The standard that nobody reads
The Payment Card Industry Data Security Standard has been around since 2004. It has 12 top-level requirements, hundreds of sub-requirements, and a library of documentation that rivals a graduate syllabus. Most small business owners have never read a page of it. Most processors prefer it that way — the non-compliance fee averages $30/month and is pure margin.
Here's the short version: PCI DSS exists to protect cardholder data — your customers' card numbers, expiration dates, and security codes — from being stolen, stored unsafely, or transmitted over insecure networks. The requirements aren't arbitrary. They map to real attack vectors that have cost merchants and banks billions of dollars in fraud losses.
The PCI Security Standards Council is the governing body. They publish all SAQ forms, the full DSS, and guidance documents — all free. If a processor tells you compliance costs $299/year for their "compliance program," know that the standard itself costs nothing to access.
The 12 requirements, translated
The PCI DSS 12 requirements organize into six control objectives. Here's what they actually mean for a small merchant:
Build and maintain a secure network
- Install and maintain a firewall — even a basic one on your router counts if configured correctly.
- Don't use vendor default passwords — change the factory password on every device that touches payments.
Protect cardholder data
- Don't store cardholder data you don't need — most small merchants store nothing, which is fine.
- Encrypt card data in transit — use TLS 1.2 or higher on any payment page or API call.
Maintain a vulnerability management program
- Use and update antivirus software on all systems.
- Develop and maintain secure systems — patch your software and your point-of-sale application.
Implement strong access control
- Restrict access to cardholder data to people who need it.
- Assign unique IDs to every person with computer access — shared logins fail this requirement.
- Restrict physical access to cardholder data — lock the server room, lock the network closet.
Regularly monitor and test networks
- Track and monitor all access to network resources and cardholder data — logs matter.
- Regularly test security systems — vulnerability scans, penetration tests at higher merchant levels.
Maintain an information security policy
- Maintain a policy that addresses information security — write it down, distribute it, review it annually.
For most small merchants using a certified terminal or a hosted payment page, requirements 3, 4, 9, 10, and 11 are largely handled by your technology. The ones that bite small businesses are the ones requiring active behavior: default passwords (requirement 2), unique logins (requirement 8), and maintaining documentation (requirement 12).
SAQ types: pick the right one
The Self-Assessment Questionnaire is your annual compliance certification. The type you use depends entirely on how your business accepts cards. Using the wrong SAQ — either underestimating your environment or overcomplying — wastes time.
SAQ A — Applies to card-not-present merchants (e-commerce, phone orders) where all payment processing is outsourced to a PCI-compliant third party. No card data touches your servers. This is the simplest SAQ: 22 questions.
SAQ A-EP — Applies to e-commerce merchants where the payment page is served from your server but card data is processed by a third party. If you have a JavaScript snippet that sends data to Stripe or Authorize.Net, you're here. 191 questions.
SAQ B — Applies to merchants using imprinters (yes, those still exist) or standalone dial-up terminals that don't store electronic card data. 41 questions.
SAQ B-IP — Applies to merchants using certified IP-connected payment terminals (think Dejavoo QD5 or PAX A35) that are isolated from all other systems. 82 questions. This is the right SAQ for most counter-service retail and restaurant environments.
SAQ C — Applies to merchants using payment application systems connected to the internet (like a POS system on your local network). 160 questions.
SAQ D — Applies to everyone else. 329 questions. If you're here, you probably need a consultant.
If you're not sure which SAQ applies, review your terminal setup. Our terminal comparison guide identifies which terminals qualify for SAQ B-IP — the simplest path for most physical retail and restaurant environments.
The non-compliance fee is a revenue line
Let's be direct: the non-compliance fee on your processing statement is not paid to the PCI SSC. It's not a card-network fee. It goes to your processor. It is charged when you have not completed your annual SAQ and, where required, your quarterly Approved Scanning Vendor (ASV) network scan.
The fee is legal. The processor did (in most cases) notify you — buried in your welcome kit and statement footnotes. But the business model is obvious: a $30/month fee on a million merchants who never complete their SAQ is $360 million per year. Processors have little incentive to remind you how easy it is to comply.
Most processors use compliance program portals like Trustwave, ControlScan, or SecurityMetrics. Log in, answer the appropriate SAQ honestly, and the fee goes away. For a simple SAQ B-IP merchant, this takes about 30 minutes.
For the full statement fee breakdown — including where the non-compliance fee appears alongside PCI annual fees, monthly minimums, and batch fees — see how to read your processing statement like an auditor.
Bottom line
PCI compliance is not complicated for most small businesses. Complete your SAQ annually, use a certified terminal, don't store card data you don't need, and change every factory default password. That covers 90% of the requirements for a typical brick-and-mortar or simple e-commerce merchant.
The non-compliance fee is the most avoidable line on your statement. Don't pay it. If you're unsure which SAQ applies to your setup, talk to us — we've helped hundreds of merchants through the process at no cost.
This is general business information, not legal or financial advice.