--- title: Counting the Cost of PCI DSS Non-Compliance description: The consequences of non-compliance to PCI DSS may result in hefty penalties. it can also result in lawsuits, data breaches, financial & reputational loss. image: https://insights.comforte.com/hubfs/comforte%20AG_Counting%20the%20Cost%20of%20PCI%20DSS%20Non-Compliance_16.05.png --- [![Hubspot\_blog\_logo](https://insights.comforte.com/hs-fs/hubfs/Hubspot_blog_logo.png?width=295&name=Hubspot_blog_logo.png)](http://www.comforte.com) [![Subscribe to comforte Insights](https://no-cache.hubspot.com/cta/default/4026697/ba125972-4bdc-4e47-b9a9-81df496120a0.png)](https://cta-redirect.hubspot.com/cta/redirect/4026697/ba125972-4bdc-4e47-b9a9-81df496120a0) [![comforte AG - Counting the Cost of PCI DSS Non-Compliance](https://insights.comforte.com/hubfs/comforte%20AG_Counting%20the%20Cost%20of%20PCI%20DSS%20Non-Compliance_16.05.png)](https://insights.comforte.com/counting-the-cost-of-pci-dss-non-compliance) [Mirza Salihagic](https://insights.comforte.com/author/mirza-salihagic) l May 16, 2024 l [Data Protection](https://insights.comforte.com/tag/data-protection), [Financial Services](https://insights.comforte.com/tag/financial-services) # Counting the Cost of PCI DSS Non-Compliance For two decades, the Payment Card Industry Data Security Standard (PCI DSS) has been the only show in town when it comes to regulating cardholder data. Created by the five big card companies (Visa, Mastercard, Discover, JCB and American Express) in 2004, it aims to enforce compliance through a kind of carrot-and-stick approach. That is, follow the rules and your organization will be able to continue processing card payments as usual. But fail to comply, and major fines could be headed your way. The potential costs involved in non-compliance are intended to make the choice a no-brainer for most businesses. ## Why PCI DSS? PCI DSS applies to any organization that stores, processes or transmits cardholder data – which is almost any organization today. Although devised in an attempt to improve data security following some high-profile corporate breaches of card data, such breaches are still with us: - In 2020, [Warner Music Group](https://www.cpomagazine.com/cyber-security/hackers-accessed-personal-and-credit-card-information-in-warner-music-group-magecart-attack/) (WMG) suffered a three-month long digital skimming attack, where customer card numbers and personal details were stolen from its e-commerce sites via an external service provider - In 2008, Heartland Payment Systems [suffered one](https://www.proofpoint.com/uk/blog/insider-threat-management/throwback-thursday-lessons-learned-2008-heartland-breach) of the worst data breaches of its kind, when an estimated 100m+ cards were compromised - A [breach at Equifax](https://www.csoonline.com/article/567833/equifax-data-breach-faq-what-happened-who-was-affected-what-was-the-impact.html) in 2017 led to the compromise of financial and personal data on around 147 million people The latest iteration (version 4.0) of PCI DSS introduces a series of new technical and operational requirements to bring it up to date with modern technology, offer companies more flexibility, and try to ensure they treat compliance/security as a continuous endeavor rather than a one-off tick-box exercise. They are treated slightly differently depending on the number of transactions processed per year, with stricter compliance requirements (and penalties) for those at the upper end: No. of Card transactions per year: Level 1: Over 6 million. Level 2: 1-6 million. Level 3: 20,000 to 1 million. Level 4: Fewer than 20,000 transactions per year. ## The cost of non-compliance Organizations that fail to comply with PCI DSS will face potentially severe fines. Often, a serious data breach is the event that prompts an investigation into compliance. Penalties are calculated based on how long it takes to fix: - During the first three months, monthly fees for non-compliance are $5,000-$10,000 depending on card volume - From 4-6 months, the fees increase to $25,000-$50,000 per month - After the seventh month, fees rise to $50,000-$100,000 monthly A serious breach of the cardholder data environment (CDE) would likely also incur a fee of around $50-$90 per affected customer. However, this doesn’t preclude those customers launching their own bid for compensation via the courts. It should also be clarified that the above financial penalties are calculated and levied by the payment card brands on acquiring (merchant) banks. The latter then pass on the charges to erring merchant customers. They may also add other non-compliance charges, compensation fees or costs incurred such as for digital forensic investigations. Other incidents which may lead to PCI DSS fines are: - Failing to report a breach within a specified time - Failing to use a PCI DSS-compliant service provider Then there are indirect costs to consider, such as: - Cardholder class action suits - Reputational damage - Business disruption including lost productivity - Remediation and investigation costs - Other regulatory fines from a breach (eg GDPR) ## Data-centric security The good news is that card brands may lower or completely eliminate any fines if a merchant is breached but found to be PCI DSS compliant. That