The short answer: If your firm accepts credit or debit cards, the Payment Card Industry Data Security Standard (PCI DSS) applies to you, however small you are. Most service businesses sit in the smallest merchant tier, which means filing a self-assessment questionnaire once a year and keeping card numbers out of your inbox, spreadsheets and files. The easiest route to payment processing compliance is to let your processor’s hosted invoice or payment link collect the card, so it never touches your systems.
Dana’s bookkeeper found it on a Tuesday, three lines from the bottom of the merchant statement: “PCI NON-VALIDATION FEE — $39.95.”
Dana runs a 14-person HR consulting firm outside Seattle. She’d never heard of PCI. Neither had her office manager, who’d quietly done everyone a favor for years: a spreadsheet of client card numbers, so she could charge monthly retainers without sending a reminder. A few clients emailed their numbers in. One read his over the phone, and the digits landed on a yellow sticky note curling at the edge of a monitor.
The fee wasn’t new. It had shown up every month for fourteen months, about $560 in all, tucked between processing charges nobody reads.
“I thought the payment company handled all that,” Dana said.
Lots of owners believe that. It’s half right. Your processor guards its own systems; your inbox and spreadsheets are on you. Here’s what PCI compliance actually asks of a service firm, why it matters more than a small fee suggests, and how to handle it in an afternoon.
What is PCI DSS, and does it apply to a firm my size?
Start with the PCI DSS basics. Five card brands (Visa, Mastercard, American Express, Discover and JCB) created the PCI Security Standards Council to write one rulebook for anyone who stores, processes or transmits card data. That rulebook is PCI DSS. It isn’t a federal law. It’s a condition of the agreement you signed to accept cards, and your processor enforces it.
Size doesn’t get you out. It just changes the paperwork.
Visa sorts merchants into four levels. Level 4 covers businesses with fewer than 20,000 online Visa transactions a year, plus most other merchants processing under a million. That’s almost every consulting and professional services firm. At Level 4, you fill out a self-assessment questionnaire, or SAQ, once a year and confirm you follow the rules that fit how you take payments. The current version of the standard is 4.0.1, and every requirement in it has been mandatory since March 2025. The grace periods are over.
So where does that monthly fee come in? When your processor doesn’t receive your questionnaire, it may add a non-compliance (or “non-validation”) charge until you file. Small merchants commonly see somewhere between $20 and $100 a month.
Think of it as a smoke detector chirping down the hall. Annoying, easy to tune out, and not really the problem. The problem is whatever it’s trying to warn you about.
Where does card data hide in a service business?
Take a slow walk through your office. Not the payment portal. The real office.
Check the inbox first. Helpful clients type all sixteen digits into an email, sometimes with the expiration date and the three-digit code underneath. That email now lives on a mail server, on three phones and in a backup somewhere. Then open the shared drive, where a “client billing” spreadsheet has sprouted a column nobody should have added. Then the CRM notes, the transcribed voicemail, the legal pad by the phone.
And the sticky note. There’s almost always a sticky note.
Every one of those spots pulls more of your business into what PCI calls scope: the people, devices and files the rules cover. One card number in a shared spreadsheet drags in the laptop that opens it, the cloud drive that syncs it and everyone with access to the folder. A lesser-known rule catches people out: you can never keep the security code from the back of a card after the payment goes through. Not encrypted, not in a locked file, not anywhere.
Be honest. If a client called tomorrow and asked who in your office could see their card number, would you know the answer?
How do you stay compliant without becoming a security expert?
Shrink the footprint. That’s the whole strategy.
First, let someone else hold the card. Most invoicing platforms can drop a “pay now” link into every invoice. The client clicks, lands on the processor’s secure page and types the card in themselves. The number never crosses your desk, your inbox or your server. For recurring retainers, ask your processor to keep the card on file. They lock the number in their vault and hand you a stand-in token, so you can charge the retainer every month without ever seeing it.
That one change does most of the work. It often qualifies you for the shortest questionnaire, the one built for businesses that hand the entire transaction to a provider. Taking numbers by phone and keying them into a virtual terminal yourself means a longer form. Keeping numbers in your own files, longer still.
