PCI Compliance for Small Businesses: A Plain-English Guide (v4.0.1)

The short answer: every business that accepts cards has to follow the Payment Card Industry Data Security Standard (PCI DSS). Most small businesses prove it once a year by completing a Self-Assessment Questionnaire (SAQ) and, if they have internet-facing systems in scope, passing quarterly vulnerability scans. PCI DSS v4.0.1 is now the only version in use, and skipping the paperwork usually means a monthly “PCI non-compliance” fee on your statement.

We see that fee on a large share of the Orange County statements we review — often for years, on businesses that could remove it with an hour of work. Here’s what small businesses need to know.

What Is PCI DSS?

PCI DSS is a set of security requirements created by the major card brands and maintained by the PCI Security Standards Council. It covers how card data is handled, stored, and transmitted. It isn’t a law, but your merchant agreement requires you to follow it. If card data is stolen from a non-compliant business, the costs can include fines, forensic investigations, and card-replacement charges.

What Changed With PCI DSS v4.0.1?

Version 4.0.1 replaced the older 3.2.1 standard, and the new requirements that were phased in became mandatory on March 31, 2025. The changes small businesses notice most:

• Stronger passwords — generally at least 12 characters, mixing letters and numbers, for systems in scope.
• Multi-factor authentication for access to systems that handle card data, not just remote administrator access.
• Payment-page script controls for ecommerce sites that host or embed their payment page.
• A narrower SAQ A. In January 2025 the Council updated SAQ A for online merchants who fully outsource their payment page. Those merchants must now confirm their site is protected against malicious-script attacks to qualify.

Which SAQ Do You Need?

Your SAQ depends on how you take cards, not your industry. The most common ones for small businesses:

• SAQ A — online only, with the entire payment page hosted by a third party (a hosted checkout or redirect). The shortest questionnaire.
• SAQ A-EP — online, where your website affects the payment page but doesn’t receive card data directly.
• SAQ B or B-IP — standalone terminals that connect by phone line or the internet, with no electronic card storage.
• SAQ P2PE — terminals using a validated point-to-point encryption solution. Often the simplest option for in-person businesses.
• SAQ C or C-VT — POS systems connected to the internet, or virtual terminals keyed on a computer.
• SAQ D — everything else, including businesses that store card data. Hundreds of questions — a sign to change your setup.

What Should a Small Business Actually Do?

1. Find out which SAQ applies by mapping how card data moves through your business — terminals, POS, website, phone orders.
2. Reduce your scope. Encrypted terminals, hosted payment pages, and tokenized card-on-file storage shrink the questionnaire and the risk.
3. Never write down or store full card numbers — no notepads for phone orders, no card numbers in email, no spreadsheets.
4. Use unique logins, strong passwords, and MFA on your POS, gateway, and any computer used for payments.
5. Complete the SAQ through your processor’s PCI portal each year, and run any required scans.
6. Check your next statement to make sure the non-compliance fee is gone.

How Much Does Non-Compliance Cost?

The most visible cost is the monthly non-compliance fee many processors charge until you complete your SAQ. That’s money spent for nothing. The bigger risk is a breach: a business found non-compliant after card data is stolen can face card-brand assessments, forensic investigation costs, and the cost of reissued cards. For a small business, that can be existential.

If you’re not sure whether you’re paying a PCI fee, our guide to reading your merchant statement shows where to look.

Frequently Asked Questions

Do small businesses really have to be PCI compliant?

Yes. Every business that accepts card payments must comply with PCI DSS under its merchant agreement. Most small businesses demonstrate compliance with an annual Self-Assessment Questionnaire.

Why am I paying a PCI non-compliance fee?

Usually because your annual questionnaire wasn’t completed or recorded in your processor’s portal. Completing it typically stops the fee from the next billing cycle.

Does using Square or Stripe make me PCI compliant?

Using a compliant provider reduces your scope, but it doesn’t remove your responsibility. You’re still responsible for how card data is handled in your business, and your provider may still require attestation.

Can DL Payments help with PCI?

Yes. We help our merchants pick equipment and gateways that reduce PCI scope, find the right SAQ, and get it completed — and we make sure the non-compliance fee comes off your statement.

Sources: Akamai — PCI DSS v4.0.1 SAQ A changes · Beancount — PCI DSS 4.0.1 for small merchants (2026)