PCI Compliance Cost

What PCI compliance costs

PCI compliance cost depends far more on how card data moves through your business than on your size. Secureframe's published guide puts annual cost for a small company completing a self-assessment questionnaire (SAQ) and Attestation of Compliance at $20,000 or less, and $50,000 to $200,000 for a large enterprise completing a Report on Compliance ¹. The main lines:

• ASV scans. Quarterly external scans by a PCI-approved scanning vendor. One reseller lists Sectigo's HackerGuardian PCI scan, which includes an ASV scan report, at $98.35 a year for up to 5 IP addresses and $299 a year for up to 20 ². Secureframe gives $150 to $200 per IP a year ¹, and SecurityMetrics puts scanning and monitoring tools at $150 to $5,000 a year ⁶.
• The SAQ itself. The forms are published by the PCI SSC ¹⁰¹⁷; the cost is the staff time and the fixes the questionnaire exposes.
• QSA assessment. About $45,000 to $75,000 for a basic Level 1 audit, mostly assessor fees, and $100,000 to $250,000 or more for full-scope, multi-location work ³.
• Penetration testing. A published 2026 guide puts an external network test at $5,000 to $20,000 and a web application test at $5,000 to $30,000 ¹¹. See our penetration testing cost guide.
• Processor fees. Some processors charge a monthly PCI program fee, and most charge a non-compliance fee if you never validate (covered below).

A merchant using a fully hosted checkout or a processor that is merchant of record may spend almost nothing beyond the processing fee ¹⁴. A merchant that stores card numbers in its own systems is on the expensive end. Moving between those two ends is the biggest saving available.

Merchant levels and which SAQ you file

Your merchant level, set by your annual card transaction count, decides how you prove compliance, and your payment setup decides which SAQ you file. Visa sets a merchant's level by its total Visa transactions over 12 months ⁷. Mastercard's levels, by combined Mastercard and Maestro transactions a year, are ⁸:

• Level 1: more than 6 million transactions. Annual assessment ending in a Report on Compliance.
• Level 2: more than 1 million up to 6 million. Annual SAQ; Level 2 merchants completing SAQ A, A-EP or D must also engage a QSA or a PCI-certified internal assessor.
• Level 3: more than 20,000 up to 1 million e-commerce transactions. Annual SAQ.
• Level 4: all other merchants. Must comply with PCI DSS, but validation to Mastercard is not required unless a law or regulation requires it.

In practice your acquirer, the bank behind your processor, usually decides what a Level 4 merchant must submit. The PCI Security Standards Council says whether a small merchant must validate is decided by each payment brand, and tells merchants to ask their acquirer or brand ⁹.

The PCI SSC publishes separate SAQs for different setups, depending on how a merchant stores, processes or transmits card data ¹⁰¹⁷:

• SAQ A: card-not-present merchants that fully outsource card handling, such as a hosted payment page.
• SAQ A-EP: e-commerce merchants that partly outsource payment, where their own site affects the payment page.
• SAQ B: merchants using only imprint machines or standalone dial-out terminals, with no electronic card storage.
• SAQ B-IP: merchants using only standalone payment terminals that connect over IP.
• SAQ C-VT: merchants keying one transaction at a time into a virtual terminal.
• SAQ C: merchants with internet-connected payment application systems and no electronic card storage.
• SAQ P2PE: merchants using only a validated point-to-point encryption solution.
• SAQ SPoC: merchants accepting cards on an off-the-shelf phone or tablet with an approved card reader.
• SAQ D: everyone else, covering the full standard.

The gap between SAQ A and SAQ D is the gap between a short form and the whole standard.

PCI DSS v4.0.1 and the March 31, 2025 requirements

PCI DSS v4.0.1 is the current version of the standard, and its future-dated requirements have been mandatory since March 31, 2025. The PCI SSC published v4.0.1 in June 2024 as a limited revision with no new or deleted requirements, and retired v4.0 on December 31, 2024 ⁴.

Of the 64 new requirements introduced in version 4, 51 were future-dated and became effective on March 31, 2025 ⁵. Until then they were not yet required; now an assessor or your acquirer can hold you to them. The Council's examples include quarterly ASV scans for e-commerce merchants filing SAQ A and an annual confirmation of your PCI scope ⁵.

E-commerce merchants got one change in their favor. In January 2025 the Council removed requirements 6.4.3 and 11.6.1, which deal with payment page scripts, and the related targeted risk analysis, 12.3.1, from SAQ A ¹². In their place, a merchant must confirm as an eligibility condition that its site is not susceptible to attacks from scripts that could affect its e-commerce systems ¹². That revised SAQ A took effect on March 31, 2025 ¹².

