Why it is called PCI compliance
PCI compliance is the everyday phrase for following the Payment Card Industry Data Security Standard, or PCI DSS. Businesses, payment providers, and security teams use it to describe whether a business meets the standard and completes the required validation. The phrase emphasizes the act of meeting requirements, while PCI DSS names the standard itself.
You may see “PCI compliance” in a processor's compliance portal, a validation request, or a monthly non-compliance fee on your statement. That fee is not a card-network interchange charge. As of 2026, PCI DSS v4.0.1 is the current version, and processors commonly bill a monthly fee when a merchant has not validated compliance. Your payment setup determines which requirements apply. The rest of this page explains PCI DSS, the primary term.
What PCI DSS is
PCI DSS stands for Payment Card Industry Data Security Standard. It sets technical and operational requirements to protect payment account data. The standard applies to any entity that stores, processes, or transmits cardholder data, including businesses that outsource payment processing.
The requirements cover 12 areas grouped into six goals: secure networks, protect card data, manage vulnerabilities, control access, monitor and test systems, and maintain an information security policy. Examples include using unique user IDs, restricting access by business need, tracking access to card data, and encrypting data sent across public networks.
Outsourcing card processing can reduce your PCI scope, but it does not erase your responsibility to validate compliance.
How your payment setup affects the work
Your responsibilities depend on how card data reaches your payment provider. If your systems store, process, or transmit the data, those systems are in scope. Using a hosted payment page or tokenized fields can reduce which parts of your environment touch card data, but does not automatically remove your validation duties.
If you outsource all payment processing and do not handle cardholder data yourself, many technical requirements may not apply directly to your environment. You still need to validate your compliance, understand the division of responsibilities, keep a written agreement that assigns the provider’s responsibilities under Requirement 12.8.2, and monitor the provider’s compliance at least annually under Requirement 12.8.4. Merchants commonly complete a Self-Assessment Questionnaire, or SAQ, to validate.
What it means for your costs
PCI DSS does not set one standard fee for merchants. Your acquiring bank or payment provider can bill a recurring PCI non-compliance fee if you miss required validation, such as an SAQ deadline. The charge is tied to your account terms and can continue each billing cycle until you submit the required proof.
A PCI fee on your statement does not prove that your business is compliant. Separate a charge for compliance services from a non-compliance charge, then confirm what action and documentation the charge relates to. Completing validation does not guarantee security, but an uncompleted form can cost you even when no data breach has occurred.
What changed in the current standard
PCI DSS v4.0.1 is the current version as of 2026. The 51 future-dated requirements from v4.0 became mandatory on March 31, 2025. They include controls for scripts on e-commerce payment pages, under Requirements 6.4.3 and 11.6.1, and multi-factor authentication for all access into the cardholder data environment.
If your checkout page loads payment scripts, or staff and vendors can access systems that handle card data, confirm that those systems and access paths are covered by your validation. These details matter even when a third party hosts your checkout.
What you can actually change
- Identify your scope. Map where card data enters, moves through, or is stored in your business. Ask your payment provider to document which requirements it handles and which remain yours.
- Complete validation. Find the required SAQ and due date for your payment setup. Submit the completed validation and any required scans or attestations to the organization managing your compliance program.
- Review the fee line. Look for PCI compliance or PCI non-compliance charges on your processing statement. Match each charge to a service or an outstanding validation requirement, and check that it stops after you submit proof.
- Reduce card-data exposure. Use hosted payment fields or tokenization where they fit your checkout. They can reduce the systems in scope, but you must still complete the validation required for your setup.
Frequently asked questions
Is PCI compliance the same as PCI DSS?
PCI compliance describes meeting the requirements; PCI DSS is the standard that defines them. People commonly use “PCI compliance” as shorthand for PCI DSS compliance.
Does a PCI compliance fee mean my business is compliant?
No. A monthly PCI non-compliance fee commonly appears when a merchant has not validated compliance. Look for the fee description and your validation status in the processor's compliance portal.