PCI compliance costs a US business anywhere from about $1,000 a year to well over $250,000, and the gap comes down to three things: how many card transactions you process, how much of your environment touches card data, and how ready you are when the assessment starts. Stripe's estimates put small businesses at $1,000 to $10,000 a year, midsize companies at $10,000 to $50,000 and large enterprises at $50,000 to $250,000. This guide shows what sits inside those numbers, which line items catch teams off guard, and how to cut scope before you cut corners.
TL;DR
- Annual cost scales with size: roughly $1,000 to $10,000 for small businesses, $10,000 to $50,000 for midsize and $50,000 to $250,000 for large enterprises, according to Stripe's published estimates.
- The assessment itself is only part of the bill. Scans, penetration tests, tools, training, remediation and internal staff time often add up to more than the assessor's invoice.
- Scope is the biggest lever you control. Fewer systems touching card data means a smaller assessment and fewer controls to run.
- The "PCI fee" on your merchant statement is a processor charge, not a government fine. A non-compliance fee is what you pay for not validating on time.
- A breach costs far more than compliance: forensic investigations alone can run $8,000 to $100,000 before card replacement and legal costs.
Table of Contents
- Who sets the price of PCI compliance
- PCI compliance cost by business size
- What a PCI audit or assessment costs
- The costs beyond the assessment
- What the PCI fee on your statement means
- What non-compliance really costs
- How to lower your PCI compliance cost
- A sample budget to adapt
- Perspective: how we see PCI budgets
- Getting help with PCI DSS
- FAQ
- Sources
Who sets the price of PCI compliance
There is no price list. The PCI Security Standards Council writes the standard, but it does not set what assessors charge, and it does not decide penalties. Payment brands and the banks that process your payments (your acquirer) set validation requirements and enforce them through your merchant agreement.
That means your cost is built from three separate pieces:
- What you spend on security and validation yourself: tools, scans, assessor fees, staff time.
- What your processor charges you: often a monthly or annual PCI program fee, plus a non-compliance fee if you have not validated.
- What you could owe if something goes wrong: investigation, penalties passed down by the acquirer, and contract consequences.
Most searches for "PCI compliance cost" mix these three together. Separating them is the first step to a real budget.
PCI compliance cost by business size
The table below combines the ranges published by Stripe. Treat them as planning ranges, not quotes: your acquirer and your actual card environment decide where you land.
| Business size | Typical annual cost | What usually drives it |
|---|---|---|
| Small business | $1,000 to $10,000 | Self-assessment questionnaire, quarterly scans, basic training |
| Midsize company | $10,000 to $50,000 | More systems in scope, assessor support, remediation |
| Large enterprise | $50,000 to $250,000 | Formal assessment, complex architecture, dedicated staff |
Other published guides stretch the top end much further for the largest merchants. One 2025 pricing guide puts small merchants at $1,000 to $5,000 a year and the biggest Level 1 organizations above $500,000. The spread is real: a coffee shop using a hosted payment terminal and a national retailer with its own card-processing stack are not buying the same thing.
Why merchant level matters
Your validation path depends on volume. Under Visa's program, Level 1 merchants, those processing 6 million or more Visa transactions a year, need a Report on Compliance completed by a Qualified Security Assessor, or by internal resources if a company officer signs it. Levels 2 and 3 use a Self-Assessment Questionnaire (SAQ). Level 4 uses an SAQ or another method defined by the acquirer.
Service providers have lower thresholds than merchants. Shuttle's 2026 report notes that Level 1 for a service provider can start at 300,000 transactions a year, which pulls many platforms into formal assessment sooner than they expect.
What a PCI audit or assessment costs
The assessment is the line item people ask about first, and it varies the most.
- Self-assessment (SAQ): if you can complete it yourself, the direct cost is mostly staff time. If you bring in a Qualified Security Assessor to help, Stripe reports the work may be time-and-materials or fixed fee up to $40,000, depending on the SAQ type.
- Report on Compliance (ROC): the same source puts formal ROC assessment fees at $30,000 to $200,000.
Assessors price on scope: how many systems, locations, applications and third parties they have to examine. A tight, well-documented environment is cheaper to assess than a sprawling one, regardless of the assessor's day rate.
The process itself follows a standard pattern. The PCI Council's QSA Program Guide describes it: understand your validation requirements, define your cardholder data environment scope, select a QSA if one applies, provide documentation, remediate gaps, and submit the completed ROC or SAQ to your acquirer or payment brands as directed. Every step in that chain has a cost, and the remediation step is the one with the widest range.