What that means for budgets:

• SAQ A online stores need a quarterly ASV scan and a defensible answer on script attacks, often a question for the web developer or platform.
• Merchants on SAQ A-EP, C or D carry more of the future-dated requirements, which usually means more IT time.

Confirm which version and SAQ your acquirer expects; this is a summary of the standard, not legal advice.

QSA assessments and ASV scans: what you pay for

A QSA assessment is a paid audit by a PCI SSC-approved Qualified Security Assessor and runs about $45,000 to $75,000 for a basic Level 1 engagement, according to SecurityMetrics ³. Secureframe gives a wider $30,000 to $200,000 range for a Report on Compliance by a QSA ¹. The price rises with the number of locations, payment channels, systems in scope and how much evidence you have ready.

Most small merchants never need a QSA. You need one when:

• You are Level 1, or Level 2 on SAQ A, A-EP or D under Mastercard's rules, which also accept a PCI SSC-certified internal security assessor ⁸.
• Your acquirer asks for a QSA-signed attestation.
• You are a service provider and a client or card brand asks for a Report on Compliance.

ASV scans are a separate, much smaller bill. An Approved Scanning Vendor scans your internet-facing systems from outside and issues a passing report that you submit with your SAQ. Pricing is usually per IP address or per site: one reseller lists one product at $98.35 a year for up to 5 IPs and $299 for up to 20, with unlimited scans each quarter ². Failed scans are where cost appears, because each failure needs a fix and a rescan before the quarter's report passes.

The fixes after a failed scan or a QSA finding are the real expense: firewall rules, patching, removing old systems that store card data, segmenting the network. A managed firewall service or your IT provider usually does that work. Compare what your current IT contract already covers using our managed IT services pricing guide.

Processor PCI fees and non-compliance fees

Processors charge small merchants in two ways for PCI: a routine program fee and a penalty-style non-compliance fee if you do not validate. Published examples:

• Wells Fargo Merchant Services lists a PCI compliance program fee of $10 a month per merchant ID and says PCI non-compliance fees apply to Level 3 and Level 4 merchants with 1 to 25 merchant IDs ¹³.
• Square says it maintains PCI certification so its sellers do not have to validate individually, and lists no audits, assessments or noncompliance fees, with security included in the processing fee ¹⁴.
• Stripe says acquiring banks typically charge $25 to $50 a month in non-compliance fees ¹⁵. It adds that fines passed down can reach $5,000 to $100,000 a month if the problem continues for six months ¹⁵.
• Merchant Maverick's 2024 review of processor fee terms listed non-compliance fees of $29.95 a month at CardConnect and $94.95 a month at TSYS ¹⁶.

Non-compliance fees stop when you validate. If one shows up on your statement, log into the processor's PCI portal, complete the SAQ and any required scans, sign the attestation and submit it to the processor ¹⁵. Then set a yearly reminder; validation lapses.

Ask whether your processor's PCI program fee already includes ASV scanning before you pay a separate scanning vendor for the same report.

How small merchants keep PCI costs down

The cheapest way to cut PCI cost is to keep card numbers off your own systems, which shrinks the SAQ you file and the parts of your network an assessor or scanner cares about. Options that do that:

• Hosted payment pages and tokens. Let your processor collect card details on its page or fields, and keep only a token. This is what makes SAQ A possible online ¹⁰.
• Encrypting terminals. Validated point-to-point encryption terminals encrypt the card at the swipe or tap and qualify for the short SAQ P2PE ¹⁰.
• Chip, P2PE and tokenization volume. Visa's Technology Innovation Program removes the requirement for eligible merchants to validate PCI DSS compliance ⁷. A merchant qualifies when at least 75% of transactions run through EMV chip terminals, a validated P2PE solution or a qualifying tokenization solution ⁷.
• Network separation. Keep payment devices on their own network, away from guest Wi-Fi and office PCs. See our guide to IT support for restaurants, hotels and retail.
• Delete old card data. Old spreadsheets, scanned order forms and legacy POS databases pull systems back into scope. A cybersecurity risk assessment can map where card data actually lives before you pick a fix.

Before you change processors or equipment, ask the new provider in writing which SAQ you would file and what its PCI fees are.

If PCI is one of several frameworks you face, compare costs with our SOC 2 audit cost and ISO 27001 certification cost guides. For help with a PCI project, send a request through the form: we route larger assessments to an advisory partner and smaller scoping or remediation work to one provider.