Firewalls and cybersecurity across San Bernardino County. Locally owned and operated, with local support. Call or text (760) 684-4139Sign inRequest service or a quote
WENO Office Solutions

Home > PCI compliance > PCI non-compliance fees

MERCHANT STATEMENT FEES
That line on your statement is a fee you can usually stop.

PCI non-compliance fee on your statement? How to stop it

Look at your monthly card processing statement. If you see "PCI non-compliance," "non-validation" or "PCI non-compliant fee," your processor is charging you because they have no current proof that your business protects card data. Here is what it means and how to make it go away.

Help me stop the feeCall or text (760) 684-4139
$ Fee review at no cost✓ We work with your processor for you
Monthly statementPCI non-compliance

The short answer

  • The fee is charged by your card processor, not the government and not the card brands directly.
  • It usually appears when the processor does not have a current, completed PCI Self-Assessment Questionnaire (SAQ) and, if required, a passing quarterly scan.
  • It commonly runs about $20 to $100 or more per month, which can add up to well over $1,000 a year.
  • The usual fix is to complete the correct questionnaire, pass any required scans, and keep them current every year.
  • It is not a penalty you have to keep paying. Once your account shows compliant, the fee normally stops.
$20 to $100+typical monthly fee
$1,000+a year in some cases
Every yearthe questionnaire must be renewed
Every quarterscans, if your account needs them

Why processors charge it

Card brands such as Visa and Mastercard require businesses that accept cards to follow the PCI Data Security Standard. Your processor is responsible for making sure its merchants do. When they have no proof on file, they charge a non-compliance fee to cover their risk and to push merchants to finish the paperwork. Many businesses pay it for years without knowing what it is.

📋No questionnaireThe yearly SAQ was never started, or it expired.
🔍Failed or missing scanA required quarterly scan failed or never ran.
❓Wrong questionnaireThe SAQ type does not match how you take cards.
🔐Lost portal accessNobody knows the login to the processor's PCI portal.

How to find it on your statement

  • Look in the fees or monthly charges section, not the per-transaction rates.
  • Common names: "PCI non-compliance," "PCI non-validation," "non-compliant fee," "PCI program fee not validated."
  • Do not confuse it with a "PCI compliance fee" or "PCI program fee," which some processors charge everyone, compliant or not. That one may stay even after you comply.
  • Compare a few months. If the amount stays the same every month, it is likely a fixed monthly fee you can stop.

Steps to stop the fee

StepWhat it involves
1. Find your PCI portalYour processor names the company that runs it. Your statement or welcome email usually has the link.
2. Pick the right questionnaireThe SAQ type depends on how you take cards: standalone terminal, POS on your network, online store or a mix.
3. Answer honestlyQuestions cover firewalls, passwords, updates, Wi-Fi, who can access card data and staff training.
4. Fix what is not in placeFirewall, network separation, updates and written policies, as needed.
5. Pass any required scansQuarterly external scans, if your SAQ type requires them. See failed PCI scan fixes.
6. Confirm with the processorCheck that your account shows compliant and that the fee is gone from the next statement.

Keep it from coming back

  • Set a reminder before the questionnaire expires each year.
  • Save the portal login and your answers where the business, not one employee, can find them.
  • Keep firewall and router firmware updated so scans keep passing.
  • Keep card terminals on their own network. See card terminal network separation.
  • Train staff to spot phishing, since the questionnaire asks about it. See phishing training.

How WENO helps you stop the fee

1. Statement reviewSend us a recent statement. We point out the fee and tell you what it will take to stop it.
2. We work the portal with youWe help find the right questionnaire and walk through the technical questions in plain English.
3. We fix the gapsWatchGuard® business firewall, network separation, updates, guest Wi-Fi and scan findings.
4. We talk to the processor and scan vendorWe handle the technical back and forth on your behalf until your account shows compliant.
5. We remind you every yearSo the questionnaire and scans stay current and the fee stays off your statement.

Questions people ask

Is the fee legal?

It is part of the merchant agreement you signed with your processor. Your agreement and fee schedule describe it. If you are unsure, ask your processor for the fee explanation in writing.

Can I get past fees refunded?

Sometimes. Some processors will credit recent months once you become compliant, but they do not have to. It is worth asking.

I only take a few cards a month. Does this apply to me?

Yes. Every business that accepts cards is expected to validate PCI compliance. Small businesses usually qualify for the simplest questionnaire.

Will switching processors fix it?

Not by itself. A new processor will ask for the same proof. Completing the questionnaire is usually faster and cheaper.

PCI complianceFailed PCI scanCard terminal network separationPhishing trainingWatchGuard firewallsBuy, lease or hardware as a service
Stop paying for paperwork nobody finished.Send us a statement and we will show you the fee and the fix.
Help me stop the fee

Sources

  1. PCI Security Standards Council: PCI DSS and Self-Assessment Questionnaires
  2. Visa: merchant data security requirements

General information, not legal or financial advice. Fees and requirements vary by processor and are set in your merchant agreement.