A statement line labeled “PCI non-compliance” does not explain which security requirement is unresolved, which validation evidence is missing or why that particular amount was charged. Separate those questions before treating a provider’s fee as a universal rule of PCI DSS.
Distinguish the standard from the charge
The PCI Security Standards Council’s FAQ on penalties explains that payment card brands define fines and penalties associated with non-compliance. A common security standard does not establish a common charge schedule. A merchant should not infer a universal dollar amount, monthly frequency or enforcement start date from the standard’s version number.
Ask the assessing provider for the actual basis
Contact the processor or acquirer through an established channel. Request the fee description, applicable notice or agreement provision, period covered, relevant account reference and explanation of what must be resolved. Ask whether the issue is missing validation, an incomplete action or something else. The answer should identify the responsible organization and the evidence it expects, rather than repeat an unexplained statement label.
Keep validation and security work separate
Submitting a requested document is not a substitute for maintaining the security measures that apply to the actual payment environment. Conversely, an owner may have completed work while the provider still lacks the accepted validation record. Confirm the required assessment or documentation route with the organization managing the account’s compliance program. Do not choose a questionnaire merely because it is shorter or assume a device replacement resolves every requirement.
Trace a concrete billing discrepancy
Illustration: the merchant’s statement shows a $30 charge for September. The owner has a submission receipt dated September 5 but no acceptance confirmation. Save the statement line, submission reference and provider response. Ask which period and account the charge concerns, whether the submission was accepted and how a correction is handled. This example does not establish that $30 is a standard fee or that a refund is owed.
Close the issue with two confirmations
Record the provider’s validation-status response and its billing response separately. Keep the case number, required next action, responsible employee and promised review date. If a fee is adjusted, reconcile the credit to a later statement. If security work remains, assign it to an authorized person or qualified specialist rather than marking the entire issue complete because a billing charge disappeared.
Connect the answer to the operating record
Eric Kuvykin’s merchant decision worksheet helps organize provider responsibilities and records. The New York payments reading path connects statement and settlement review; the New Jersey path adds payment records and accountable handoffs. Keep the original notice and provider explanation with the statement so a later reviewer can distinguish a documented requirement from a marketing or billing label.
Primary reference checked October 17, 2026. The example illustrates an inquiry process, not an assessment result, compliance certification or individual legal advice.
Eric Kuvykin
Publisher and editorial director covering payments, fintech, merchant services, banking, AI, technology and operating strategy for small and medium-sized businesses.
