PCI compliance for small business comes down to two jobs: protect card data every day, and prove it once a year, usually by filling out a self-assessment questionnaire (SAQ) your processor asks for. If you take cards on modern chip and tap terminals and never write down or store card numbers, most of the work is already done; the part owners skip is the paperwork, and that is what triggers monthly PCI non-compliance fees. This guide explains what PCI DSS 4.0.1 is, how to find your merchant level and SAQ, and gives you a plain-English checklist to get and stay compliant.
Key takeaways
- Every business that accepts cards agrees to follow the Payment Card Industry Data Security Standard (PCI DSS) in its merchant agreement. Size changes how you prove it, not whether it applies.
- The current version is PCI DSS v4.0.1. Version 4.0 was retired at the end of 2024, and the remaining "future-dated" requirements became mandatory on March 31, 2025.
- Most small merchants are Level 4 and validate with an annual SAQ. Which SAQ depends on how you take cards, not on your industry.
- A PCI non-compliance fee on your statement almost always means a questionnaire or scan was never submitted. Finishing it usually stops the fee.
- The less card data your systems touch, the smaller your PCI job. Chip, tap, encryption and hosted checkout pages do most of the heavy lifting.
What PCI compliance means for a small business
PCI DSS is a security standard written by the PCI Security Standards Council, which was founded by the major card brands. It is not a federal law. You are bound by it because your merchant agreement with your processor says so, and the card networks enforce it through the banks that sponsor your account (your acquirer).
In practice, PCI compliance asks you to do two things:
- Follow the security requirements that apply to the way you take cards: secure equipment, controlled access, no storing of sensitive card data, and a plan for when something goes wrong.
- Validate that you are following them, on the schedule your acquirer sets. For most small businesses that means an annual SAQ and, depending on your setup, quarterly external vulnerability scans run by an Approved Scanning Vendor (ASV).
The standard has twelve high-level requirements, but a coffee shop with two tap terminals does not answer the same questions as an online store running its own checkout code, which is why picking the right SAQ matters.
PCI DSS 4.0.1: what changed and what it means for you
The Council published PCI DSS v4.0 in March 2022 and released a limited revision, v4.0.1, in June 2024. Version 4.0 was retired on December 31, 2024, so v4.0.1 is the version your questionnaire is measured against today. Dozens of requirements were introduced as "future-dated" best practices and became mandatory on March 31, 2025, so there is no longer a grace period for any of them.
For a typical small merchant, the changes that come up most often are:
- Stronger logins. Longer passwords for system accounts and multi-factor authentication for access to systems that handle card data. Shared "front counter" passwords that never change are a problem.
- Payment page security for online sellers. Two requirements (6.4.3 and 11.6.1) target malicious scripts on checkout pages, the kind of "skimming" code that copies card numbers as customers type them.
The SAQ A change for online sellers
If you sell online and send customers to a payment page fully hosted by your provider, or use an embedded payment form (iframe) from them, you may qualify for SAQ A, the shortest questionnaire. In January 2025 the Council revised SAQ A for v4.0.1: merchants using it no longer have to meet requirements 6.4.3 and 11.6.1 directly, but they must confirm that their site is not susceptible to attacks from malicious scripts that could affect their e-commerce systems. If you can't confirm that, you need a longer SAQ such as A-EP or D.
Looking ahead: the Council collected industry feedback on the current standard in mid-2026, and in August 2026 it revised an FAQ to remind merchants to confirm their validation and reporting requirements with their acquirer. Nothing about the next version changes your obligations today: your next questionnaire is still measured against v4.0.1.