A waiver can reduce validation work
Visa's Technology Innovation Program lets eligible merchants skip the annual validation exercise when at least 75% of their transactions run through secure acceptance channels, such as EMV chip terminals or a PCI-validated point-to-point encryption solution. You still have to maintain PCI DSS compliance. You just don't have to submit the paperwork each year. Ask your acquirer whether you qualify.
The costs beyond the assessment
Businesses that budget only for the assessor are usually surprised by what comes next. Stripe lists the recurring items: quarterly vulnerability scans, annual penetration tests, security tools, employee training, internal labour and remediation of issues found in audits.
Internal time is the hidden expense
The same source notes that internal time spent preparing for the audit, collecting evidence and resolving findings is often the biggest hidden cost. Think about who actually does that work. If your head of engineering or your IT manager spends weeks pulling logs, writing policies and chasing vendors, that is salary you are already paying, and it is also work that does not ship.
A practical way to budget: count the people who will touch the audit, estimate their hours across the year, and price those hours at their loaded cost. Most small teams find the number is larger than the scan and tool subscriptions combined.
Remediation can be the biggest swing
Assessments find things. Unpatched systems, flat networks, weak access controls and missing logging all become tasks with a price. Our own write-up on the evidence auditors expect for PCI DSS requirements shows what documentation and proof to have ready, which is the cheapest way to avoid paying for rework. Your vulnerability handling matters too: a clear vulnerability remediation process keeps scan findings from piling up before the audit.
Standards changed, and so did the workload
PCI DSS v4.0.1 is the current version, and every requirement that was originally labelled "future-dated" became mandatory on March 31, 2025. That includes newer controls around payment page scripts, stronger access controls and authenticated vulnerability scanning. If your last budget predates that deadline, rebuild it. Newly mandatory controls translate into tools, configuration work and ongoing monitoring that older estimates leave out.
What the PCI fee on your statement means
Merchants searching for pricing often mean something simpler: the charge on their processor statement. There are two different items.
- A PCI program fee: a recurring charge for the processor's compliance package, which typically includes a questionnaire portal and scanning support.
- A non-compliance fee: a monthly charge applied if you have not validated in time.
Paya's support page gives a concrete example of how the structure works: the annual PCI-DSS fee covers the processor's PCI package, while a monthly non-compliance fee applies if a merchant has not become compliant within 60 days of approval, and continues until they do. Other processors set their own amounts and timelines, so read your merchant agreement and statement line by line.
Two practical points. First, a program fee does not make you compliant; it pays for tools to help you validate. Second, the non-compliance fee is cheap to end: complete and submit your questionnaire, and ask your processor to remove the charge.
What non-compliance really costs
There is no public schedule of non-compliance penalties. Whether charges reach your business depends on your agreement with your acquirer, which can pass along assessments from the payment brands. Forum posts quoting "up to $100,000 a month" describe the worst case for large merchants, not what most small businesses will see.
The breach scenario is the real exposure. Stripe's reporting puts PCI Forensic Investigator engagements after a breach at $8,000 to $100,000, excluding card replacement and legal settlements. A noncompliant business can also face legal exposure, reputational damage, insurance consequences, and an acquirer that suspends or terminates card processing if it deems you high-risk.
Storing card data you don't need makes every one of these worse. If you keep cards on file for repeat customers, it is worth understanding how card-on-file payments work for merchants and who holds the sensitive data, because that decision changes both your risk and your scope.
Insurance is part of the picture as well. Carriers increasingly ask for proof of controls such as MFA, endpoint detection and tested backups, which overlap heavily with PCI requirements. Our guide on how to qualify for US cyber insurance covers that evidence, so one body of work can support both.
How to lower your PCI compliance cost
Shrink the scope first
The biggest cost lever is not negotiating with the assessor. It is reducing the number of systems that touch card data. Every server, application, network segment and employee workstation in the cardholder data environment adds controls to implement and evidence to collect.
Practical ways to cut scope:
- Use hosted payment pages or tokenization so card numbers never reach your servers.
- Use validated point-to-point encryption terminals in stores.
- Segment your network so the card environment is isolated from the office network, email and general systems.
- Stop storing what you don't need. Data you never keep cannot be breached.
Your payment architecture decides how much of this is available. If you run a complex or high-risk online business, working out how your payment processing setup affects compliance early prevents expensive rebuilds later.
