Are PCI Compliance Fees Negotiable?
What PCI Compliance Fees Actually Are
If you accept credit cards, you are required to comply with the Payment Card Industry Data Security Standard (PCI DSS). This is a set of security requirements designed to protect cardholder data. It is not optional — every business that processes card payments must comply.
Your processor charges PCI-related fees to cover the cost of managing your compliance validation — one more line among your credit card processing fees. But here is what most merchants do not know: these PCI fees vary wildly from processor to processor, and many of them are inflated or completely unnecessary.
Do I Have to Pay for PCI Compliance?
Do you have to pay for PCI compliance at all? Compliance itself is mandatory, but the PCI compliance charges your processor adds are not a fixed government cost — they are a line item your provider sets. So how much does it cost to be PCI compliant? For many merchants, very little: completing the Self-Assessment Questionnaire is free, and some processors include PCI compliance at no charge. If you feel like you are being scammed by the PCI compliance fee, you are not imagining it — inflated PCI compliance fee charges in merchant services are one of the most common padding tactics we see.
Types of PCI Fees on Your Statement
PCI Compliance Fee
Typical range: $4.95 - $14.95 per month
This is a recurring monthly charge for maintaining your PCI compliance program. It supposedly covers the cost of providing you with a Self-Assessment Questionnaire (SAQ), vulnerability scanning tools, and compliance validation.
Is it negotiable? Yes. Many processors charge this fee purely for margin. Some processors include PCI compliance at no additional cost. If your processor charges more than $6.95/month, you are paying too much.
PCI Non-Compliance Fee
Typical range: $19.95 - $99.95 per month
This is a penalty fee charged when you have not completed your annual PCI compliance validation. So who pays the PCI non-compliance fee, and do these PCI non-compliance fee charges come from providers or the card brands? You do — the PCI non compliance fee is billed to the merchant by the processor (your provider), not by the card networks, which makes it one of the few fees entirely within your control to remove. It is designed to motivate you to complete the questionnaire — but many processors make the compliance process confusing or difficult to find, so merchants end up paying this fee for months or years without realizing it.
Is it negotiable? Absolutely — and it should be eliminated entirely. Complete your SAQ and the fee goes away. If your processor cannot provide clear instructions for completing compliance, that is a red flag.
Annual PCI Fee
Typical range: $59 - $149 per year
Some processors charge an annual lump-sum PCI fee in addition to (or instead of) monthly fees. This is billed once per year, often buried on a single month's statement.
Is it negotiable? Yes. This fee is negotiable and can often be waived, especially if you are already paying a monthly PCI compliance fee.
How to Know If Your PCI Fees Are Padded
Here are the warning signs that your processor is using PCI fees as a profit center:
1. You are paying both monthly AND annual PCI fees. You should not be paying both. One or the other is standard — paying both is double-dipping.
2. You completed compliance but are still being charged the non-compliance fee. This happens more often than you would think. Processors do not always update their billing systems when you complete your SAQ.
3. Your PCI fee is above $9.95/month. Some processors charge $14.95, $19.95, or even $24.95 per month for PCI compliance. At $24.95/month, you are paying nearly $300/year for a service that many processors provide for free.
4. You cannot find the compliance portal. If your processor does not make it easy to complete your SAQ, they may be profiting from non-compliance fees. A reputable processor provides a clear link and reminders to complete your assessment.
For more on spotting inflated charges, read our guide to 5 hidden fees on your processing statement.
How to Negotiate PCI Fees Down
Step 1: Complete Your PCI Compliance
Before you negotiate, make sure you are PCI compliant. Contact your processor and ask for instructions to complete your Self-Assessment Questionnaire. Once completed, verify that the non-compliance fee has been removed from your next statement.
Step 2: Ask for a Fee Reduction
Call your processor and request a reduction in your monthly PCI compliance fee. If you are paying more than $6.95/month, you have grounds to negotiate.
What to say: *"I have completed my PCI compliance. I see that I am being charged [amount] per month for PCI. I have received quotes from other processors that include PCI compliance at no charge. Can you match that or reduce my fee?"*
Step 3: Request the Annual Fee Be Waived
If you are paying an annual PCI fee on top of a monthly fee, request that the annual fee be waived entirely. There is no justification for paying both.
Step 4: Get It in Writing
As with any rate negotiation, confirm the changes in writing before your next billing cycle. Check your next statement to make sure the adjustments are reflected.
When PCI Fees Signal a Bigger Problem
If your processor is padding PCI fees, they are likely padding other areas too — your monthly merchant service fee and other processing charges deserve the same scrutiny. PCI fee inflation is often a symptom of an overall overpriced processing agreement, with padded payment processing costs hiding across the statement. It is worth reviewing your entire statement for other hidden markups.
Read our guide on how to read your merchant statement for a section-by-section breakdown of what to look for.
The Bottom Line
PCI compliance fees are negotiable, and in many cases they can be reduced or eliminated. Add up your total PCI compliance costs for the year — monthly fees, annual fees, and any non-compliance penalties — and you will often find hundreds of dollars worth of room to negotiate, on top of any room to negotiate elsewhere in your credit card merchant charges. The key is knowing what is legitimate, what is inflated, and what your processor is really charging for. Do not accept a $20+/month PCI fee as "the cost of doing business" — it is not.
Not sure if your PCI fees are fair? Upload your statement for a free analysis, or estimate your all-in rate with our processing fee calculator. We will flag every inflated charge — PCI fees included — and show you how to get them reduced.