The PCI fee on your statement, and what you are actually paying for

The line reads PCI compliance fee. £15 a month, every month, and nobody in the building can say what it buys.

It is one of the few charges on a merchant statement that is not a payment cost at all. It is an administration charge attached to a security programme, and whether you should be paying it depends on things your provider already knows and has never asked you about.

What PCI actually is, and who decides you have to do it

PCI DSS is a card industry security standard, written by the PCI Security Standards Council, which is owned by the card brands.

The Council writes the standard. It does not police you. Its merchant guidance is explicit that the card brands, not the Council, decide who has to prove compliance and how, and that a merchant should contact their acquirer or payment brand to find out what applies. So the obligation reaches you through your provider, and your provider is also the party billing you monthly in connection with it.

Worth sitting with. The same company tells you the rule applies, sells you the service for meeting it, and bills you monthly whether you use it or not.

The fee is not the compliance

This is the part that catches people.

Paying the PCI fee does not make you compliant. Compliance is a questionnaire you fill in, plus, for some businesses, a network scan. The fee covers the portal you fill it in on, a reminder email, and someone to ring if you get stuck.

If you never complete the questionnaire you are not compliant, and most contracts then apply a second and higher charge on top of the first. Check your own terms for that one. The amount varies by provider and is rarely published.

Market figures come from Merchant Savvy's card processing fees guide, last updated 6 October 2025. It puts the PCI compliance charge at typically £5 to £20 a month, with its provider table running from £4.99 to £25. That guide also prices the authorisation fee at 0p to 4.5p per transaction, with Worldpay and Barclaycard at the top of that range, and terminal rental at £14 to £35 a month per device. We went through how those stack up in the first piece in this series.

Which questionnaire you actually need

There is no single PCI questionnaire. There are several, and which one applies is decided by how card data reaches your provider. The Council publishes the full list. The short version for a hospitality venue:

• SAQ B covers imprint machines and standalone dial out terminals with no electronic cardholder data storage. There is a separate version of it for standalone approved terminals connected to the processor over IP, which is what most venues now run.
• SAQ C covers payment application systems connected to the internet with no cardholder data storage. A till that takes payment itself usually lands here.
• A shorter questionnaire exists for terminals inside a validated point to point encryption solution listed by the Council. Fewer questions, because the hardware does the work.
• SAQ D is the catch all for anyone who does not fit the others. It is by far the longest.

Now the trap. SAQ A is the short one everybody has heard of, and almost no venue is eligible for it. Its published eligibility criteria require a merchant to accept only card not present transactions, meaning ecommerce or mail and telephone order, with everything outsourced. The document states plainly that it does not apply to face to face channels.

If you have a card machine on your bar, SAQ A is not your form. Venues are handed it anyway, complete it quickly, and are recorded as compliant against criteria they do not meet.

One date worth knowing. The Council published the questionnaires for version 4.0.1 on 15 October 2024, and version 4.0 was retired on 31 December 2024. If your provider's portal is still serving the older forms, that is a fair thing to ask about.

What it costs over a year

Take the fee on its own, with no rate and no transaction volume involved.

• At £5 a month, the bottom of the published range: £60 a year
• At £15 a month, a common middle figure: £180 a year
• At £25 a month, the top of that table: £300 a year

It is a fixed cost. It does not fall when trade is quiet, so as a share of a bad January it is at its largest in the month you can least afford it.

It also sits alongside the other fixed line, terminal rental, at a reported £14 to £35 a month per device. Two rented terminals at the bottom of that range plus a £15 PCI fee comes to £516 a year before a single card has been tapped. None of it shows up in the percentage you were quoted, which is the argument we made on interchange plus against blended pricing.

What removing the fee does not fix

Plenty. Worth being straight about it.

It does not remove the obligation. If your provider charges nothing for PCI, you still have to complete the questionnaire. The standard applies either way.

It does not secure anything by itself. Compliance is a floor, and a completed form is not the same as a secure venue.

It does not make a bad rate good. A provider charging no PCI fee and a poor processing rate is still the more expensive provider. Only the total matters.

And it does not answer the scan question. Depending on how your systems connect you may need an approved scanning vendor for quarterly network scans, charged separately.

Four things to check on your own statement

1. Is there a PCI compliance fee, and what is the monthly figure?
2. Is there a separate and higher non compliance charge sitting behind it in the contract?
3. Which questionnaire have you been asked to complete, and does the way you take payments actually match its eligibility criteria?
4. Is anything else being charged in the same area, such as a scan fee or a portal subscription?

If any of those is hard to find, ask in writing. A provider quoting honestly will put it in an email.

Where we sit, stated plainly

We charge no PCI compliance fee. There is no terminal rental and no subscription on the terminal, because the card machine is free, so there is nothing to rent. Hardware and installation cost nothing and there is nothing to pay upfront.

We do charge an authorisation fee. It is priced per contract rather than published, and there are other contract terms that are not on this website. In an article about a fee nobody explains, it would be poor form to hide one of our own.

What we commit to is that your rate and every fee attached to it are quoted in writing before you agree to anything, and every product and module price we charge is published in full.

Common questions

Do you have to pay for PCI compliance?

You have to be PCI compliant. You do not automatically have to pay a monthly fee for it. The fee is your provider's charge for administering the process, so whether it appears on your statement is a matter of that provider's pricing rather than of the standard. Completing the questionnaire is the obligation. The fee is a commercial arrangement on top of it.

What is the PCI fee on my card machine statement?

A monthly administration charge connected to the PCI DSS security programme, usually covering a compliance portal and support in completing your annual self assessment questionnaire. Published UK figures put it between roughly £5 and £25 a month. It is separate from your processing rate and is charged whether or not you use the portal.

Does having a card machine make you PCI compliant?

No. Approved terminal hardware makes compliance simpler and can put you on a shorter questionnaire, but the merchant still has to complete and submit a self assessment. The Council's own guidance is that even a listed point to point encryption solution reduces the requirements that apply but does not remove them.

Which is the point of reading your own statement rather than the quote. Put your figures through the savings calculator and see what the fixed lines cost you before the percentage is even applied.