PCI Non-Compliance Fees and Fines: Why You Are Charged and What Stops Them

A PCI non-compliance fee is a monthly charge from your acquirer or payment provider for not having a current PCI DSS validation on file. It is not a fine from the PCI Security Standards Council (PCI SSC), and it does not mean you have been breached. It stops when your acquirer accepts a valid Self-Assessment Questionnaire (SAQ) or Report on Compliance (ROC) with a signed Attestation of Compliance (AOC), plus any quarterly ASV scans your SAQ requires. Card-brand fines are a separate matter: they are charged to acquirers, except for American Express, which can charge merchants it contracts with directly. They matter most after a data breach.

This guide, from a PCI SSC-approved Qualified Security Assessor (QSA) company, covers the fee first, then fines and breach costs.

Why am I paying a PCI non-compliance fee?

You are paying it because your acquirer’s records do not show a current, accepted validation for your merchant account. Acquirers answer to the card brands for their merchants’ compliance, and many UK acquirers add a monthly charge until each merchant validates. The usual causes:

Paying the fee does not make you compliant, and it gives you no protection if card data is later compromised.

How do I spot the fee on my statement?

Names vary between providers, so look for any line that mentions PCI, data security or compliance; our guide to Worldpay PCI compliance shows how one acquirer’s programme works. Then work out which kind of charge it is:

If a line is unclear, ask your provider in writing what it is and what it needs from you. The cost of becoming compliant is a separate question, covered in our guide to PCI compliance cost.

How do I avoid or stop paying a PCI non-compliance fee?

To avoid the fee, validate before your acquirer’s deadline every year. To stop it, give your acquirer a valid validation and get written confirmation that it has been accepted. Nobody else can remove the fee: not a QSA, a consultant or your card machine supplier. Be wary of unsolicited calls or emails offering to “remove your PCI fee” for a payment, and check any such request using the contact details on your statement.

A 30-day plan to get back to compliant

This plan assumes you validate with an SAQ, as most smaller merchants do. Level 1 merchants need a ROC, covered in our guide to PCI Level 1.

Choosing the SAQ is the step to get right, because it depends entirely on how you take payments. Our free PCI compliance check suggests your likely SAQ and the gaps to close in about five minutes. Our guide to which PCI SAQ you need walks through each type, and our guide to PCI compliance for small businesses shows what a typical small merchant has to do.

Where your SAQ requires quarterly external scans, they must come from a PCI SSC Approved Scanning Vendor; we arrange quarterly ASV scans through our PCI SSC Approved Scanning Vendor partner. If some gaps will take longer than 30 days to fix, tell your acquirer. The AOC has an action plan section (Part 4) for requirements not yet in place, completed only if the organisation you submit to asks for it, and your acquirer decides whether the fee continues in the meantime.

PCI compliance penalties: what is the penalty for not being PCI compliant?

Usually a monthly non-compliance fee from your acquirer until you validate. PCI fines in the UK do not come from the government or the PCI SSC: they come from the card brands, which charge acquirers (and, for American Express, some merchants directly), and the largest costs follow a data breach.

Who issues PCI fines?

The card brands issue PCI compliance fines, not the PCI SSC. Visa and Mastercard charge acquirers rather than merchants, but American Express, which contracts directly with many UK merchants, can charge non-compliance fees to the merchant itself under its Data Security Operating Policy. Visa’s published compliance rules say that if a merchant or service provider does not comply with PCI DSS, or fails to fix a security issue, Visa may charge a non-compliance assessment to the issuer or acquirer, which is responsible for paying it. The same page says the issuer or acquirer must not represent that Visa has imposed the assessment on the merchant. What reaches you depends on your merchant agreement, which typically lets the acquirer recover costs it incurs because of your non-compliance. Check the indemnity terms in yours.

How much are PCI fines?

There is no single figure, and PCI DSS itself sets no penalties. Visa’s and Mastercard’s assessment amounts sit in their rules for acquirers, while American Express publishes its merchant fees. Under its UK Data Security Operating Policy, a merchant that misses a validation deadline can be charged USD 25,000, then 35,000, then 45,000 at Level 1, USD 5,000, 10,000 and 15,000 at Level 2, and USD 50, 100 and 250 at Level 3 or 4 where American Express has required validation, in local currency equivalents. For Visa and Mastercard, what you can be charged sits in your merchant agreement. Treat monthly fine ranges quoted online with caution unless they cite a card-brand source, and ask your acquirer in writing what it can pass on to you.

What triggers PCI fines and extra costs?

What happens if you are not PCI compliant and suffer a breach?

This is where non-compliance becomes expensive:

• Tell your acquirer straight away. It will tell you what the card brands require.
• Forensic investigation. You may be required to appoint a PCI Forensic Investigator (PFI) from the PCI SSC’s list, normally at your own cost. Sovereign Secure is not a PFI company.
• Issuer recovery. Visa’s Global Compromised Account Recovery programme lets card issuers recover a portion of their operating expenses after a compromise from the acquirer, and Mastercard’s account data compromise rules let issuers partly recover the cost of reissuing cards and monitoring affected accounts. Your acquirer can pass these costs on to you.
• Compliance at the time matters. Visa says its assessments may be waived if a forensic investigation shows no evidence of PCI DSS non-compliance before and at the time of the breach. Being compliant, not paying the fee, is what protects you.
• Stricter validation. Mastercard can place any merchant at Level 1 to minimise risk to the system, so a compromise can mean a full ROC in future.
• Your merchant account. If your acquirer terminates your agreement, it may record that on Mastercard’s MATCH database, which acquirers check before taking on new merchants.
• UK GDPR. Card data linked to a cardholder is personal data. A personal data breach must be reported to the ICO within 72 hours of becoming aware of it, unless it is unlikely to result in a risk to people’s rights and freedoms. For the most serious infringements, UK GDPR fines can reach £17.5 million or 4% of annual worldwide turnover, whichever is higher.

Is it illegal not to be PCI compliant in the UK?

No. PCI DSS is a contractual requirement in your merchant agreement, not a UK law, so non-compliance is a breach of contract rather than an offence. Data protection law still applies to card data, as our guide to PCI compliance in the UK explains.

Why Sovereign Secure

• A PCI SSC-approved assessor. Sovereign Secure Ltd, established in 2012 and based in Accrington, Lancashire, is a Qualified Security Assessor (QSA), Qualified PIN Assessor (QPA) and Card Production Security Assessor (CPSA) company, and a member of the PCI SSC Global Executive Assessor Roundtable (GEAR) for 2026 to 2028.
• Help that ends in an accepted validation. Our PCI DSS consultancy team helps you choose the right SAQ and close the gaps; where your acquirer needs one, we provide a QSA-validated SAQ or ROC. Advisory and assessment work are kept separate, as the PCI SSC expects of a QSA company.
• Clear about limits. We cannot remove an acquirer’s fee, and we are not a PFI. What we do is get you to a validation your acquirer can accept.

Get the fee stopped with a validation that sticks

Tell us how you take card payments, what your acquirer has asked for and the statement line you are being charged (never send card numbers). We will tell you which SAQ applies, what needs fixing and send a fixed quote for any help you need. Contact our PCI team or call +44 161 523 5276.