What Is a PCI Non-Compliance Fee?

Who charges it: your provider, not the card brands

The PCI Security Standards Council manages PCI DSS, but its At a Glance document on the Council's role says enforcement of compliance and any non-compliance penalties are carried out by the individual payment brands, not by the Council, and that the Council has no information about penalties or fines. The brands, in turn, place the job on the acquirer. Visa's Core Rules (18 April 2026) require an acquirer to ensure that merchants with access to account or transaction information comply with PCI DSS, and to make sure its merchant agreements set out merchants' responsibilities and the liabilities for failing to meet Visa's standards. Visa's own non-compliance assessments are charged to its members, such as acquirers. The line on your statement is a different thing: a fee your provider chose to put in your agreement.

Why processors charge it

Because the acquirer answers to the card brands for its merchants' PCI status, a merchant with no validation on file is an open item on its books. Some providers attach a fee to that open item, both to cover their own compliance work and to give merchants a reason to submit their paperwork. Whether the fee exists on your account, what it is called and how much it is are all set by your provider, so there is no network rate to look up and no typical figure we can source. Check your own fee schedule.

How to spot it on your statement

Look in the account fees or other fees section of your statement, not among the per-transaction charges. Labels vary by provider. Wording to look for includes PCI non-compliance, PCI non-validation, non-receipt of PCI validation, or PCI compliance penalty. If a line names PCI and you are not sure what it pays for, find the same name in your fee schedule and read what triggers it and what stops it. Check three recent statements so you can see the month it started.

How to get it removed

First, ask your provider in writing which SAQ it expects from you and where to submit it. PCI SSC FAQ 1133 says there are several questionnaires for different set-ups, depending on how a business stores, processes or transmits cardholder data, and that merchants should ask their acquirer or the payment brands which one applies. Second, ask whether your SAQ needs external vulnerability scans. PCI SSC says an Approved Scanning Vendor (ASV) runs the external scans used to validate PCI DSS Requirement 11.3.2, and it keeps the list of approved vendors. Third, submit the SAQ and any passing scan reports, and keep the confirmation. Fourth, check your next statement. If the fee is still there, send the confirmation back and ask for the fee to be removed and for any charges after your submission date to be credited. Whether earlier months are refunded is your provider's decision, so ask, but do not count on it. Repeat on the schedule your provider sets.

Non-compliance fee vs PCI compliance or annual fee

A PCI non-compliance fee is triggered by missing validation and should end when you validate. A PCI compliance fee or PCI program fee is a different line in some agreements: it is charged whether or not you validate, and some providers say it pays for a compliance portal or tools. An annual fee is a general account fee that may have nothing to do with PCI. You may see one, two or all three on the same account. Paying any of them does not make you PCI compliant; only completing the validation your provider requires does that. Our hidden processing fees checklist covers the other account fees worth questioning.

How a statement review with CELER Merchants can flag it

CELER Merchants is an independent merchant services agent, not a processor or a bank. When you send us a statement for a free analysis, we label every fee line, including PCI-related ones, and tell you which lines look like non-compliance charges and which look like program or annual fees. If a non-compliance fee is on your statement, we can walk you through the questions to ask your provider to have it removed. If you also want to compare offers, we show you what other providers would charge, side by side. This is general information, not legal advice (October 13, 2026).