Find your PCI merchant level
Your merchant level is based on how many card transactions you process per year, counted per card brand. It decides how you must prove compliance. Visa and Mastercard use closely aligned levels; Mastercard's definitions are summarized below.
| Level | Annual transactions (per brand) | How you usually validate |
|---|---|---|
| Level 1 | More than 6 million | Annual on-site assessment and Report on Compliance (ROC) |
| Level 2 | 1 million to 6 million | Annual SAQ (some SAQ types require a qualified assessor to be involved) |
| Level 3 | 20,000 to 1 million e-commerce transactions | Annual SAQ |
| Level 4 | Everyone else (most small businesses) | Annual SAQ, as required by your acquirer |
Most auto repair shops, cafés, restaurants, boutiques and single-store retailers are Level 4. Level 4 merchants still have to comply; the card brands simply leave it to your acquirer to collect the proof.
Which SAQ fits the way you take cards?
The SAQ you complete is set by your payment setup. Here are the common ones, in plain English:
| SAQ | Who it is for |
|---|---|
| A | Online or phone/mail-order sellers that fully outsource payment pages to a compliant provider. No in-person card acceptance. |
| A-EP | Online sellers whose own website controls part of the checkout, even though a provider processes the payment. |
| B | Imprint machines or standalone terminals on a phone line, not connected to the internet. |
| B-IP | Standalone, PCI-approved PIN terminals that connect to the processor over the internet, not to your other systems. |
| C-VT | Typing cards one at a time into a web-based virtual terminal on a dedicated computer. |
| C | An internet-connected POS or payment application that is isolated from your other systems. |
| P2PE | Only validated point-to-point encryption terminals listed by the PCI Council. |
| SPoC | A phone or tablet paired with a PCI-approved secure card reader. |
| D | Anything else, including businesses that store card data electronically. The longest questionnaire. |
If you take cards several ways, for example terminals in the shop plus an online store, you may need to cover each channel. Your processor or acquirer has the final word on which SAQ applies, so ask them in writing.
The small business PCI compliance checklist
It won't replace your actual questionnaire, but if you can check every line, the questionnaire will go quickly.
Cards and equipment
- ☐ Every terminal reads chip and tap, and you avoid keying cards when a card is present.
- ☐ Terminals came from your processor or a trusted source and are on the PCI-approved list. Ask about point-to-point encryption (P2PE).
- ☐ Staff check terminals for tampering, such as overlays, loose parts or extra cables, and you keep a list of devices with serial numbers.
- ☐ You never store the security code (CVV), PIN or full magnetic-stripe data, on paper or in any system.
- ☐ Card numbers are not written on work orders, sticky notes or in email. If a card must be kept on file, it is tokenized by your processor.
People and access
- ☐ Each person who uses the POS or merchant portal has their own login. No shared passwords.
- ☐ Default passwords on routers, POS systems and terminals are changed, and passwords are long.
- ☐ Multi-factor authentication is on for your merchant portal, POS back office and any remote access.
- ☐ Access is removed the day an employee leaves.
- ☐ Staff get a short yearly refresher on skimming, phishing and phone scams.
Network and online
- ☐ Payment devices are on a network separate from guest Wi-Fi.
- ☐ POS software, computers and routers get security updates promptly.
- ☐ If you sell online, checkout is hosted or embedded by your payment provider, and you know who manages your website's scripts.
- ☐ Quarterly ASV scans are scheduled and passing, if your SAQ requires them.
Paperwork
- ☐ You know your SAQ type and the date your annual validation is due.
- ☐ You have a list of the outside companies that handle card data for you, such as your processor, gateway or online store, and confirmation that each is PCI compliant.
- ☐ You have a one-page incident plan: who to call (your processor first), what to unplug and how to preserve evidence.
- ☐ Last year's questionnaire and attestation are saved where you can find them.
PCI non-compliance fees, fines and real costs
Look at your merchant statement for lines like "PCI non-compliance," "PCI non-validation" or "PCI program fee." They are not the same thing:
- PCI program or compliance fees are what some processors charge for their compliance portal, scanning tools or support. Whether that's worth paying is a pricing question you can negotiate.
- PCI non-compliance fees are monthly penalties for not validating. There is no standard amount; each processor sets its own, and ranges from roughly $10 to $300 a month have been reported. Submitting your SAQ and any required scans normally ends the charge.
