What Is PCI Compliance? Do You Need It?

By GoPayhawk Editorial Team  ·  Reviewed by Travis Lastra  ·  January 1, 2023

If you accept credit or debit cards, PCI compliance is not optional — it is a contractual obligation baked into your merchant agreement with the card networks. Most small business owners know they are supposed to be compliant but are not sure exactly what that means in practice, which parts their processor handles, and what the non-compliance fee on their monthly statement is actually for. This guide covers all of it plainly.

What Is PCI Compliance?

PCI compliance refers to adherence to the Payment Card Industry Data Security Standard (PCI DSS) — a set of 12 security requirements that every business accepting card payments must meet to protect cardholder data from theft and fraud.

The standard is maintained by the PCI Security Standards Council, established by Visa, Mastercard, Amex, Discover, and JCB. It applies to any organization that stores, processes, or transmits card data — from a solo freelancer to a Fortune 500 retailer. "Compliant" means you have assessed your environment against the 12 requirements, documented the results in an annual Self-Assessment Questionnaire (SAQ), and implemented the required controls.

Being PCI compliant does not guarantee that a breach cannot occur — but it significantly reduces your risk, and it dramatically reduces your liability if one does.

Do You Need to Be PCI Compliant?

Yes — if you accept card payments. There are no small business exceptions. A sole proprietor running $2,000/month on a card reader has the same PCI obligation as a mid-sized retail chain, though the level of assessment required scales with your transaction volume (covered in the next section).

The good news: most businesses working with a reputable merchant services provider are already largely compliant because the provider handles the technical infrastructure — certified terminals, encrypted transmission, tokenization. The annual SAQ is the piece most merchants skip, and the resulting non-compliance fee on your merchant statement is entirely avoidable.

The other good news: using a processor that supports tokenization and end-to-end encryption (like GoPayhawk does) reduces your PCI "scope" significantly — meaning fewer of the 12 requirements actually apply to your direct environment.

PCI Merchant Compliance Levels

The PCI Security Standards Council segments merchants into four compliance levels based on annual transaction volume. Your level determines which assessment method is required:

Almost all small and medium businesses fall into Level 4. The annual SAQ for most Level 4 merchants takes 30–60 minutes to complete through your processor's compliance portal. It is the single most important action you can take to eliminate the non-compliance fee from your monthly statement.

The 12 PCI DSS Security Standards

The 12 requirements are organized into six control objectives. Here is what each standard requires in practical terms:

1. Install and maintain a firewall: Restrict inbound and outbound traffic to and from your cardholder data environment. Most modern routers include firewall capability — the key is having it enabled and configured correctly, not left on default settings.
2. Change all default passwords: Vendor-supplied default usernames and passwords (like "admin/admin") must be changed before deploying any system. Default credentials are the first thing attackers try.
3. Protect stored cardholder data: If you store card data, it must be encrypted. You must never store CVV codes or full magnetic stripe data after authorization. If you do not store card data (which tokenization enables), this requirement is substantially reduced.
4. Encrypt data in transit: All cardholder data transmitted across public networks must be encrypted using TLS (Transport Layer Security). Never transmit card numbers in plain text.
5. Use and maintain anti-virus software: Deploy anti-malware protection on all systems that could be exposed to malware. Keep it updated and actively running — not just installed.
6. Develop and maintain secure systems: Apply security patches to operating systems and applications within a defined timeframe. Payment terminals must have current firmware. Unpatched systems are among the most common breach entry points.
7. Restrict access to cardholder data by business need: Only give employees access to cardholder data if their job requires it. Use role-based access control and document who has access to what.
8. Assign a unique ID to each person with computer access: Do not allow shared user accounts. Each person should have their own login so you can track exactly who accessed what data and when.
9. Restrict physical access: Prevent unauthorized individuals from accessing physical hardware that stores or processes cardholder data. This includes locking server rooms, securing terminals to prevent tampering, and using security cameras where warranted.
10. Track and monitor all access to network resources and cardholder data: Maintain audit logs that capture who accessed what and when. Logs must be retained for at least one year, with three months immediately available for review.
11. Regularly test security systems and processes: Run quarterly vulnerability scans (for Level 1–3 merchants, by an Approved Scanning Vendor). Conduct annual penetration testing. Test your intrusion detection systems regularly.
12. Maintain an information security policy: Document your security policies in writing. All staff must be trained on these policies annually. The policy must cover passwords, acceptable use, incident response, and data handling procedures.

Which SAQ Type Applies to You?

