PCI Compliance Cost: Ranges by Level, SAQ, and ROC

PCI compliance costs a small e-commerce merchant on SAQ A about $2,700 to $16,000 in the first year, a Level 2 merchant validating SAQ D with a Qualified Security Assessor (QSA) about $94,000 to $350,000, and a Level 1 merchant with a Report on Compliance (ROC) about $325,000 to $1.27 million, in BD Emerson planning ranges as of October 2026. Later years run lower because remediation is a one-time cost. Remediation and tooling make up about half of the year-one midpoint for the SAQ D merchant and 58 percent for the Level 1 merchant, so the size of your cardholder data environment (CDE), more than the assessor's fee, decides what you pay.

The ranges cover the costs PCI DSS v4.0.1 creates: scoping and gap assessment, remediation, QSA fees, Approved Scanning Vendor (ASV) scans, internal vulnerability scans, penetration and segmentation tests, security tooling, and training and policy work. They exclude processing fees and your staff's time. BD Emerson is not a QSA company or an ASV and does not sign Reports on Compliance, so the QSA and ASV lines are fees you pay those firms; our work sits in the scoping, remediation, evidence preparation, and penetration and segmentation testing lines. If you have not confirmed your merchant level or SAQ type, start with our guide to PCI compliance levels and SAQ types.

How much does PCI compliance cost by level and SAQ?

Your validation path sets the cost tier, and the path follows from your merchant level and how you accept cards. These three profiles span the common paths. Each range is a BD Emerson planning range, and the drivers in the sections below move a merchant within it.

The middle row includes a QSA fee because Mastercard requires a Level 2 merchant completing SAQ A, SAQ A-EP, or SAQ D to have a QSA or an Internal Security Assessor (ISA) validate it. A Level 3 merchant on SAQ D can self-assess and drops the $15,000 to $40,000 QSA line. The SAQ A range assumes outside help with scoping and the questionnaire; a merchant that answers SAQ A on its own pays mainly for quarterly ASV scans and its processor's PCI program fee.

PCI compliance cost by component

Eight components make up the total, and each traces to specific PCI DSS v4.0.1 requirements. The year-one ranges below use the same three profiles, and the totals match the table above.

The testing lines match our penetration testing cost ranges, where an external network test runs $4,000 to $15,000 and an internal network test $8,000 to $30,000, and PCI scope adds application-layer testing of the CDE and segmentation testing. Requirement 11.4.4 requires you to correct exploitable findings and repeat the test to verify the fixes, so buy the retest with the test. Internal and external tests answer different questions, as our guide to internal vs external penetration testing explains. A service provider that relies on segmentation must test it every six months under 11.4.6, which doubles the segmentation part of the line.

What moves PCI compliance cost within each range

Five drivers move a merchant from the bottom of a range to the top: the number of systems in scope, the number of payment channels and locations, stored card data, the state of existing controls, and how much work you buy from outside firms.

Scope is the largest. PCI SSC's scoping and segmentation guidance sorts systems into three categories: CDE systems, systems connected to or able to affect the security of the CDE, and out-of-scope systems. Each system in the first two needs hardening, logging, scanning, and evidence, and the QSA samples from them. The same guidance calls segmentation optional and says it can reduce both the scope and the cost of the assessment, so segmentation design belongs in the gap assessment.

Channels and locations multiply the work. A merchant with e-commerce, a call center, and 40 stores has three data flows to map and test, and its QSA samples stores. Stored card data brings Requirement 3's encryption controls and puts the database in the CDE. Existing controls cut remediation: a company that already runs MFA, central logging, and quarterly scanning for SOC 2 or ISO 27001 can reuse much of that evidence. Managed services shift cost between lines: a managed logging service replaces staff time, which these ranges exclude, with a tooling fee they include.

What the March 31, 2025 requirements added to PCI cost

The requirements that became mandatory on March 31, 2025 added recurring tooling and testing costs, and most of that cost lands on SAQ D merchants and service providers. PCI DSS v4.0 introduced 64 new requirements, and 51 of them were future-dated to March 31, 2025. Version 4.0.1, published on June 11, 2024, added or deleted none, and v4.0 retired on December 31, 2024. The PCI SSC summary of changes lists each one; these are the additions that move budgets.

