You take card payments, so you’ve probably heard you need to be “PCI compliant.” Now you’re wondering if that’s an actual legal requirement or just something vendors push to sell you services.
Here’s the straight answer. PCI compliance is not a law. It’s a contractual requirement, and for most small businesses, that distinction changes nothing about whether you have to follow it. If you accept credit cards, you’re on the hook.
This post covers what PCI compliance is, whether the law requires it, who it applies to, what it actually asks of you, and what happens if you skip it. Let’s clear it up.
Is PCI Compliance Required by Law?
No federal law requires PCI compliance. The PCI DSS (Payment Card Industry Data Security Standard) is a set of security rules created by the major card brands, not by Congress.
But that’s a technicality, not a loophole. When you signed up to accept cards, your merchant agreement required PCI compliance. Visa, Mastercard, and the others enforce it through the banks and processors you work with.
So while no statute names it, your contract does. Breaking that contract carries real consequences, which we’ll get to.
Where State Law Enters the Picture
A handful of states have folded PCI standards into actual law. Nevada and Minnesota, for example, have written parts of the PCI framework into their statutes.
Several other states reference PCI standards in their data protection or breach notification rules. So depending on where you operate, pieces of PCI compliance may carry legal weight beyond your contract.
The safe read for a small business is simple. Whether by law or by contract, if you handle card data, PCI applies to you. You can see how this fits alongside other obligations in our guide to business regulatory compliance in 2025.
Who Does PCI Compliance Apply To?
PCI compliance applies to any business that stores, processes, or transmits cardholder data. Size doesn’t exempt you. A one-person shop taking payments falls under the same standard as a national chain.
That includes more setups than owners often realize:
- Card-present businesses using a physical terminal or point-of-sale system.
- E-commerce stores accepting payments through a website.
- Phone and mail order businesses keying in card numbers by hand.
- Any business that stores customer card details, even temporarily.
If a card number passes through your business in any form, you’re in scope. The only question is which compliance level applies.
The Four PCI Compliance Levels
PCI sorts merchants into four levels based on annual transaction volume. Your level sets how much you have to do to prove compliance.
- Level 1: over 6 million card transactions a year; requires a formal external audit.
- Level 2: 1 to 6 million transactions a year.
- Level 3: 20,000 to 1 million e-commerce transactions a year.
- Level 4: under 20,000 e-commerce transactions, or up to 1 million total.
Most small businesses land in Level 4. That means lighter requirements, but not zero. You still have to validate compliance, usually once a year.
What PCI Compliance Actually Requires
The standard breaks down into twelve core requirements. They sound technical, but the goal is plain: protect card data at every point it touches your business.
For a small business, the practical work usually looks like this:
- Secure your network with a firewall and no default vendor passwords.
- Protect stored data by not keeping card numbers you don’t need.
- Encrypt transmissions so card data is never sent in the clear.
- Control access so only the right people can reach cardholder data.
- Monitor and test your systems for gaps on a regular basis.
Most Level 4 merchants prove this through a Self-Assessment Questionnaire (SAQ). You answer a set of yes-or-no questions about your setup, and the type of questionnaire depends on how you accept payments.
If you use a compliant payment processor, they handle much of the heavy lifting. Your job is to confirm your own practices don’t create a gap on your end.
What Happens If You’re Not Compliant
Skipping PCI compliance is a gamble, and the odds aren’t in your favor. The consequences fall into three buckets, and they stack.
Fines and Penalties
Card brands can fine your bank for your non-compliance, and that cost gets passed straight to you. Fines range from a few thousand dollars a month upward, depending on the violation and how long it lasts.
Your processor may also raise your transaction fees or add penalty charges. What looked like saved effort turns into a recurring bill.
Breach Liability
Here’s where it gets serious. If you suffer a data breach while non-compliant, you’re exposed to the full cost. That means forensic investigations, customer notification, card replacement, and potential lawsuits.
For a small business, a single breach can be an existential event. Many don’t recover from the financial and reputational hit.
Losing the Ability to Take Cards
The worst outcome is losing your merchant account entirely. If your processor drops you for non-compliance, you can’t accept card payments at all.
Getting reinstated is hard and expensive, and some businesses never do. For most, losing card acceptance means losing the business.
Making Compliance Manageable
The good news is PCI compliance is achievable for small businesses without a full IT department. The key is treating it as an ongoing practice, not a one-time checkbox.
Start by confirming your payment processor is PCI compliant and finding out how much they cover. Then complete the right Self-Assessment Questionnaire for your setup and fix any gaps it surfaces.
Compliance rarely stands alone. It usually sits inside a wider set of rules your business already has to meet, from data privacy to industry-specific standards. Mapping it all together saves duplicated effort, and our overview of business regulatory compliance in 2025 is a practical place to start.
Frequently Asked Questions
Is PCI compliance required by law?
No single federal law requires it. PCI is enforced through your merchant contract with card brands. Some states, like Nevada and Minnesota, have written parts of it into law.
Does PCI compliance apply to small businesses?
Yes. Any business that stores, processes, or transmits card data must comply, regardless of size. Even a handful of transactions puts you in scope.
What happens if a small business isn’t PCI compliant?
You risk monthly fines, higher processing fees, and full liability for any breach. In serious cases, you can lose the ability to accept card payments entirely.
How do small businesses prove PCI compliance?
Most complete a Self-Assessment Questionnaire once a year. The questionnaire type depends on how you accept payments. A compliant processor handles much of the technical work.
How much does PCI compliance cost?
Costs vary by size and setup. Small merchants using compliant processors often pay little beyond their time. Non-compliance almost always costs more than compliance.
Who enforces PCI compliance?
The card brands set the standard, and your bank and payment processor enforce it. Penalties flow from the card brands through your processor to you.
