PCI compliance fees: required rules, optional charges

The short version: keeping card data safe is required. Paying a monthly PCI fee for it usually isn't. If you're paying a "non-compliance" fee on top, you can probably stop it by filling in one questionnaire.

What PCI DSS is

PCI DSS (the Payment Card Industry Data Security Standard) is the card industry's set of security rules for any business that takes card payments. It's run by the PCI Security Standards Council, which was set up by the major card schemes.

It's a contract rule, not UK law. You agree to it in your merchant agreement, and your provider is responsible for making sure its customers follow it.

Compliance is required. The fee isn't.

These are two different things that get muddled on purpose:

• Being compliant means following the rules and confirming it once a year, usually with a self-assessment questionnaire. Every card-taking business has to do this.
• A PCI fee is a charge your provider chooses to add, often for access to a compliance portal or a scanning service. Plenty of providers don't charge one at all.

So "PCI compliance: £4.50" on your statement isn't a tax or a regulatory charge. It's part of your provider's pricing, and it's negotiable.

Typical PCI and non-compliance fees in the UK

• PCI fee: typically around £4 to £5 a month, plus VAT. At £4.50, that's £64.80 a year with VAT.
• Non-compliance fee: added by some providers if you haven't completed your annual questionnaire. It's often higher than the PCI fee itself, and it can be charged on top of it. Check your statement for the exact amount. Charges vary widely between providers.

Not sure whether you're paying either? Our statement guide shows where these lines usually appear.

How to become compliant

1. Log in to your provider's compliance portal, or ask them which questionnaire you need.
2. Pick the right self-assessment questionnaire (SAQ). Businesses that only take payments on a standalone card machine usually have one of the shortest forms. Online sellers have different forms.
3. Answer the questions honestly. For a card-machine-only business they're mostly about not writing down card numbers, keeping the machine secure and using the provider's own software. It often takes 15 to 30 minutes.
4. Submit it and keep a copy. Set a reminder for next year.
5. Check your next statement to make sure any non-compliance fee has stopped.

PCI DSS version 4: what changed in 2025

The current version of the standard is PCI DSS 4.0.1. On 31 March 2025, the "future-dated" requirements in version 4.0 became mandatory.¹ Most of them affect larger businesses and online sellers: stronger authentication, script monitoring on payment pages, and more regular risk reviews. For a small business that only takes payments on a card machine, the practical change is small. Fill in your questionnaire each year.

How to stop paying PCI fees

1. Complete your questionnaire to end any non-compliance fee.
2. Ask your provider to remove the PCI fee. It's a pricing choice, so it's negotiable, especially if you're thinking of leaving.
3. When you compare providers, include it. A deal with no PCI fee saves you £64.80 a year with VAT, compared with one at £4.50 a month.
4. Check the contract terms before switching. Our contract guide explains exit fees and the 18-month rule.

For every other charge you might see, read card machine fees explained.