For a mid-size SAQ D merchant, BD Emerson plans $10,000 to $40,000 a year for these additions, most of it in log review automation, payment page script controls, and MFA. SAQ A merchants avoided most of the new cost. PCI SSC's January 30, 2025 revision of SAQ A removed 6.4.3, 11.6.1, and the supporting 12.3.1 analysis and replaced them with an eligibility criterion that the merchant's site is not susceptible to script attacks. FAQ 1588 applies that criterion only to merchants that embed a provider's iframe, which meet it with their own script controls or with confirmation from their PCI DSS compliant provider.

How scope reduction cuts PCI compliance cost

Taking card data off your systems is the largest cost lever in PCI DSS, because each requirement that no longer applies is a control you stop building, testing, and evidencing. Four methods do most of the work.

A hosted payment page keeps card data off your web servers, and a checkout that redirects to the processor's page, or embeds its iframe, can qualify you for SAQ A. Tokenization takes stored card numbers out of your database. PCI SSC's tokenization guidelines say systems that hold only tokens can fall outside scope when they are segmented from the tokenization system and cannot retrieve card numbers, while the token vault and any de-tokenization function stay in scope.

Point-to-point encryption (P2PE) does the same for card-present payments. Terminals from a PCI-listed P2PE solution encrypt card data at the reader, which qualifies a merchant for SAQ P2PE and can support a validation waiver from Visa or Mastercard. Outsourcing to a compliant processor removes whole channels, for example when a call center moves card entry to the processor's virtual terminal or automated phone payment service, provided the processor's AOC covers the service you use.

Worked example: a Level 2 retailer moves from SAQ D to SAQ A

Take an online retailer with about 1.5 million Visa and 600,000 Mastercard e-commerce transactions a year. Visa rates it Level 2. Its Mastercard volume alone would make it Level 3, but Mastercard also classes as Level 2 any merchant that meets Visa's Level 2 criteria. Its checkout posts card data to its own servers and it stores card numbers for repeat orders, so it validates with SAQ D, and Mastercard requires a QSA or ISA to validate that SAQ. The retailer moves to its processor's hosted payment page with a full redirect and replaces stored card numbers with the processor's tokens. Its systems no longer touch card data, so it qualifies for SAQ A, and as a Level 2 merchant it still needs a QSA or ISA to validate that SAQ A, which BD Emerson plans at $5,000 to $12,000.

The arithmetic: $130,000 minus $11,850 is a saving of $118,150 a year. BD Emerson plans $30,000 to $80,000 for the one-time move, which covers integrating the hosted page, migrating stored cards to tokens, deleting the old card data, and re-scoping. At the $55,000 midpoint, payback is $55,000 divided by $118,150, or 0.47 years, which is under six months.

Three assumptions hold the example together. The processor's hosted page and tokens add no fee to the retailer's pricing; if they do, subtract that fee from the saving. The retailer keeps its quarterly ASV scans, because FAQ 1604 confirms they apply to SAQ A merchants whose pages redirect to a provider. The retailer drops penetration testing only because SAQ A does not include Requirement 11.4; an annual web application test is still worth budgeting when customers or insurers ask for one, and our penetration testing services scope that test to the risk.

What does PCI non-compliance cost?

Non-compliance costs come in three layers: fees from your acquirer, card brand assessments that reach you through your acquirer, and the cost of a breach.

Acquirer fees come first. Acquirers and processors can charge a PCI program fee and, separately, a non-compliance fee when you miss validation. Wells Fargo Merchant Services, for example, lists a PCI Compliance Program fee of $10.00 per month per merchant ID and states that PCI non-compliance fees apply to Level 3 and Level 4 merchants with 1 to 25 merchant IDs, without listing the amount on its pricing page. Your merchant agreement's fee schedule has your number.

Card brand assessments come second. PCI SSC imposes no consequences for non-compliance; the brands do, and they assess the acquirer. The August 4, 2026 edition of Mastercard's Security Rules and Procedures sets noncompliance assessments, in Table 2.2, of up to USD 25,000 for a Level 1 or Level 2 merchant's first violation in a calendar year, USD 50,000 for the second, USD 100,000 for the third, and USD 200,000 for the fourth. Level 3 merchants face up to USD 10,000 for a first violation, rising to USD 80,000 for a fourth. Visa states that the issuer or acquirer pays any assessment Visa levies. Whether your acquirer passes an assessment through to you is a term of your merchant agreement, so read its fines and indemnification sections.

