Also called: PCI SSC, Payment Card Industry Security Standards Council
What PCI Security Standards Council is
The PCI Security Standards Council (PCI SSC) is an industry organization that develops and maintains standards for protecting payment-card data. American Express, Discover, JCB International, Mastercard, and Visa founded it in 2006. Its best-known standard is the PCI Data Security Standard (PCI DSS), which sets technical and operational requirements for protecting payment account data.
PCI SSC writes the standards and provides guidance. It is not your payment processor, does not set your processing rates, and does not determine the amount of a PCI fee on your bill. Card-network programs and your payment relationships establish how your business must validate compliance.
PCI SSC sets the security baseline; it does not set your processor's monthly PCI fee.
How the standards apply to your business
PCI DSS applies to organizations that store, process, or transmit cardholder data or sensitive authentication data, and to systems that can affect the security of the cardholder data environment. That includes merchants, even when you accept cards only through a terminal or online checkout.
Other PCI SSC standards cover specific tools and roles. Point-to-Point Encryption (P2PE) addresses protection of card data from the point of acceptance toward your processor or acquirer. Separate standards address payment software, PIN devices, and 3-D Secure. The relevant requirements depend on how your business handles card data.
Why it matters to your business
PCI SSC provides the security baseline, but your business is responsible for applying the requirements that match its payment environment. Most small merchants can validate through an applicable Self-Assessment Questionnaire (SAQ); the right questionnaire depends on how card data enters and moves through your systems.
The current PCI DSS version is v4.0.1. The 51 future-dated requirements in PCI DSS v4.0 became mandatory on March 31, 2025. They include controls for payment-page scripts and multi-factor authentication for access into the cardholder data environment. For an online business, missing a required script control can leave checkout exposed to tampering.
What PCI SSC means for your costs
PCI SSC does not publish a merchant fee schedule or bill you a card-processing fee. Your processor or other payment provider sets any compliance-related charge. Processors commonly bill a monthly PCI non-compliance fee when a merchant has not validated compliance, so a charge on your processing bill is not a fee paid to the Council.
The practical cost issue is whether you have completed the validation your payment relationship requires. Identify the exact fee name and amount on your statement, then compare the charge with your current validation status. Do not treat a monthly fee as proof that your systems meet PCI DSS requirements.
What you can actually change
- Map your data flow. List each place card data is entered, stored, or sent, including terminals, online checkout, and staff systems. That determines which PCI DSS requirements and validation questionnaire apply.
- Complete the right validation. Use the SAQ that matches how your business accepts and handles card data. Keep the completed questionnaire and any required supporting validation records with your compliance files.
- Review fee details. Find any PCI or non-compliance charge on your processing statement and record its amount and billing frequency. Compare it with your validation status and the fee terms in your processing agreement.
- Check online controls. If you take payments online, confirm your checkout follows the applicable payment-page script requirements, including PCI DSS controls 6.4.3 and 11.6.1.
Frequently asked questions
Does PCI SSC enforce PCI compliance?
PCI SSC develops and maintains the standards. Card-network programs enforce compliance requirements through payment relationships, including acquirers and processors. The Council itself does not audit every merchant or issue your processing bill.
Does PCI SSC charge merchants a compliance fee?
PCI SSC does not set a merchant processing fee. A processor may bill a monthly PCI non-compliance fee when your business has not validated compliance. The amount and fee name are set by the provider, not by the Council.
What is the difference between PCI SSC and PCI DSS?
PCI SSC is the organization that develops and maintains payment security standards. PCI DSS is one of those standards, with technical and operational requirements for protecting payment account data. The current PCI DSS version is v4.0.1.
Do small businesses need to follow PCI DSS?
PCI DSS applies to entities that store, process, or transmit cardholder data, including merchants. Most small merchants can use an applicable self-assessment questionnaire to validate their compliance, based on how they handle payment data.