PCI basics
Do I Need PCI Compliance? (And What It Actually Costs in 2026)
Three questions decide your obligations. For most small shops, the honest answer is shorter than the internet makes it sound — and cheaper than the vendors want you to believe.
If you accept credit or debit cards — online or in person — PCI DSS applies to you. There is no small-business exemption.
But what you actually have to do depends on how you take payments, not how big you are. For most small businesses the real cost is $0 to about $500 a year, plus your time. Larger or custom setups climb into five figures.
This is general information, not legal or compliance advice. Requirements and pricing change — verify against the current PCI DSS standard and your acquirer before you make decisions.
First, what PCI compliance actually is
PCI DSS — the Payment Card Industry Data Security Standard — is a set of security rules written by Visa, Mastercard, Amex, Discover and JCB. Not by a government, and not by your bank.
It is enforced through your merchant agreement. If you take cards, you have already agreed to follow it. That is the whole reason it is not optional — and it is also why nobody sends you to jail over it.
Your obligations come down to two things:
- Your SAQ — the self-assessment questionnaire you file, which depends on how you take cards
- Your merchant level — which depends on your annual transaction volume
Get those two right and almost everything else is paperwork plus a short technical checklist.
Three questions, and you are done
1. Do you take cards at all?
Online, in person, over the phone — if you take credit or debit cards in any form, you are required to comply.
The only businesses that genuinely do not need to think about this are those that never accept cards: bank transfer only, invoice or check only, or cash only.
2. How do you take them?
This is the biggest single factor in your cost. It decides which SAQ you file:
| How you take cards | Your SAQ | What it means |
|---|---|---|
| Hosted checkout or redirect — Shopify, Stripe Checkout, PayPal, Square Online, a hosted payment page | SAQ A | The light path. Card data never touches your servers. Mostly a short form. |
| Iframe or embedded payment fields on your own site | SAQ A-EP | More work. You are responsible for the security of your page, even though the fields are hosted elsewhere. |
| Custom checkout where card data reaches your own server, or you store or process card data | SAQ D | The heavy one — hundreds of controls. Most small businesses should get out of this scope rather than comply with it. |
| Card terminal, in person (standalone or connected to a POS) | SAQ B / B-IP / C | Depends on whether the terminal is standalone or IP-connected. |
3. What is your merchant level?
Levels are set by annual transaction volume. Most small businesses are Level 4 — the least demanding tier.
| Level | Typical criteria | What you have to do |
|---|---|---|
| 1 | 6M+ transactions/year (any channel) | Annual QSA on-site assessment (ROC) |
| 2 | 1M–6M transactions/year | Annual SAQ, possibly ASV scans |
| 3 | 20,000–1M e-commerce transactions/year | Annual SAQ + quarterly ASV scans |
| 4 | Under 20,000 e-commerce, or under 1M total | Annual SAQ; scans depend on your SAQ |
Levels are set by the card brands and can vary slightly by acquirer — worth checking in your merchant agreement.
If you are Level 4 on a hosted checkout, your realistic obligation is: file a short SAQ once a year, and keep your site and plugins updated. That is genuinely it.
What it actually costs
There is no single price, and anyone who quotes you one is guessing. Here is the honest line-by-line breakdown for 2026.
| Item | Typical cost | Who pays |
|---|---|---|
| SAQ self-assessment | $0 | Everyone — you complete it yourself |
| ASV vulnerability scans (quarterly, external) | ~$80–$800 per IP/year — budget providers run ~$59/quarter | SAQ A-EP / D, and most Level 3+ |
| Penetration test | ~$5,000–$30,000 | SAQ D, Level 1, or when your acquirer requires it |
| QSA on-site assessment (ROC) | ~$5,000–$50,000+ | Level 1 merchants |
| Compliance software (Vanta, Drata, Secureframe and similar) | ~$5,000–$50,000/year | Usually mid-market and up — rarely most small shops |
| Processor “PCI fee” | ~$79–$120/year | Most merchants who have not opted out |
| Processor “non-compliance fee” | ~$20–$100/month | Merchants who have not filed their SAQ |
| Your time, plus developer fixes | The real hidden cost | Everyone |
The two things that surprise people
1. Your scope drives the cost — not your size. Move from a custom checkout to a hosted one and you can drop from SAQ D to SAQ A. That turns a five-figure project into a short form. If you are rebuilding checkout anyway, this is the highest-leverage decision in the whole exercise.
2. Most “PCI fees” on your statement are penalties, not fees. A legitimate annual PCI fee runs about $79–$120. If you are being charged $20–$100 a month, that is almost always a non-compliance fee — charged because your SAQ has not been filed. Filing it usually makes the charge disappear. Some processors, including Square, Helcim and PayJunction, charge no PCI fee at all, which is worth weighing when you compare providers.
How to pay less, in order of impact
- Shrink your scope. Use a hosted checkout, or a provider that owns the card fields. Biggest lever by far.
- Actually file your SAQ. It is free, it is the one thing every card-accepting business must do, and it removes the monthly penalty.
- Buy ASV scans separately. The same certified service ranges from about $80 to $800+ per IP per year. Do not take the first quote.
- Skip compliance software you do not need. Vanta and Drata are good products for companies with a real compliance program. A Level 4 shop on a hosted checkout almost never needs a $5,000-a-year platform.
- Patch your stack. Most small-merchant risk is an outdated plugin or CMS — not a missing $50,000 tool.
Want the working checklist?
The full PCI compliance checklist walks through scope, tasks, evidence and a cost worksheet — step by step.
The one-page version
A plain-English checklist for small business: which SAQ, what documents, and a cost worksheet you can fill in yourself.
No spam. Unsubscribe anytime.No spam. Unsubscribe anytime.What to do next
- Confirm your SAQ using the table above.
- File it through your acquirer’s portal or the card brand’s self-assessment site.
- Read your statement and separate a PCI fee from a non-compliance fee. Most people are paying the second one by mistake.
- If you are on a custom checkout, price out a move to hosted before you price out SAQ D compliance.
FAQ
Is PCI compliance required by law?
No. It is a contractual requirement from the card brands, enforced through your merchant agreement — not a statute. But breaking it can mean fines passed down to you, higher fees, or losing the ability to accept cards.
Does a small business have to be PCI compliant?
Yes. There is no revenue or headcount exemption. What changes with size is your merchant level and how much validation is required — not whether the rules apply at all.
What happens if I am not PCI compliant?
In practice: a monthly non-compliance fee ($20–$100), possible fines passed down from the card brands, higher processing fees, and — if you are breached — liability for the cost of the incident.
Can I be PCI compliant for free?
Often, yes. If you use a hosted checkout (SAQ A) and complete your self-assessment, your direct cost can be $0. You may still have an annual PCI fee from your processor.
How much does PCI compliance cost per year?
Most small businesses: $0–$500. Mid-size e-commerce: roughly $1,000–$5,000 once scans and remediation are included. Level 1 merchants: $10,000+ for QSA assessments and penetration tests.
Do I need PCI compliance if I only use Stripe or Shopify?
You still have to validate — but your scope shrinks, usually to SAQ A. The platform is compliant; the responsibility to attest is still yours.
Written by a payment-security specialist with 17+ years in payment QA and security testing. Background in about. Spotted something out of date? Tell us — accuracy beats volume.