Second, clean house. Delete the card-number column. Purge old emails with card details, then empty the trash. Shred the sticky note. Write down the new rule (we don’t take card numbers by email; here’s the payment link instead) so the whole team says the same thing.
Third, file the questionnaire. Your processor will tell you which version you need, usually through an online portal. With payments on hosted links, it’s often an afternoon’s work. Save the confirmation, called an attestation of compliance, where you’ll find it next year.
Fourth, read your merchant statement every month. Or have someone read it for you.
That last step is where good bookkeeping and payment processing compliance meet. Your bookkeeper already reconciles processor deposits against invoices, so they’re the person most likely to spot an odd fee before it runs for fourteen months. Paul, a System Six client, said the team has been “proactive at catching mistakes I’ve made or seeing challenges coming down the pike.” That’s the job, really. Hear the chirp early.
What does getting it right look like?
Three weeks after that Tuesday, Dana’s office looked the same and worked differently.
Every invoice carried a payment link. Retainer clients on the old spreadsheet got a short note asking them to re-enter their card on the processor’s page. Every one did it within the week. The spreadsheet column disappeared. So did the sticky note. Her office manager filed the questionnaire on a Thursday afternoon, coffee in one hand and the processor’s help page open in another tab. The fee dropped off the next statement.
The bigger change was harder to see on paper. Dana stopped wondering what was sitting in her inbox. When a new client asked how to pay, she had a clean, confident answer. Clients notice that. In a professional services firm, trust is the currency.
Shane, who opened a dental practice with his wife, described bookkeeping as a relationship “where trust needs to be paramount,” and said they wholeheartedly trust the System Six team with their books. That kind of trust gets built in small, unglamorous moments, like catching a $40 fee before it turns into something bigger. It’s part of why System Six, with 175+ businesses served, scores 9.5 out of 10 when clients are asked whether they’d recommend us, and why more than half of our new clients each year come by referral.
So what should you do this week?
Here’s the takeaway, and yes, it fits on a sticky note: the safest card number is the one you never see.
PCI compliance sounds like an IT project. For most service firms it’s really a habits project. Send cards through a hosted link, keep numbers out of your files, file the questionnaire once a year and read your merchant statement.
So do one thing today. Pull up last month’s statement and search it for “PCI.” If you find a non-compliance fee, you’ve found your to-do list. And if you’d like a team that reads those statements every month and flags what doesn’t belong, let’s talk.
What’s hiding on yours?
Frequently asked questions
Is PCI compliance required by law?
Not by federal law. PCI DSS is a contract requirement: when you signed your merchant agreement, you agreed to follow it, and your processor enforces it through fees and, after a breach, potential assessments from the card brands. A few states also reference PCI standards in their own data-security laws, so check with your attorney if you operate across several states.
What’s the difference between a PCI compliance fee and a non-compliance fee?
A compliance fee is what some processors charge to run their compliance program, usually a small monthly or annual amount. A non-compliance or non-validation fee is a penalty that appears when you haven’t submitted your annual questionnaire, commonly $20 to $100 or more a month. Paying the first doesn’t make you compliant. Filing the questionnaire stops the second.
Which self-assessment questionnaire does my firm need?
It depends on how you take cards, and your processor will tell you. Firms that send every payment through a provider’s hosted page or payment link often qualify for SAQ A, the shortest. Typing card numbers into a web-based virtual terminal usually means SAQ C-VT. Storing card data on your own systems pushes you toward SAQ D, the longest.
Can we keep client cards on file for monthly retainers?
Yes, as long as your processor stores them and you don’t. Card-on-file (often called tokenization) keeps the number in the processor’s vault and gives you a reference to charge. Never keep the three-digit security code after a payment is authorized, even encrypted.
About System Six
System Six is a Seattle-based outsourced bookkeeping, accounting, payroll, and CFO advisory firm serving consulting and professional services businesses. We work with more than 175 businesses, our team averages over 10 years of accounting experience, and we’ve processed more than $100 million in payroll. Clients rate us 9.5 out of 10 on likelihood to recommend, and over half of our new clients come from referrals. We work on a fixed weekly fee with no long-term contracts. Learn more at systemsix.com.
