rules, and who checks
Two different groups are involved, and it helps to know which is which.
- The PCI Security Standards Council writes the standard. It’s led by an executive committee with representatives from American Express, Discover, JCB International, Mastercard, UnionPay and Visa (PCI SSC).
- The card brands and acquiring banks enforce it. The Council says “Compliance and enforcement of PCI Standards is the role of the payment brands and acquiring banks, not the PCI SSC.” It also says it “does not receive copies of compliance assessment reports, nor is it involved in and has no information about penalties or fines for non-compliance.”
The Council’s merchant page adds: “Whether a small merchant is required to validate compliance is determined by the individual payment brands” (PCI SSC). In practice, your provider or acquirer is the one who tells you what to do.
What a small business typically does
Here’s what the Council’s guidance points to for a business that uses a provider for its card payments:
- Ask your provider which questionnaire applies. The Council says merchants “should also consult with their acquirer (merchant bank) or payment brand” to find out whether they must submit a Self-Assessment Questionnaire, or SAQ, and which one (PCI SSC). For businesses that outsource all card handling, the Council names SAQ A as a typical example.
- Confirm your provider is compliant. The Council says to confirm the provider is PCI DSS compliant for the services it gives you.
- Keep a written agreement. It says to keep written agreements with the provider that set out each side’s responsibilities.
- Check on your provider. It says to monitor “the provider’s compliance status at least annually” (PCI SSC FAQ).
- Know where the line is. Understand which security jobs are yours and which are your provider’s.
A simple habit keeps your part small: let card numbers go straight into the terminal or online checkout your provider gives you. Don’t write them down, and don’t take them by email or text, so they never sit on your own systems.
The Council also has free small merchant guides on its merchant resources page, including a guide to safe payments.
What providers charge for PCI
A PCI fee on your statement is set by your provider. The Council says it has no information about penalties or fines for non-compliance.
What the providers we compare publish:
- Helcim: lists “PCI fees, Annual compliance self assessment” at $0. It also lists no account monthly fee, minimums, software fees or statement fees.
- Stax: doesn’t publish chargeback, PCI or statement fees on its pricing page.
- Everyone else we compare: we haven’t found a published PCI fee amount.
If your statement shows a PCI fee or a “non-compliance” charge, ask your provider three things in writing: what the fee covers, what you need to do to stop paying it, and whether a lower-fee plan includes it.
Keep reading
- Credit card processing fees, explained: every line on a US statement, PCI included.
- What is a payment processor?: who handles your customers’ card data.
- What is a chargeback?: the other fee that shows up when something goes wrong.
Common questions
What is PCI compliance?
It means meeting the Payment Card Industry Data Security Standard, or PCI DSS. The PCI Security Standards Council says the standard provides a baseline of technical and operational requirements designed to protect payment account data. It applies to every business that stores, processes or transmits cardholder data, which includes any business that accepts cards.
Do small businesses need to be PCI compliant?
Yes. The PCI Security Standards Council says PCI DSS applies to all entities that store, process or transmit cardholder data. Even if your provider handles every card number, the Council says you must still make sure that provider protects the data, and still validate your own compliance, typically with a Self-Assessment Questionnaire.
Who enforces PCI compliance?
The card brands and acquiring banks, not the Council that writes the standard. The PCI Security Standards Council says compliance and enforcement are the role of the payment brands and acquiring banks, and that it has no information about penalties or fines. Your provider or acquirer tells you what you must submit and when.
What is a PCI compliance fee?
It's a charge some providers add to cover PCI programs. The amount is set by your provider, not by the Council. Among the providers we compare, Helcim lists its fee for the annual compliance self assessment as $0, and Stax doesn't publish chargeback, PCI or statement fees. If you see a PCI fee, ask what it covers.