PaySec LLCVisit Website →
← Back to blog

Merchants: Confirm SAQ Eligibility to Avoid PCI Noncompliance Fees

September 27, 2026
Merchants: Confirm SAQ Eligibility to Avoid PCI Noncompliance Fees

A PCI non-compliance fee is a charge your acquirer bills you because your business has not validated its PCI DSS compliance status, and it lands on your monthly statement whether or not your systems are actually secure. These fees can recur monthly or hit as a one-time incident charge, and they can climb higher than the cost of fixing the underlying problem. The fastest way to stop them: confirm your SAQ type and scanning status directly with your acquirer and submit any missing documentation right away.

TL;DR:

  • Non-compliance fees can be triggered by missed or incorrect SAQ submissions, failed quarterly scans, or expired attestations, and are often avoidable with proper scheduling.
  • These fees vary based on merchant level, incident severity, and your specific merchant agreement, with maximums potentially reaching $25,000 for high-level merchants.
  • Confirm your correct SAQ type with your acquirer before submitting any documentation to prevent repeated fees caused by process errors.
  • Promptly address breaches by notifying your acquirer immediately, retaining forensic investigators if needed, and adhering to card-brand reporting deadlines to limit investigation costs.
  • Using validated payment technology and maintaining organized compliance documentation can reduce your PCI scope and the risk of high non-compliance fees.
Paysec
Make Payment Compliance More Transparent
PaySec helps businesses manage payments with detailed transaction reporting, transparent pricing, and seamless compliance across multiple industries.
Visit PaySec

Table of Contents

What is a PCI non-compliance fee, exactly?

A non-compliance fee is different from a compliance service fee. The service fee is what your processor charges to help you complete validation work, like scanning or portal access. The non-compliance fee is a penalty charged because that validation never happened, happened late, or used the wrong form.

Card brands set the rules, but they do not bill merchants directly. Mastercard and Visa enforce compliance through acquiring banks, and the amount that lands on your statement is governed by your merchant agreement, not a public price sheet. That agreement typically includes an indemnity clause that lets your acquirer pass the brand's charge straight to you.

On a statement, these fees usually show up as:

  • A recurring monthly non-compliance line item that continues until validation is submitted.
  • A one-time per-incident assessment tied to a specific violation or missed deadline.
  • A cumulative non-validation fee that increases the longer the account stays unresolved.

Who sets the fee, and what do published ranges actually show?

Mastercard publishes its Site Data Protection program tables with escalating maximums by merchant level, and Visa outlines investigation-related fees in its breach-response guidance. Your acquirer then applies those brand rules according to the terms in your merchant agreement, which is why two merchants with similar violations can see different invoices.

Reported ranges for non-compliance exposure vary widely, ranging from modest monthly fees for small merchants up to high penalties for severe violations, according to industry reporting on PCI violation penalties. There is no single universal fine schedule: card brands issue different tables, and your acquiring agreement is what ultimately determines your invoice.

A few reasons the amount varies so much:

  • Merchant level: Level 1 merchants (highest transaction volume) generally face steeper ceilings than Level 4.
  • Incident type: a missed scan deadline is treated differently than a confirmed data compromise.
  • Contract terms: your specific merchant agreement, not a public brand chart, sets what you owe.

What triggers a fee, and which timelines matter most?

Fees rarely appear out of nowhere. They follow specific, avoidable events.

  1. Wrong or missing SAQ. PCI SSC's guidance on SAQs for PCI DSS v4.0.1 tells merchants to confirm SAQ eligibility with the entity receiving their validation before filling anything out, since using the wrong form is a common cause of repeat non-compliance flags.
  2. Failed or absent quarterly ASV scans. Missed scan windows are one of the most common recurring triggers.
  3. Expired Attestation of Compliance. An AOC that lapses without renewal restarts the non-compliance clock.
  4. Confirmed compromise. A breach shifts you from routine validation into incident response, with its own fee structure.
  5. Missed reporting or investigation deadlines. Card-brand rules generally require reporting a suspected compromise within days, and delays narrow your response window.

Merchant level also shapes exposure. Mastercard's Site Data Protection tables list escalating maximums by level, with Level 1 and Level 2 merchants facing first-violation ceilings up to $25,000, rising on repeat violations. Visa's guidance on what to do if compromised sets a four-month grace period for forensic investigations before monthly fees can begin.

A checklist to avoid PCI non-compliance fees

Most fees are preventable with a short list of consistent habits, not a major technology overhaul.