- Card-brand fines and breach costs are the real risk. If card data is stolen, the networks can assess fines and costs against your acquirer, which are typically passed to you, along with forensic investigation and card reissuance costs.
Our guide to reading a merchant statement shows where these fees usually appear, and credit card processing fees explained covers which charges are set by the networks and which are set by your processor.
A note for Colorado businesses
Colorado adds its own rules on top of PCI. State law requires businesses that maintain personal information, which includes a card number together with its security code, to keep reasonable security procedures suited to the size of the business. If a breach occurs, affected Colorado residents generally must be notified no later than 30 days after you determine a breach happened, and the Attorney General must also be notified if 500 or more residents are affected. A PCI-compliant setup that never stores card data is the simplest way to stay out of that situation.
How to make PCI easier (and cheaper)
The single best way to shrink your PCI workload is to keep card data off your systems entirely. That is called reducing scope, and small businesses have more options than ever:
- Encrypted terminals. P2PE or encrypting terminals mean card data is scrambled from the moment it's read, which can qualify you for a much shorter SAQ.
- Tokenization. Cards on file, recurring payments and deposits are stored by your processor as tokens, so your system never holds the real number.
- Hosted checkout and payment links. Text-to-pay and hosted pages let customers pay remotely without your staff ever hearing or typing a card number.
- Pay-at-the-counter or pay-at-the-table devices. The card stays in the customer's hand, which also cuts fraud disputes. See what is a chargeback for why chip and tap reads matter when a dispute arrives.
- A processor that helps. Good providers tell you which SAQ you need, pre-fill what they can and remind you before the deadline. If yours only bills you a fee, that's worth weighing when you choose a merchant services provider.
We set up merchants on secure, EMV and contactless terminals, payment links and hosted checkout designed to keep card data out of your systems. If you're seeing PCI fees on your statement and aren't sure why, send us a recent statement for a free review and we'll explain what each line means and what it would take to remove it.
Frequently asked questions
Is PCI compliance required by law?
PCI DSS is not a federal law. It is a security standard that Visa, Mastercard, American Express, Discover and JCB require through your merchant agreement, so any business that accepts cards has agreed to follow it. Separately, state laws such as Colorado's data security and breach notification statutes can apply if card data is compromised.
How much does PCI compliance cost a small business?
For most small, card-present businesses using modern terminals, the direct cost is low: an annual questionnaire, sometimes quarterly network scans, and any PCI program fee your processor charges. Costs rise if you store card data, run your own payment page or need outside assessors. Not completing the questionnaire usually costs more, because processors charge monthly non-compliance fees.
What is a PCI non-compliance fee?
It is a monthly charge many processors add when you have not validated PCI compliance, usually because the annual self-assessment questionnaire was not completed. Amounts are set by each processor and vary widely. Completing and submitting the questionnaire, plus any required scans, typically removes the fee going forward.
Which SAQ do I need?
It depends on how you take cards. Fully outsourced online checkout may qualify for SAQ A, standalone internet-connected terminals often use SAQ B-IP, validated point-to-point encryption terminals use SAQ P2PE, and businesses that store card data or accept it directly on their own website usually need SAQ D. Your processor or acquirer confirms which one applies.
Do I need to be PCI compliant if I use Square, Stripe or another payment company?
Yes. Using a compliant provider reduces how much of the standard applies to you, often a great deal, but it does not remove your responsibility. You still need to protect any devices, staff logins and paper records that touch card data, and you may still need to complete a questionnaire.
Sources and further reading
- PCI Security Standards Council: PCI DSS v4.0.1 published (v4.0 retirement date)
- PCI Security Standards Council: Future-dated requirements effective March 31, 2025
- PCI Security Standards Council: Bulletin on revised FAQ 1331 (August 2026)
- Mastercard: Site Data Protection program and merchant levels
- Akamai: PCI DSS v4.0.1 changes to qualify for SAQ A
- C.R.S. § 6-1-713.5: Colorado protection of personal identifying information
This article is general information, not legal or compliance advice. Confirm your validation requirements with your acquirer.