What PCI DSS is
PCI DSS is the card industry's security standard for handling cardholder data. It is enforced through the card networks and your processing agreement rather than by a government agency.
Compliance is an ongoing operational practice, not a one-time form, though the annual attestation is how it is documented.
Who has to comply
Every merchant that accepts card payments does, regardless of size. What changes with size and channel is the validation path: most small merchants complete a self-assessment questionnaire and, where applicable, a network scan.
The questionnaire you complete depends on how you take payments: a standalone terminal, an integrated POS system, an e-commerce checkout or a mix.
Reducing your scope
The most effective compliance strategy is to store as little cardholder data as possible. Modern terminals and gateways use encryption and tokenization so that usable card data never sits inside your systems.
Use validated devices
Point-to-point encryption keeps card data out of your local network.
Never store full card numbers
No spreadsheets, order notes, email threads or paper files containing full PANs.
Segment your network
Keep payment devices off shared guest Wi-Fi and separate from general office traffic.
Control access
Unique logins per employee, no shared credentials, and removal of access when staff leave.
Practical annual routine
Complete the questionnaire, change default device and router passwords, confirm software is current, and keep the attestation on file with your provider.
Many non-compliance charges on statements are simply an unfinished questionnaire rather than a security failure.
Frequently asked questions
Do I need PCI compliance if I only take a few cards a month?
Yes. The obligation applies to any merchant accepting cards, though the validation requirements are lighter at low volume.
What is the PCI non-compliance fee on my statement?
It is typically a monthly charge applied while your attestation is outstanding. It generally stops once the questionnaire is completed and filed.
Does using a modern terminal make me compliant?
It reduces scope significantly but does not remove the obligation to validate annually.
Can BSV help with the questionnaire?
Yes. A specialist can walk through which questionnaire applies to your setup and what evidence is needed.
Want a second opinion on your setup?
Tell us how you take payments today and a BSV Solution specialist will walk through the options with you. Eligibility and processor selection are reviewed individually, subject to underwriting approval.