Common pitfalls and official sources
PCI compliance fees and non-compliance fees: what Canadian small merchants pay and why
Why processors charge PCI programme and non-compliance fees, what PCI DSS validation means for a small business, how to stop a non-compliance fee, and PIPEDA links.
PCI DSS (the Payment Card Industry Data Security Standard) is the security standard set by the PCI Security Standards Council, which card networks require every business that accepts cards to follow. Many Canadian processors charge a PCI programme fee (monthly or yearly) for tools that help small merchants validate compliance, and a separate, higher PCI non-compliance fee every month until the merchant completes its annual validation, usually a self-assessment questionnaire (SAQ) and sometimes network vulnerability scans. The non-compliance fee is usually avoidable: complete the validation and keep proof. PCI DSS is an industry standard, not a Canadian law, but card data is also personal information protected by PIPEDA or provincial privacy laws.
This guide is part of the pitfalls and official sources section. Fee amounts are illustrative.
The two fees, side by side
| Fee | What it is for | Typical form (illustrative) | Avoidable? |
|---|---|---|---|
| PCI programme / compliance fee | Access to a validation portal, scanning tools, sometimes breach coverage | $5 to $15 a month, or a yearly fee | Depends on processor; negotiate or compare |
| PCI non-compliance fee | Charged when validation is not completed or has lapsed | $20 to $50 a month | Yes, by completing validation |
Both must be listed in the processor's disclosure of fees under the Code of Conduct, and a new or increased fee requires 30 to 60 days' notice. See merchant rights under the Code.
Worked example: what a missed questionnaire costs
Illustrative café paying a $10 monthly PCI programme fee and a $30 monthly non-compliance fee because nobody completed the SAQ after account opening.
- Year one: (10 + 30) × 12 = $480.
- After completing the SAQ (about an hour for a simple set-up): 10 × 12 = $120 a year.
- Avoidable cost: $360 a year.
On a café with $15,000 of monthly card sales, that $360 is 0.2% of annual card sales, enough to erase much of the saving from a lower rate.
What validation means for a small business
The SAQ you complete depends on how you accept cards:
| How you accept cards | Usual direction (check with your processor) |
|---|---|
| Standalone terminal connected to the processor, no card data stored | A short questionnaire for terminal-only merchants |
| Online, with a hosted payment page or redirect (card data never touches your site) | A short questionnaire for fully outsourced e-commerce |
| Online, with card data entering your own web pages or servers | A longer questionnaire; possibly vulnerability scans |
| POS system integrated with payments | Depends on whether the solution is validated and how it handles card data |
| Storing card numbers yourself | Much wider obligations; usually best avoided |
PCI DSS is updated from time to time (v4.0.1, published in June 2024, replaced v4.0 at the end of 2024 and its future-dated requirements became mandatory on 31 March 2025; check the PCI SSC document library for the current version and questionnaires). Your processor's PCI portal usually guides you to the right SAQ.
Steps to stop a non-compliance fee
- Find the PCI fee lines on your statement.
- Log in to the processor's PCI portal (or ask for access).
- Answer the questions that determine your SAQ type.
- Complete the SAQ honestly; fix anything you answer "no" to.
- Run any required scans.
- Submit and keep a copy with the date.
- Check the next statement: the non-compliance fee should stop. If not, ask in writing.
- Diary the annual renewal date.
Practical security for small merchants
- Never write down or store full card numbers or security codes, including on paper order forms.
- Do not take card numbers by email or text.
- Use tokenisation and hosted payment pages online.
- Keep terminals secure: inspect for tampering, keep software up to date, and use only devices supplied by your processor.
- Change default passwords on POS, routers and admin accounts; use multi-factor authentication.
- Separate networks: keep payment devices off guest Wi-Fi.
- Limit access: only staff who need it should see payment systems.
The Canadian Centre for Cyber Security publishes practical guidance for small organisations.
Privacy law: PIPEDA and card data
Card numbers and customer details are personal information. Under PIPEDA, private-sector organisations in most provinces must protect personal information with safeguards appropriate to its sensitivity, remain accountable for information they transfer to service providers, and report breaches of security safeguards that create a real risk of significant harm to the Office of the Privacy Commissioner and notify affected individuals. Quebec, Alberta and British Columbia have their own private-sector privacy laws for organisations in those provinces. Breach reporting duties apply whether or not you are PCI compliant.
What to do after a suspected breach
- Contact your processor immediately; follow its incident instructions.
- Preserve evidence; do not wipe devices.
- Assess whether there is a real risk of significant harm and report to the privacy commissioner and affected individuals as required.
- Report fraud to the Canadian Anti-Fraud Centre and police where appropriate.
- Get professional help for forensic work if required by your processor.
FAQ
Is a PCI programme fee mandatory?
It depends on the processor's pricing. It is a processor fee, not a government charge. Compare it across quotes and ask whether it can be waived.
I only use a mobile reader. Do I still need to validate?
Every merchant accepting cards is expected to comply with PCI DSS, but validation for a simple set-up can be short. Some all-in-one providers handle validation for small merchants; ask.
Does PCI compliance protect me from chargebacks?
No. PCI concerns card data security. Chargebacks are a separate process; see chargebacks and dispute fees.
Sources
- PCI Security Standards Council — PCI DSS and self-assessment questionnaires
- Office of the Privacy Commissioner of Canada — PIPEDA safeguards and breach reporting
- Canadian Centre for Cyber Security — guidance for small businesses
- Financial Consumer Agency of Canada — fee disclosure under the Code
- Canadian Anti-Fraud Centre — fraud reporting
