PCI compliance for small retail is not a certificate on the wall. It is whether card numbers stay in a listed terminal, whether anyone writes a PAN in a notebook, and whether you complete the questionnaire your processor actually sends. We board stores on terminals that take the card path. We are not your QSA, and we cannot sign you off.
What PCI is asking a small store to do
The Payment Card Industry Data Security Standard is a baseline for anyone who stores, processes, or transmits cardholder data. The PCI Security Standards Council merchant pages (retrieved 2026-09-16 from pcisecuritystandards.org/merchants/) say it is intended for all such entities, including merchants, regardless of size. Small shops often have simpler environments. Size does not remove the standard.
What that means at a counter: do not keep full card numbers on paper, in a spreadsheet, in a camera photo of a receipt, or in a private email. The terminal and the processor are supposed to handle the number. If a cashier writes a card number to run later, you have taken the data out of the box that was built to hold it.
The Council’s own FAQ on that page says whether a small merchant must validate compliance is a payment-brand and acquirer question, not a Council waiver. Ask the processor who boards you. Do not treat a blog as a ruling.
What lives in the terminal versus what lives on you
A PCI-listed terminal that encrypts the card at the swipe, dip, or tap is doing the part you cannot do by policy. Your part is people and process: who can refund, who can see reports, whether remote support uses a shared password, whether the firmware is current, whether anyone stored a card number “just this once.”
The same merchant page lists the usual holes: malware, phishing, weak remote access, default passwords, unpatched software, and skimmers on the reader. Those are the Council’s published threat list that day. A store that never stores cards can still get hurt by a skimmer or a vendor login that never changed.
P2PE, when it is a PCI-listed solution, can reduce how many requirements apply. The Council’s FAQ says it does not remove PCI DSS from the merchant environment. Do not buy a “you are out of scope” story without reading that page.
Offline mode is a related risk: a terminal that stores transactions to settle later still has to protect those records. Our retail POS offline mode page is the outage walk, not a PCI letter.
The questionnaire, the scan, and who sends them
A Self-Assessment Questionnaire is the Council’s validation tool for SAQ-eligible merchants. There are several SAQs for different environments. Your processor or acquirer tells you which one you are in, and they are usually the ones who email it. An ASV scan, when it applies, is a quarterly external scan by an approved scanning vendor. Many counter stores on a standalone listed terminal are on a shorter path than an e-commerce shop that keys cards into a website.
We do not name your SAQ type from this page. Open the current processor portal and read the card brands’ own PCI pages. The Council’s merchant FAQ says to contact the payment brands for their programs.
Our published sample pricing (program page recorded in the claims ledger, 2026-08-21) lists a PCI non-compliance fee of $0.00 to $79.00, waived when the PCI checklist is completed. Sample pricing applies to new accounts applying directly. Pricing is subject to underwriting, MCC, and the merchant agreement. Rates may differ and are subject to change. That fee is a processor checklist reminder, not a Council fine schedule. Do not treat $79 as “the PCI penalty.”
Credit card processing fees is where statement lines live. PCI is one of the lines that is not the rate.
What a processor setup should already cover
A setup that uses a listed terminal, does not pass card numbers through a store PC, and does not ask staff to type PANs into a back-office form has already done the hardware half. How it works on this brand is scoping, a written four-line quote, item data, then shipped hardware. Monthly software on the sample card is $0.00. Whether you still get a SAQ email depends on the processor program, not on that $0.00 line.
If someone wants to key cards on a website, or store card-on-file, the scope grows. Say no unless you have a reason and a processor who will own that scope with you.
Do POS systems have a monthly fee is the software line. PCI is not that line. It is the questionnaire and the terminal.
How to check your own status without guessing
Log into the processor or bank portal you already use. Look for PCI, SAQ, or compliance. Download whatever they sent. If you cannot find it, call that number, not a general “PCI hotline” from a search ad.
Walk the counter: is anyone writing card numbers. Are receipts stored in a box with full PAN visible. Is the terminal’s default passcode still the sticker password. Is a vendor still connected remotely after a service call.
Read the Council’s Small Merchant Guide to Safe Payments from the same merchant page if you want the short version in their words. Then do the portal, not a laminated poster.
Frequently asked questions
Does a small store have to follow PCI DSS? The Council says the standard is intended for all entities that store, process, or transmit cardholder data, including small merchants. Validation and reporting are set by the payment brands and your acquirer.
If I never type a card number, am I done? You still have a terminal, receipts, people, and vendors. Encryption in the terminal helps. It does not delete the questionnaire your processor sends.
Is the PCI non-compliance fee on our sample card a fine from the Council? No. It is a processor fee on that sample schedule, waived when the checklist is completed, with the underwriting disclaimer above.