The self-assessment questionnaire comes in several versions. Using the correct one is important — the wrong SAQ either overburdens you with requirements you do not need, or understates what you are required to assess. Your processor can confirm which SAQ applies to your setup.

Scope Reduction: How Tokenization Simplifies Compliance

One of the most practical things you can do to simplify PCI compliance is reduce your "cardholder data environment" (CDE) — the systems and networks that touch, store, or transmit actual card data. Fewer systems in scope means fewer requirements to assess.

The two technologies that reduce scope most significantly are:

• Tokenization: When your terminal or gateway tokenizes card data at the point of capture, the real card number is replaced with a randomly generated token that has no value if intercepted. Your systems never receive or store a real card number — only the token. Systems that only handle tokens are generally excluded from your CDE, dramatically reducing the number of requirements that apply.
• Point-to-Point Encryption (P2PE): Card data is encrypted from the moment the card is swiped or dipped, before it even reaches your POS software. If your business uses a P2PE-validated solution, your CDE may be reduced to just the physical terminal itself — and SAQ P2PE (a much simpler questionnaire) may apply.

GoPayhawk's processing infrastructure supports tokenization for all merchants. If you are on a more complex setup and want to explore P2PE options for maximum scope reduction, ask your account manager.

Consequences of Non-Compliance

The consequences of PCI non-compliance fall into two categories: the ongoing fees you pay while non-compliant, and the catastrophic costs you incur if a breach occurs while you are out of compliance.

Ongoing non-compliance costs:

• Monthly non-compliance fee: $20–$50/month from your processor — $240 to $600 per year for a fee that disappears the moment you complete your SAQ
• Potential for higher processing rates at contract renewal if your account shows extended non-compliance history

Breach-related costs (if non-compliant when a breach occurs):

• Full liability for all fraud losses on compromised cards
• Cost of card reissuance paid to the issuing banks
• Forensic investigation costs to determine the scope of the breach
• Card network fines up to $100,000 per month during the period of non-compliance
• Loss of your ability to accept cards — revocation by Visa and Mastercard

Compliant merchants still face post-breach investigations and potential costs, but compliance demonstrates due diligence and limits exposure significantly.

Common PCI Compliance Mistakes

Most small business PCI failures are not complex security failures — they are simple oversights:

• Skipping the annual SAQ entirely. The most common cause of the non-compliance fee. The SAQ takes 30–60 minutes for most small businesses and costs nothing to complete through your processor's portal.
• Using shared login credentials. If multiple employees use the same username and password, you cannot track who accessed what — which violates Requirement 8 and makes investigation after an incident nearly impossible.
• Writing card numbers on paper or in spreadsheets. Storing card data outside your payment system in any form — a notepad, a spreadsheet, an email — is a PCI violation even if your terminal and gateway are fully compliant.
• Using outdated terminal firmware. Unpatched payment terminals with known security vulnerabilities are a common breach entry point. Check for firmware updates on your terminals at least quarterly.
• Leaving remote access enabled unnecessarily. Many POS systems are configured with remote desktop or VPN access for technical support. When not actively in use, these access points should be disabled — open remote access is a primary attack vector for card skimming malware.
• Assuming your processor's compliance covers everything. Your processor's certification covers their infrastructure, not your local environment. Your network, hardware, staff credentials, and data handling practices are your responsibility.

GoPayhawk and PCI Compliance: Who Handles What

Non-compliance fees are one of several avoidable processing costs most merchants pay without realizing it. The fastest way to make compliance feel manageable is to understand exactly who is responsible for what:

How to Get Compliant Today

For most Level 4 small businesses, getting compliant is a straightforward process that takes less than an hour:

1. Log into your processor's compliance portal. GoPayhawk merchants access this through their account portal. If you are not sure where to find it, ask your account manager.
2. Identify your SAQ type. Your processor or account manager can tell you which questionnaire applies to your setup. For most retail merchants with IP-connected terminals, this is SAQ B-IP.
3. Complete the SAQ. Answer each question honestly based on your actual environment. Most questions for SAQ B-IP and SAQ A are yes/no and take only a few seconds each.
4. Remediate any gaps. If you answer "no" to a requirement, it means you need to implement that control. Your account manager can advise on straightforward fixes — most gaps for small businesses are simple (change a default password, enable a firewall, create a written password policy).
5. Submit the completed SAQ. Once submitted, your non-compliance fee is removed from your next statement. Your compliance status resets annually.
6. Schedule a reminder for next year. Set a calendar reminder 11 months out to repeat the process before your compliance lapses.

Frequently Asked Questions