What is PCI compliance?
Every business that takes card payments pays a PCI compliance fee. Here is what it actually covers, what it should cost, and how to check you are not paying twice what you need to.
PCI in one paragraph
PCI DSS stands for the Payment Card Industry Data Security Standard. It is a set of rules written by the card schemes — Visa, Mastercard and the rest — that every business taking card payments has to follow. The rules cover simple, sensible things: don't write card numbers down, keep your terminal physically secure, use the network your provider gave you, and tell someone if something looks wrong.
For a typical small shop, café or salon, being compliant means filling in a short online self-assessment questionnaire once a year and confirming a handful of statements. It is not a piece of equipment and it is not software you have to buy.
So what is the PCI fee on my statement?
Your payment provider charges a monthly PCI compliance fee to cover the portal you use to complete that annual questionnaire, plus any support and, in some cases, a small amount of breach cover. That is the whole of it.
Because the underlying work is identical whoever you are with, the fee is one of the clearest places to see whether a provider is being fair with you. Some charge £3 a month. Some charge £15 or more, and add a separate non-compliance charge on top if the questionnaire isn't completed.
What you should be paying
Open Rates publishes PCI compliance at £5 per month + VAT. It is on the home page, it is in the calculator, and it doesn't change once you've signed.
If you are paying more than that, the difference is pure margin — you are not getting a better standard of compliance for the extra money.
| Monthly PCI fee | Cost per year |
|---|---|
| £5 | £60 |
| £10 | £120 |
| £15 | £180 |
| £19.99 | £239.88 |
What happens if you ignore it
Most providers apply a monthly non-compliance fee — often £10 to £45 — if the questionnaire is never completed. It is quietly one of the most common reasons a statement is bigger than the merchant expects.
Completing the questionnaire usually takes ten to fifteen minutes. If you have never been shown where to do it, that is worth asking about before anything else.
What to ask your current provider
- What is my monthly PCI compliance fee, excluding VAT?
- Am I currently marked as compliant, and when did I last complete the questionnaire?
- Am I being charged a non-compliance fee, and how much is it?
- Is the PCI fee fixed for the length of my contract, or can it rise?