Guide
PCI non compliance: what it costs, and how to get back on track
PCI non compliance is rarely a single dramatic fine. Instead, costs arrive through your acquirer, monthly fees and, after a breach, much larger bills. So it pays to understand the chain.
- We prepare, a QSA assesses
- Published price ranges
- Written estimate, no call
How penalties reach you
The card brands can penalise acquirers, and acquirers pass costs to merchants through their contracts. Therefore your agreement with your bank decides what you actually pay. The standard itself is in the PCI SSC document library.
Typical costs of PCI non compliance
Amounts vary by acquirer and case. However, the common patterns are well known.
| Cost | What it looks like |
|---|---|
| Monthly penalties | Reported from about $5,000 a month upward. |
| Non-compliance fees | Extra charges on your merchant statement. |
| Breach costs | Forensics, card replacement and higher fees. |
| Account action | Higher rates, or termination of card acceptance. |
PCI non compliance risk check
Tick each statement that is true. More ticks mean higher risk.
Your result appears here as you tick, so you can see what is still open.
PCI non compliance is common
Around 45 percent of businesses have failed an assessment at some point. So failing is common rather than shameful. What matters is closing the gaps quickly and validating again.
Recovering from PCI non compliance
Start with a gap analysis, then fix the highest-risk items first. Typically, fixing what a gap analysis finds takes three to six months. Also, tell your acquirer you are working on it, because a plan often eases pressure.
- Run a gap analysis against version 4.0.1
- Fix the highest-risk findings first
- Complete the correct SAQ or assessment
- Send your acquirer an updated AOC
Our role
We run the gap analysis and help you remediate. However, we are not a QSA, so validation is always performed by you on a questionnaire or by an independent assessor.
Communication with your acquirer matters too. A short written plan with dates often buys time, because it shows the problem is being handled.
PCI non compliance questions
Is PCI non compliance illegal?
Not usually. PCI DSS is contractual, but some laws on data protection can also apply after a breach.
Who fines us?
Card brands penalise acquirers, who pass costs on through your contract.
Can PCI non compliance close our merchant account?
In serious cases, yes, so act on acquirer letters promptly.
How fast can we fix it?
Often three to six months, depending on the gaps.
Related guides
Get back to compliance with a plan
Send us your acquirer's letter. We reply with a written estimate for a gap analysis and remediation plan.
Get my written estimate