  1. Confirm SAQ eligibility with your acquirer first. Do this before you complete anything. PCI SSC's SAQ bulletin flags this as the step most merchants skip, and skipping it causes repeat non-compliance entries even when your actual controls are fine.
  2. Complete and submit the right SAQ or ROC. Match the form to your validated business type, payment channels, and processing volume.
  3. Schedule ASV scans and keep the reports. Quarterly scans, where required, need to happen on schedule and the reports need to be retrievable on demand.
  4. Adopt validated payment technology. P2PE, tokenization, and validated EMV devices reduce how much cardholder data touches your systems, which shrinks your PCI scope and can qualify you for validation exemptions under card-brand programs.
  5. Limit or document cardholder data storage. If you do not need to store card data, do not. If you must, map and document every place it flows.
  6. Keep your paperwork ready. Your AOC, scan reports, remediation plans, and proof of fixes should be organized and easy to hand your acquirer on request.
  7. Train staff and maintain basic network hygiene by using the best security plugins for BigCommerce to close the gaps that lead to incidents in the first place. Unique credentials, current patching, and active firewalls close the gaps that lead to incidents in the first place.
  8. Move fast if you suspect a breach. Notify your acquirer immediately, retain a forensic investigator if asked, and follow card-brand reporting timelines closely.

Pro Tip: Ask your acquirer to confirm your correct SAQ type in writing. A documented answer protects you if a dispute over your validation status comes up later.

What happens after a breach: investigators, fees, and downstream costs

A confirmed compromise moves you from routine validation into a formal investigation, often involving a PCI Forensic Investigator (PFI). Visa's guidance gives merchants roughly a four-month fee-free window to resolve a PFI investigation.

After that window, Visa's published examples show fees as high as $10,000 per month for Level 1 and Level 2 investigations left unresolved, according to Visa's breach-response guidance. Smaller Level 3 or 4 cases may instead see a flat fee near $3,000.

Beyond the investigation fee itself, expect several cost buckets to stack up:

  • Forensic investigation and remediation work.
  • Card reissuance costs passed through from issuing banks.
  • Potential litigation exposure.
  • Higher processing rates going forward.

A breach can also push a smaller merchant into Level 1 status, which means a full Report on Compliance and a Qualified Security Assessor review going forward. Cooperating quickly with your acquirer and any assigned PFI is the most reliable way to keep the response contained.

Why the compliance burden matters more than the fine itself

The published fee tables get attention, but they are not the real problem. The real problem is that most merchants find out their SAQ was wrong only after a fee already posted, months after the mistake was made. That is a process failure, not a security failure, and it is entirely fixable before it costs anything.

The most overlooked fact in this whole system is that a business can have genuinely solid security and still eat recurring non-compliance fees, simply because nobody confirmed the SAQ type with the acquirer up front. Smaller compliance costs, estimated in guides at roughly $1,000 to $5,000 a year for merchants using SAQs and scans, are trivial next to what a single missed deadline can trigger. Treat validation as a calendar task, not a one-time project, and most of this risk disappears.

— PaySec Marketing Team

How PaySec reduces your PCI fee risk

PCI Compliance Assistance included with some merchant accounts can mean less time spent figuring out which SAQ applies and more clarity on required documentation. Combined with support for validated payment technology and pricing that passes through wholesale interchange rates, merchants may experience a smaller compliance scope and fewer surprises on their statement. For a deeper walk-through of validation requirements, see PaySec's PCI compliance checklist for small businesses.

Get PCI compliance help built into your processing

Switching processors does not need to add friction, and reducing your PCI exposure does not need to mean a technology overhaul. Merchant accounts with this provider often include PCI Compliance Assistance as part of onboarding, helping with SAQ selection, scan scheduling, and documentation tracking alongside account setup.

Paysec

Relevant services for reducing fee exposure can include PCI Compliance Assistance integrated with onboarding, pricing that passes through wholesale interchange rates, and support for validated devices and gateways across various sales channels.

If recurring non-compliance fees or high processing costs are cutting into your margin, check current PaySec pricing or review the PCI Compliance Assistance page to see how included support fits your setup. Merchants across SaaS, restaurants, eCommerce, healthcare, and CBD retail already use PaySec's contract-free service to combine lower processing costs with clearer compliance support.

Get PCI compliance help built into your processing — overview diagram

This article is general information, not a substitute for advice from a qualified financial advisor. Consult a qualified financial professional about your own circumstances before acting on anything here.

Sources

FAQ

Do I have to pay a PCI compliance fee?

Most merchant agreements include a compliance or validation service fee that covers scanning and documentation support, separate from any non-compliance penalty. Whether you owe one, and how much, depends on the terms in your specific merchant agreement with your acquirer.

How much is a non-compliance fee?

Amounts vary widely by merchant level, violation type, and acquiring agreement, with reported ranges spanning modest monthly charges up to over $100,000 for severe incidents, according to industry reporting on PCI penalties. Mastercard's published tables list escalating maximums by merchant level, while Visa's fees for unresolved investigations can reach $10,000 per month after a four-month grace period.

Is it illegal to charge a 3% credit card fee?

This depends on state law and is a separate issue from PCI compliance, which is a card-brand contractual requirement rather than a government regulation. Check your state's specific surcharging rules or consult a payments attorney, since permitted surcharge caps and disclosure requirements vary by state.

What is the penalty for not being PCI compliant?

Penalties typically start as recurring monthly non-compliance fees charged through your acquirer until you submit valid documentation. If a compromise occurs, additional costs can include forensic investigation fees, card-brand assessments, and higher processing rates going forward, as outlined in Visa's breach-response guidance.