PCI Compliance Isn't Optional, Even for a One-Location Shop

It’s a contract obligation, not a law

Every business that accepts card payments is required to be PCI DSS compliant. That requirement doesn’t come from Congress or Sacramento, it comes from the card brands, Visa, Mastercard, Amex, Discover, through the PCI Security Standards Council they created, and it reaches you because your merchant agreement with your acquirer or processor says you have to maintain it. Skip it, and the consequence isn’t a government fine, it’s your processor charging you and, eventually, the card brands coming after your acquirer, who passes that cost straight to you.

That’s a different animal from California’s SB446 breach-notification law, which actually is a statute with its own separate deadline and disclosure requirements, or the PCI DSS v4.0.1 technical rules for online ordering pages we’ve covered before. This is about the baseline obligation underneath all of it: you have to be compliant, period, whether you’ve ever thought about it or not.

How much you actually have to do

Your obligations scale with how many transactions you process. Most small merchants fall into what the card brands call Level 4, and in practice that usually means filling out an annual Self-Assessment Questionnaire, or SAQ, rather than hiring an outside auditor. Which specific SAQ type applies to you depends on how you take payments: a fully hosted online checkout page is a different category than a countertop terminal, which is different again from a card-on-file system integrated into your own website. Your processor assigns the SAQ type, so if you’ve never seen one, ask them which one applies to you.

Do you actually need quarterly scans

This is where a lot of merchants get it wrong in both directions. The quarterly external vulnerability scan requirement, run by an Approved Scanning Vendor, doesn’t apply to every merchant, but it applies to more merchants than people assume. Under the current standard, even merchants using a fully outsourced, hosted checkout page are now required to run these scans on their own public-facing systems, which is a change from the older rules many business owners still have in their heads. The real exemption is narrow: a business with no internet-connected system anywhere in its card-payment environment, like a standalone terminal that only dials out over a phone line, genuinely has nothing to scan. The moment you add an internet-connected terminal, a router handling card traffic, or an online ordering page, you’re back in scope. If you’re not sure which category you’re in, that’s a five-minute question for your processor, and worth asking before you assume you’re exempt.

What non-compliance actually costs

Processors typically charge an ongoing non-compliance fee once you fall out of your required validation, commonly somewhere in the range of $20 to $250 a month, and that figure tends to climb the longer it goes unresolved. That’s the manageable part. The bigger exposure shows up if you’re actually breached: card-brand assessments levied against your account to cover fraud losses and investigation costs can run into the tens of thousands of dollars even for a small operation, layered on top of whatever you’re already paying to deal with the breach itself.

Your cyber insurance policy may be checking too

Insurers have been tightening how they underwrite and pay out on cyber policies, and PCI compliance status is increasingly part of that picture. The clearest real-world example is P.F. Chang’s China Bistro’s dispute with its insurer, Federal Insurance, after a 2014 breach. The insurer paid roughly $2 million for direct breach-response costs but denied about $2 million in PCI-related card-brand assessments, and a court sided with the insurer based on that specific policy’s language. The lesson isn’t that insurance is worthless here, it’s that you need to actually read what your policy covers before you assume a breach means a check is coming for everything.

What to do about it

A short list that covers most of the baseline, no matter how small you are:

• Use PCI-validated hardware, ideally with point-to-point encryption, so card data is encrypted before it ever touches your network.
• Never store card numbers yourself. Let your processor or terminal tokenize everything.
• Keep your POS software and terminal firmware updated, and change default passwords on any networked equipment.
• Keep your payment network separate from guest wifi or any other open network in your business.
• Complete whatever SAQ your processor assigns you, every year, instead of assuming last year’s answer still applies.
• Ask your processor directly whether quarterly ASV scans apply to your specific setup, rather than guessing based on your business size.

If your current hardware is old enough that you’re not sure it’s still PCI-validated, our hardware page is a good place to check what’s current, and you can always reach out if you want to walk through your specific setup.

This is general information about payment-industry contractual requirements, not legal advice. If you’re dealing with an active compliance dispute or a breach, talk to an attorney who handles this.

Sources: PCI Security Standards Council guidance via Schellman and the Token Vault / PCI Proxy blog, Otava and LBMC on the contractual nature of PCI DSS, Cybersierra and Security Boulevard on non-compliance fee ranges, The National Law Review and Perkins Coie on cyber-insurance treatment of PCI assessments.