What PCI DSS is
PCI DSS stands for the Payment Card Industry Data Security Standard. It is a set of security rules for card data.
It is written by the PCI Security Standards Council. The Council describes itself as “a global forum for the ongoing development, enhancement, storage, dissemination and implementation of security standards for account data protection.”
It says PCI DSS “provides a baseline of technical and operational requirements designed to protect payment account data.”
Who it applies to. The Council says it applies to everyone who stores, processes or sends cardholder data, “including merchants, processors, acquirers, issuers, and service providers.”
Your contract usually says so too. TD’s terms say: “You will comply with the Payment Card Industry Data Security Standard.” They also say the merchant is responsible for any outside company it lets handle card data, including its point of sale software.
Why there is a fee at all
A PCI fee is a charge set by your processor. It is not set by the card networks. Amounts vary a lot. Two published examples:
| Processor | PCI fee | Where it is listed |
|---|---|---|
| TD Merchant Solutions | $0 to $29.85 a quarter, per location (“Quarterly PCI Fee”) | TD fee descriptions |
| Helcim | $0, “Annual compliance self assessment” | Helcim pricing page |
TD’s sample statement shows the fee as a monthly line called “PCI security monthly fee”, at $9.95 in the sample.
Ask your processor what the fee pays for.
The non-compliance penalty
There are two different things people call “non-compliance fees”. They are easy to mix up.
1. Card network non-compliance fees. These come from the card networks when a sale breaks one of their rules. TD’s fee list shows examples, charged per sale:
| Fee on TD’s list | Amount | What triggers it, in TD’s words |
|---|---|---|
| Visa Domestic Compliance Integrity Fee | $0.15 | “each authorization attempt following a declined transaction”, or manipulated data in a retry |
| Visa Foreign Compliance | $0.38 | The same, for cross-border sales |
| Mastercard Compliance Integrity Fee | $0.74 | A “Nominal Amount Authorization”: an authorization for one full unit of currency, reversed afterwards, used to check the card |
| Mastercard Card-Not-Present (CNP) Advice Decline Fee | $0.78 | “multiple authorization attempts” after a declined response |
| Mastercard CNP Decline Fee | $0.03 | Card-not-present decline codes linked to Mastercard’s Authorization Optimizer Service |
TD’s fee list charges these each time a declined card is tried again.
TD also posted a notice that some card network fees now carry HST that TD cannot recover, after changes to the Excise Tax Act. TD says it passes a matching increase on to these non-compliance fees.
2. PCI non-compliance fees. These relate to PCI DSS, the card industry’s data security standard. A published PCI non-compliance fee amount was not on the processor pages we read.
TD’s terms cover both. They define a “Fine” as “any fine, fee, non-compliance fee, penalty or other type of assessment, including those imposed by a Payment Card Network or under PCI DSS”, and say the merchant agrees to pay any Fine.
How to become compliant
The PCI Security Standards Council publishes the standard and its documents in its document library, along with guides for small merchants.
Helcim’s pricing page describes its PCI step as an “Annual compliance self assessment”. A self-assessment is a questionnaire about how you take and store card data. The PCI Security Standards Council calls it a Self-Assessment Questionnaire, or SAQ. Its small merchant guide says small merchants “may be familiar with validating their PCI DSS compliance via a Self-Assessment Questionnaire (SAQ).”
There are several SAQs. Each one starts with a list of conditions a merchant must meet to use it. Here is a short summary of the conditions in the version 4.0 forms (April 2022) we read:
| SAQ | Who it is written for, in short |
|---|---|
| SAQ A | Online, mail or phone sales only, with all card handling outsourced to a PCI DSS compliant company. No card data stored, processed or sent on your own systems. Online, the whole payment page comes from that company. |
| SAQ B | Only an imprint machine or standalone dial-out terminals on a phone line, not connected to the internet or other systems. No card data stored electronically. |
| SAQ B-IP | Only standalone, PCI-approved terminals connected to the processor over the internet (IP), not connected to other systems and not relying on another device such as a phone or tablet. No card data stored electronically. |
| SAQ C-VT | Only a virtual terminal (a web page hosted by a PCI DSS compliant provider, where you key in card details) on one computer, in one place, with no card reader attached. |
| SAQ P2PE | Only terminals from a validated, PCI-listed point-to-point encryption (P2PE) solution. P2PE means the card data is scrambled from the moment the card is read. |
| SAQ D for Merchants | Everyone who can self-assess but does not meet the conditions of any other SAQ. The form’s examples include websites that take card data themselves and businesses that store card data electronically. |
In every one of these forms except SAQ D, any card data kept must be on paper only, such as printed receipts, and not received electronically. The forms also say that if they do not cover your setup, that may mean the form is not the right one for you.
The forms refer to “payment brands and acquirers” (the card networks and your processor’s bank) as the organizations that manage compliance programs.
Questions a processor can answer:
- Which PCI form do I need to fill in, and where?
- Do I need a network scan?
- What happens to my fees if I do not complete it?
When non-compliance fees can be removed
For card network fees, TD’s list ties each fee to a cause, such as retrying a declined card. Stopping the cause stops the fee.
For a PCI non-compliance fee, the processor’s terms set the rules. TD’s terms say merchants pay any Fine imposed by a card network or under PCI DSS.
Where to go from here
On a statement, PCI and non-compliance charges usually have “PCI” or “non-compliance” in the name. Each one is either a processor fee or a card network fee. How to Read Your Merchant Statement shows where the account fees sit, and Processor Markup covers the other fees your processor sets.
Want a partner to review your statement? We will put you in touch. Start the free statement review.