PCI Compliance for Small Business: What It Is and What It Should Cost
If you take credit cards, you're required to protect card data. That's PCI compliance. It sounds technical, but for most small businesses it comes down to a short questionnaire and a few good habits.
What PCI compliance is
The Payment Card Industry Data Security Standard (PCI DSS) is a set of security rules created by the major card brands. Every business that accepts cards has to follow it.
How small businesses stay compliant
- Complete the Self-Assessment Questionnaire (SAQ). It asks how you take cards and store data. Most small shops using a modern terminal qualify for one of the shorter versions.
- Run network scans if required. Some businesses need a quarterly scan of their network.
- Renew every year. PCI compliance isn't one and done.
The fees to watch for
- PCI compliance fee. A monthly or yearly charge from the processor.
- PCI non-compliance fee. A monthly penalty if your questionnaire isn't on file. It's one of the most common hidden fees on statements, and some owners pay it for months without noticing.
- Breach protection fees. Sometimes sold as add-on insurance.
Check your statement for any of these. Our list of hidden credit card fees shows what they're usually called.
Simple habits that keep card data safe
- Use an up-to-date EMV chip and tap terminal like the Valor VL550
- Never write down or store full card numbers
- Change default passwords on your terminal, POS and Wi-Fi
- Keep your payment devices on a separate network from guest Wi-Fi
- Limit who can issue refunds
- Watch for fake "technicians" who want to swap your terminal
Wholesale Payments and its reps will never ask for your online banking password or a verification code. If anyone does, hang up and call your processor using the number on your statement.
Get help with your questionnaire
Not sure if you're compliant, or seeing a PCI fee you don't understand? Ask your processor. Most offer the questionnaire online and can walk you through it.
Frequently asked questions
Is PCI compliance required for small businesses?
Yes. Any business that accepts credit or debit cards must follow PCI DSS. For most small businesses that means a yearly self-assessment questionnaire and good security habits.
What is a PCI non-compliance fee?
A monthly penalty some processors charge when your PCI questionnaire isn't on file. Completing the questionnaire usually stops it.
How do I know if I'm paying PCI fees?
Look in the fees section of your merchant statement for lines like PCI, compliance, non-compliance or breach protection. Your processor can tell you what each one is for.
Questions about your own setup? Text Tyler.
General information only, not legal, tax or financial advice. Card network rules and state laws change, so confirm current rules before you change your pricing.
