PCI compliance refers to the ongoing state of adhering to PCI DSS (Payment Card Industry Data Security Standard) requirements. It's not a one-time certification — compliance must be maintained continuously and validated annually.
For most small merchants, PCI compliance is achieved by: 1. **Using compliant equipment**: Only using PCI-approved payment terminals on the Validated Payment Applications list 2. **Not storing sensitive cardholder data**: Most modern terminals don't store card numbers — but verify this is the case 3. **Completing the annual Self-Assessment Questionnaire (SAQ)**: An honest self-evaluation of your security practices 4. **Maintaining basic security practices**: Strong passwords, updated software, employee access controls 5. **Using encryption and tokenization**: Ensuring card data is protected in transit and at rest
PCI compliance fees: Most processors charge a PCI compliance fee ($5–$15/month or $50–$150/year) that covers the cost of their compliance programs and SAQ support. Some charge a non-compliance fee ($10–$50/month extra) if merchants don't complete their SAQ — this is often an additional profit center for processors.
Being "PCI compliant" reduces but does not eliminate liability in the event of a breach. If you've completed your SAQ and maintained compliant practices, liability shifts significantly. If you're non-compliant, you bear full liability.
PCI compliance is a business protection measure. The $100–$200/year you spend on PCI compliance is insignificant compared to the cost of a data breach: card brand fines ($5,000–$100,000+), forensic investigation costs ($20,000–$100,000), remediation costs, and customer notification requirements.
Check your processing statement: if you're paying a "non-compliance fee" it means you haven't completed your annual SAQ. Contact your processor to complete it — the fee goes away and you're actually protected.
A small dental office's PCI compliance checklist: - Payment terminal: Clover Flex (PCI-listed, point-to-point encrypted) - No card data stored in practice management software - Annual SAQ: SAQ B-IP completed in 20 minutes - Wi-Fi network segmented (payment network separate from practice network) - Employee access to payment terminal limited to front desk - Result: PCI compliant, no non-compliance fees, reduced breach liability
Your processor will provide you with a portal or link to complete the SAQ. The appropriate SAQ type depends on how you accept payments. Most small card-present merchants use SAQ B or B-IP. Answer honestly — false attestations carry legal liability.
The PCI compliance fee ($5–$15/month) is charged by your processor for PCI support services. This is normal. If you see both a compliance fee AND a non-compliance fee, call your processor — you may not have completed your annual SAQ.
Yes. E-commerce merchants have more PCI requirements because card data is entered online. Using a PCI-compliant hosted payment page or tokenization can dramatically reduce your scope and compliance burden.
Liberty Bancard supports merchants through the entire PCI compliance process. Our compliance team walks you through your SAQ, answers security questions, and helps you achieve and maintain compliant status. PCI support is included in our merchant services.
Continue learning: Browse all 60 payment processing terms in our Payment Processing Glossary, or upload your statement for a free analysis of your current processing costs.