PCI Compliance
PCI compliance refers to meeting the security standards set by the Payment Card Industry Data Security Standard (PCI DSS). If your business accepts, processes, stores, or transmits credit card information, you're required to follow these standards. PCI compliance protects your customers' card data f
PCI Compliance Definition
PCI compliance refers to meeting the security standards set by the Payment Card Industry Data Security Standard (PCI DSS). If your business accepts, processes, stores, or transmits credit card information, you're required to follow these standards. PCI compliance protects your customers' card data from breaches and fraud.
PCI Compliance in Practice — Example
An online boutique processes about 500 credit card transactions per month through Shopify. To maintain PCI compliance, she uses Shopify's built-in payment processing (which handles most PCI requirements), ensures her website uses HTTPS, doesn't store card numbers in any spreadsheets or emails, and completes an annual Self-Assessment Questionnaire (SAQ). Her payment processor confirms her compliance status each year.
Why PCI Compliance Matters for Your Business
A data breach can destroy a small business. Beyond the direct costs of a breach — which average over $100,000 for small companies — you face potential fines from card networks, lawsuits from affected customers, and devastating reputational damage.
PCI compliance isn't just a checkbox — it's the minimum standard for protecting your customers and your business. Non-compliance can result in fines of $5,000 to $100,000 per month from card brands, and your payment processor can terminate your account entirely. Most small businesses achieve compliance easily by using reputable payment processors that handle the heavy lifting.
How PCI Compliance Works
PCI DSS has 12 core requirements organized into six categories:
| Category | Requirements |
|---|---|
| Build Secure Network | 1. Install firewalls 2. Change default passwords |
| Protect Cardholder Data | 3. Protect stored data 4. Encrypt transmissions |
| Manage Vulnerabilities | 5. Use antivirus 6. Maintain secure systems |
| Access Control | 7. Restrict data access 8. Authenticate users |
| Monitor & Test | 9. Restrict physical access 10. Track and log access |
| Security Policy | 11. Test systems regularly 12. Maintain security policy |
Your compliance level depends on transaction volume:
| Level | Annual Transactions | Requirement |
|---|---|---|
| Level 4 | Under 20,000 (e-commerce) | SAQ + quarterly scans |
| Level 3 | 20,000 – 1 million | SAQ + quarterly scans |
| Level 2 | 1 – 6 million | SAQ + quarterly scans |
| Level 1 | Over 6 million | Annual on-site audit |
PCI Compliance vs SOC 2
PCI compliance specifically covers credit card data security and is mandatory for any business accepting card payments. SOC 2 is a broader security framework for service organizations that covers data handling practices in general. A business might need both if it processes payments and provides SaaS services.
FAQ
Q: Do I need PCI compliance if I use a third-party payment processor?
A: Yes, but your scope is greatly reduced. Using processors like Stripe or Square means they handle most PCI requirements. You still need to complete an SAQ confirming you follow basic security practices.
Q: What happens if I'm not PCI compliant?
A: You risk fines from card networks ($5,000-$100,000/month), increased transaction fees, and potential loss of your ability to accept card payments. If a breach occurs, liability costs multiply.
Related Terms
> Need a business bank that actually makes sense? Holdings offers free checking, 1.75% APY, and AI-powered bookkeeping — all in one place. Open a free account →
Related Terms
Direct deposit is an electronic payment method that transfers funds directly from one bank account to another — most commonly used for payroll. Instead of issuing paper checks, employers deposit wages straight into employees' bank accounts via the Automated Clearing House (ACH) network. It's faster,
A service charge is a fee that a bank or financial institution charges for providing specific services or when your account doesn't meet certain requirements. Common service charges include monthly maintenance fees, overdraft fees, ATM fees, wire transfer fees, and minimum balance penalties. These f
A Treasury bill (T-bill) is a short-term debt security issued by the U.S. government with maturities of one year or less. T-bills are sold at a discount to face value and mature at par, with the difference representing the interest earned. They're considered one of the safest investments because the
Accrual accounting records revenue when it's earned and expenses when they're incurred, regardless of when cash actually changes hands. It's the standard method required by GAAP and gives a more accurate picture of a business's financial health than cash-basis accounting.