PCI Compliance Fee 2026: What It Is and How to Stop Paying Extra
If you've spotted a "PCI" line on your card statement and wondered what you're paying for, you're not alone. It's one of the most common questions small businesses ask about their card bills, and one of the easiest costs to cut. The bit that really stings is the non compliance fee, which can be charged every month until you fill in a short form. Here's what's going on, with real figures from UK providers' websites checked in October 2026.
What PCI DSS is
PCI DSS stands for the Payment Card Industry Data Security Standard. It's a set of security rules for any business that stores, processes or sends card data. The standard is written by the PCI Security Standards Council, which was set up by the major card brands.
The current version is PCI DSS v4.0.1, published in June 2024. The council retired v4.0 on 31 December 2024, and the requirements that were future dated in v4.0 became mandatory on 31 March 2025. Sources: blog.pcisecuritystandards.org and the PCI DSS v4.0.1 standard, checked October 2026.
PCI DSS isn't a law. It's a contractual requirement. Your acquirer's agreement with the card schemes requires your business to be compliant, and your contract with your acquirer passes that duty on to you.
The two PCI fees
Providers tend to charge one or both of these:
| Fee | What it pays for | Example |
|---|---|---|
| PCI service or programme fee | Access to an online portal to complete your checks, plus support | Paymentsense example: £4.95 a month + VAT |
| PCI non compliance fee | Charged if you haven't completed your annual checks | Paymentsense example: £35 a month + VAT |
Elavon says on its Start simple plan that non compliance fees apply if you don't prove compliance within 90 days of signing up. App based providers such as SumUp, Square and Zettle don't list a separate PCI fee on their UK pricing pages. Sources: paymentsense.com/uk/pricing and elavon.co.uk, checked October 2026.
What it costs over a year
| Situation | Monthly | Yearly |
|---|---|---|
| Service fee only (£4.95 + VAT) | £5.94 | £71.28 |
| Service fee plus non compliance (£39.95 + VAT) | £47.94 | £575.28 |
That's based on Paymentsense's example figures. A small cafe taking £2,000 a month on cards could end up paying more in PCI fees than in transaction fees if it ignores the paperwork.
How to become compliant
For most small businesses using a standalone card machine, compliance means completing a Self Assessment Questionnaire (SAQ) each year, usually through your provider's portal. Typical steps:
- Log in to your provider's PCI portal. The details are often in your welcome email.
- Answer questions about how you take payments. Card machine only, online, phone orders and so on.
- Complete the right SAQ. The portal usually picks it for you based on your answers.
- Run a network scan if asked. Some setups need a quarterly scan of your internet connection. The portal will say.
- Submit and keep a copy. Set a reminder for next year.
Paymentsense says it offers a PCI phone validation service to help.
Ways to reduce your PCI burden
- Don't write down card numbers. Ever. If you take phone orders, use a virtual terminal or payment link instead of noting details on paper.
- Keep your card machine separate. A standalone terminal that doesn't connect to your till network keeps things simpler.
- Ask about P2PE. Point to point encryption can reduce the scope of your checks. Stripe, for instance, offers optional P2PE on Terminal for 4p per authorisation.
- Use hosted payment pages online. If customers enter card details on your provider's page, your website handles less card data.
PCI for different businesses
Cafe
A standalone or integrated card machine with no card details stored usually means a short SAQ. Do it in your first week.
Market stall
App based readers don't usually charge a separate PCI fee, but you should still keep phones and readers secure.
Hairdresser
Never keep clients' card details in a booking diary. Use your booking system's secure card storage if you take deposits.
Trades
Taking card details over the phone for jobs? Use a payment link so you never handle the numbers.
Taxi
Keep your terminal's software updated and never write down card details for account customers.
Which SAQ might apply to you?
The Self Assessment Questionnaire (SAQ) you fill in depends on how you take payments. Your provider should tell you which one, but here's a rough guide:
| How you take payments | Likely SAQ | Effort |
|---|---|---|
| Fully hosted online checkout or payment page | SAQ A | Short |
| Standalone card machines connected by phone line or mobile network | SAQ B | Short |
| Card machines connected over the internet (IP) | SAQ B-IP | Medium |
| Approved point to point encryption (P2PE) solution | SAQ P2PE | Short |
| Virtual terminal on a single computer | SAQ C-VT | Medium |
| Payment software connected to the internet, no card data stored | SAQ C | Longer |
| Anything else, including storing card data | SAQ D | Long |
Most small businesses using a modern card machine or reader end up with one of the shorter forms. If you're asked to complete SAQ D, ask why, as there may be a simpler setup available.
Common mistakes that trigger non compliance fees
- Ignoring the first email. Providers usually send a login for their PCI portal when you join. If it goes to spam, the deadline passes and fees start.
- Not finishing the questionnaire. Starting isn't enough. Check it shows as complete.
- Forgetting the yearly renewal. Compliance has to be confirmed each year.
- Missing a vulnerability scan. If your setup needs quarterly scans, a missed scan can make you non compliant.
- Writing card numbers down. Taking card details over the phone and writing them on paper is a big no. Use a virtual terminal or payment link instead.
- Changing setup without telling anyone. Adding a new till or online shop may change your SAQ.
Put a reminder in your calendar a month before your renewal date. It's a ten minute job that can save you £35 or more a month.
Worked monthly cost examples
Here's how PCI fees affect your overall cost on a typical rented machine, using Paymentsense's example 1.40% rate, £20 rental and £4.95 PCI fee (both + VAT).
| Monthly takings | Compliant | Not compliant (extra £42 inc VAT) |
|---|---|---|
| £2,000 | £57.94 | £99.94 |
| £10,000 | £169.94 | £211.94 |
| £30,000 | £449.94 | £491.94 |
We've left out authorisation fees here to keep it simple. The point stands: non compliance adds about £500 a year for nothing.
FAQs
What is a PCI compliance fee?
A monthly or annual charge from your card provider for its PCI compliance programme, such as a portal and support to complete your security checks.
What is a PCI non compliance fee?
An extra charge if you haven't completed your annual PCI checks. Paymentsense's example showed £35 a month plus VAT.
Is PCI compliance a legal requirement?
No. It's a requirement of the card schemes, passed on through your contract with your acquirer.
How do I stop paying PCI non compliance fees?
Complete your annual self assessment questionnaire, and any scans your provider asks for, through its PCI portal.
Do SumUp or Square charge PCI fees?
They don't list a separate PCI fee on their UK pricing pages, checked October 2026.
What is the current version of PCI DSS?
PCI DSS v4.0.1, published in June 2024.
Do I need to pay for a PCI scan?
Only if your SAQ requires external vulnerability scans, which usually applies to setups connected to the internet in certain ways. Your provider's PCI portal will tell you. Some include scans in their PCI fee; others charge extra, so ask.
Can my accountant fill in the PCI questionnaire?
They can help, but you're the one confirming how your business handles card data, so you need to know the answers are right.