A breach is the largest layer. IBM's Cost of a Data Breach Report 2026, researched by the Ponemon Institute across 602 organizations that had breaches between March 2025 and February 2026, puts the global average breach at $4.99 million, with financial services at $6.3 million. A compromise also raises your PCI costs: Mastercard can designate a merchant with a confirmed account data compromise as Level 1, which moves a self-assessed merchant to a ROC, and its rules require the acquirer to make sure a forensic investigation takes place.

How to budget PCI compliance in year one and later years

Budget year one as a project with a fixed scope date and later years as an operating cost, because remediation and most of the scoping effort happen once. BD Emerson sequences a first-year budget in five steps:

1. Fix scope before you buy anything. Map card data flows and decide on hosted payments, tokens, or P2PE first, because each of those changes the other lines.
2. Fund remediation from the gap assessment, and leave at least one quarter between the end of remediation and the validation date so new controls produce the logs, scan results, and review records an assessor samples.
3. Book the penetration test and segmentation test together, after remediation and before validation, with time for the retest that Requirement 11.4.4 requires.
4. Start ASV scans early. For a first assessment, the applicability notes to Requirement 11.3.2 accept a passing most recent scan, a documented quarterly scanning process, and rescans showing earlier findings fixed; from the second year, each quarter needs a passing scan.
5. Carry tooling, scanning, testing, training, and the QSA fee as annual operating lines. At the range midpoints, later years run at about 55 to 60 percent of year one for SAQ D and ROC programs.

For a program you already run, the annual question is whether scope has grown. Requirement 12.5.2 has merchants confirm scope every 12 months and after significant changes, and 12.5.2.1 has service providers do it every six months. A new acquisition, payment channel, or data store pushes a steady-state budget back toward year-one levels.

Frequently asked questions

How much does PCI compliance cost for a small business? A small business that takes cards through a processor's hosted payment page and qualifies for SAQ A spends about $2,700 to $16,000 in the first year and $1,700 to $8,000 a year after that, in BD Emerson planning ranges that assume outside help. Most of it goes to scoping help, one-time cleanup, and quarterly ASV scans, plus any monthly PCI program fee the processor charges.

How much does a QSA charge for a Report on Compliance? In BD Emerson planning ranges, a QSA's fee for a Level 1 Report on Compliance runs $50,000 to $200,000 a year. The fee moves with the number of in-scope systems the QSA samples, the number of locations and payment channels, and how well your evidence is organized before fieldwork. QSA validation of a Level 2 merchant's SAQ D runs $15,000 to $40,000.

What is a PCI non-compliance fee? A PCI non-compliance fee is a charge your acquirer or processor adds while your SAQ or ROC and AOC are overdue, and the amount is in your merchant agreement's fee schedule. It is separate from card brand assessments, which the brands levy on your acquirer. Mastercard's rules set those at up to USD 25,000 for a Level 1 or Level 2 merchant's first violation in a calendar year.

Does the PCI Security Standards Council fine merchants? No. The PCI SSC writes the standard and states in its FAQs that it does not impose any consequences for non-compliance. The card brands enforce compliance through their own programs and assess acquirers, and your merchant agreement decides whether the acquirer passes an assessment through to you. Mastercard publishes its assessment amounts in its Security Rules and Procedures.

How much does PCI scope reduction save? In BD Emerson's worked example, a Level 2 online retailer that moves from SAQ D to SAQ A with a hosted payment page and processor tokens cuts its annual PCI cost from about $130,000 to about $11,850, a saving of $118,150 a year. The one-time move costs $30,000 to $80,000 in our planning, so it pays back in under six months at the midpoint.

Do SAQ A merchants need penetration testing? PCI DSS does not require it. SAQ A excludes Requirement 11.4, so an SAQ A merchant has no annual penetration test or segmentation test to validate. SAQ A merchants do owe quarterly ASV scans of their e-commerce pages under Requirement 11.3.2, which PCI SSC confirmed in FAQ 1604. An annual web application test is still worth budgeting when customers or insurers ask for one.

If you are building a PCI budget or weighing a move to hosted payments or tokenization, our PCI DSS compliance team can scope your cardholder data environment, price the remediation, and prepare the SAQ or ROC evidence your QSA will test, so the number you take to finance matches your actual scope.