Automate recurring evidence
Scans, log retention, access reviews and configuration checks recur every quarter or year. Automating them turns a yearly scramble into steady background work. One vendor analysis claims automation can cut the annual engineering effort for the payment-page script requirements from 15 to 30 days down to 1 or 2 for a mid-market merchant, though that figure comes from a vendor selling such tools, so test it against your own environment before budgeting on it.
Ask your acquirer the right questions
Before you spend, ask:
- What is my merchant level, and which SAQ or report applies?
- What is the deadline, and what happens if I miss it?
- Am I eligible for any validation waiver based on my terminals or encryption?
- Which fees on my statement relate to PCI, and which can be removed once I validate?
Bundle where it makes sense
PCI work overlaps with other frameworks. Controls for access, logging, monitoring and incident response are shared with SOC 2 and ISO 27001. If you are weighing multiple frameworks, a SOC 2 readiness assessment and realistic ISO 27001 certification costs show where evidence can be reused instead of paid for twice.
A sample budget to adapt
Here is how a small online retailer on a hosted checkout might structure a first-year budget. The categories are the point; fill them with your own quotes.
| Line item | Where the number comes from |
|---|---|
| SAQ and processor PCI program fee | Your acquirer's agreement |
| Quarterly external vulnerability scans | Quote from an approved scanning provider |
| Annual penetration test, if required | Quote from a testing firm |
| Staff training | Provider quote or internal time |
| Security tools (endpoint, logging, MFA) | Subscription quotes |
| Internal labour | Hours multiplied by loaded hourly cost |
| Remediation reserve | Findings from your first gap review |
Add a reserve for remediation to your first year, because a first review nearly always finds something. Costs usually fall in later years as processes become routine.
Perspective: how we see PCI budgets
Most businesses we talk to treat PCI as a yearly purchase, then discover it is a year-round operating cost. The invoice for the assessment is the visible part. The expensive part is running security controls inconsistently across several vendors: one firm for scans, another for monitoring, a third for cloud, and nobody accountable when evidence is missing.
Our view is that consolidation lowers cost mainly by removing duplicate work. When monitoring, vulnerability management, cloud configuration and compliance evidence come from one team under one agreement, the audit becomes a report of things already being done rather than a project. That is why we offer fixed monthly pricing and a single point of accountability: the budget you approve in January should be the budget you spend in December.
Our advice for any buyer, whether or not they work with us: define scope before you request quotes, ask every provider what is included and what is billed separately, and treat remediation as part of the budget rather than a surprise.
— Nick - Sr. Executive
Getting help with PCI DSS
If your team lacks the time to run scans, monitoring, evidence collection and remediation alongside daily work, Nexus handles it as part of one managed program. We combine 24/7 security monitoring, cloud and network work, data protection and compliance assessments, including PCI-DSS, under a single agreement and a unified SLA. Pricing is not published, so talk to us about your cardholder environment and we will scope it with you.
FAQ
How much does PCI compliance cost for a small business?
Stripe's estimate for small businesses is $1,000 to $10,000 a year. Businesses that use a hosted checkout and can complete a short self-assessment usually sit at the low end. Costs rise when you store card data, run your own payment systems or need assessor support.
Is PCI compliance legally required in the US?
PCI DSS is a contractual requirement set through payment brands and your acquirer, not a federal law. In practice it is mandatory if you accept cards, because your merchant agreement requires you to maintain compliance and validate as your acquirer directs.
What is the difference between a PCI fee and a PCI non-compliance fee?
A PCI fee is usually a recurring charge for your processor's compliance program. A non-compliance fee is an extra monthly charge when you have not validated within the processor's deadline. Completing and submitting your questionnaire typically ends the second charge, though the terms depend on your agreement.
Does the PCI Council fine businesses?
No. The PCI Security Standards Council publishes the standard but does not set assessor prices or decide penalties. Payment brands and acquirers set validation rules and enforce them through merchant agreements.
How long does PCI compliance take?
A small merchant with a simple setup may finish a self-assessment in days or weeks. A formal assessment with remediation can take months, mostly because scoping, evidence collection and fixing findings take time. Start well before your acquirer's deadline.
Sources
- How Much Does PCI Compliance Cost for Businesses? (Stripe)
- How Much Does PCI DSS Compliance Cost? Pricing Guide
- Review PCI Data Security Essentials for Small Merchants (Visa)
- Technology Innovation Program Merchant PCI DSS Validation (Visa)
- PCI Compliance Cost for Platforms (Shuttle)
- QSA Program Guide v3.0 (PCI Security Standards Council)
- Annual Compliance Fee and PCI DSS Fee (Paya support)