Understanding PCI Compliance for Small Businesses

PCI DSS (Payment Card Industry Data Security Standard) compliance is a requirement for every business that accepts credit card payments. Despite this, many small business owners are unfamiliar with PCI requirements — and many are paying non-compliance fees without even knowing it.

What Is PCI DSS?

PCI DSS is a set of security standards created by the major card networks (Visa, Mastercard, Discover, American Express, and JCB) to protect cardholder data. Compliance is mandatory for all merchants, regardless of size.

PCI Compliance Levels

Merchants are classified into four levels based on annual transaction volume:

• Level 4: Under 20,000 ecommerce transactions or up to 1 million total transactions per year (most small businesses)
• Level 3: 20,000 to 1 million ecommerce transactions per year
• Level 2: 1 to 6 million transactions per year
• Level 1: Over 6 million transactions per year

What Small Businesses Need to Do

Most small businesses fall into Level 4 and are required to complete an annual Self-Assessment Questionnaire (SAQ) and maintain a secure processing environment. The SAQ asks about your payment setup, data storage practices, network security, and access controls.

The Cost of Non-Compliance

Processors charge a monthly PCI non-compliance fee — typically $19.95 to $99.95 — if you have not completed your annual SAQ. This fee continues every month until you complete the questionnaire. Over a year, that is $240 to $1,200 in unnecessary fees.

Steps to Achieve Compliance

1. Identify which SAQ applies to your business (your processor can help)
2. Complete the questionnaire online through your processor's PCI portal
3. Ensure your POS equipment is up to date with the latest security patches
4. Never store cardholder data on paper or in unsecured digital files
5. Use a PCI-compliant payment gateway for ecommerce transactions

Mogil Partners helps clients navigate PCI compliance and eliminate non-compliance fees as part of our comprehensive cost-saving analysis.