puts the pressure on compliance teams to ensure they meet the rigorous requirements of the standard. Data-centric security should be a key foundational step for any program. Comforte’s Data Security Platform automatically and continuously discovers and classifies cardholder data, wherever it resides, then applies strong data protection in line with policy. Crucially, we offer tokenization as a data protection method. Tokenization can help to reduce the scope and cost of PCI DSS compliance by removing cardholder data from the CDE. By removing the footprint of “in-scope” systems, organizations can streamline compliance and reduce the impact of data breaches. --- | Share this: | [![LinkedIn](https://insights.comforte.com/hubfs/Social%20Icons/linkedin%20icon.png)](https://www.linkedin.com/shareArticle?mini=true&url=https://insights.comforte.com/counting-the-cost-of-pci-dss-non-compliance&utm_medium=social&utm_source=linkedin) | [![Bluesky](https://insights.comforte.com/hubfs/Social%20Icons/bluesky_logo.png)](https://bsky.app/intent/compose?url=https://insights.comforte.com/counting-the-cost-of-pci-dss-non-compliance&utm_medium=social&utm_source=Bluesky) | ![Twitter](https://insights.comforte.com/hubfs/Social%20Icons/twitter_x_logo-1.png) | [![XING](https://insights.comforte.com/hubfs/Social%20Icons/xing-color2.png)](https://www.xing.com/spi/shares/new?url=https://insights.comforte.com/counting-the-cost-of-pci-dss-non-compliance&utm_medium=social&utm_source=xing) | [![Email](https://insights.comforte.com/hubfs/Social%20Icons/email%20icon.png)](mailto:?subject=Check%20out%20https://insights.comforte.com/counting-the-cost-of-pci-dss-non-compliance&utm_medium=social&utm_source=email%20&body=Check%20out%20https://insights.comforte.com/counting-the-cost-of-pci-dss-non-compliance&utm_medium=social&utm_source=email) | | --- | --- | --- | --- | --- | --- | ## ACI Worldwide has chosen comforte as their strategic partner to support their joint customers on their journey to PCI DSS v4.0 compliance with data-centric security. Click the button below to download the case study: [![Download Case Study](https://no-cache.hubspot.com/cta/default/4026697/67ba0392-bc74-4472-a3af-c43ad38b3379.png)](https://cta-redirect.hubspot.com/cta/redirect/4026697/67ba0392-bc74-4472-a3af-c43ad38b3379) ### Related posts ![Reuse, Reward: How Banks Can Safely Unlock the Value of Their Data](https://insights.comforte.com/hubfs/comforte%20AG_%20Reuse%20Reward_%20How%20Banks%20Can%20Safely%20Unlock%20the%20Value%20of%20Their%20Data_03.2025.png) Mar 12, 2026 l [Data Protection](https://insights.comforte.com/tag/data-protection) , [Payments Transformation](https://insights.comforte.com/tag/payments-transformation) , [Business Value](https://insights.comforte.com/tag/business-value) ### [Reuse, Reward: How Banks Can Safely Unlock the Value of Their Data](https://insights.comforte.com/reuse-reward-how-banks-can-safely-unlock-the-value-of-their-data?hsLang=en) The financial world is awash with data. But too few organizations are able to use it effectively. In [Bank Director’s *2025 Technology Survey*](https://www.bankdirector.com/wp-content/uploads/2025/09/2025TechReport-OpenVersion.pdf), one-third of US banking leaders cite an inability to harness data as a top technology challenge facing their... [Read more](https://insights.comforte.com/reuse-reward-how-banks-can-safely-unlock-the-value-of-their-data?hsLang=en) ![Delivering a Secure, Trusted Foundation for Cloud Growth at LGT](https://insights.comforte.com/hubfs/comforte%20AG_Delivering%20a%20Secure%2c%20Trusted%20Foundation%20for%20Cloud%20Growth%20at%20LGT_01.2026.png) Jan 15, 2026 l [Data Protection](https://insights.comforte.com/tag/data-protection) , [Business Value](https://insights.comforte.com/tag/business-value) ### [Delivering a Secure, Trusted Foundation for Cloud Growth at LGT](https://insights.comforte.com/delivering-a-secure-trusted-foundation-for-cloud-growth-at-lgt?hsLang=en) There’s a world of difference between retail and private banking. While the former is transactional and focused on the mass market, the latter is built on trust and personal relationships. That trust can be hard won, but is easily lost, especially... [Read more](https://insights.comforte.com/delivering-a-secure-trusted-foundation-for-cloud-growth-at-lgt?hsLang=en) ![Top Indicators You Have a Cybersecurity Problem—and What to Do About It](https://insights.comforte.com/hubfs/comforte%20AG_Top%20Indicators%20You%20Have%20a%20Cybersecurity%20Problem_and%20What%20to%20Do%20About%20It.png) May 22, 2025 l [Data Protection](https://insights.comforte.com/tag/data-protection) , [Digital Enablement](https://insights.comforte.com/tag/digital-enablement) ### [Top Indicators You Have a Cybersecurity Problem—and What to Do About It](https://insights.comforte.com/top-indicators-you-have-a-cybersecurity-problem-and-what-to-do-about-it?hsLang=en) Data is both blessing and curse to the modern enterprise. Yes, when analyzed effectively it can surface intelligence to improve decision making, customer engagement, process efficiency and, ultimately, drive revenue. But it also represents a major... [Read more](https://insights.comforte.com/top-indicators-you-have-a-cybersecurity-problem-and-what-to-do-about-it?hsLang=en) ### Service - [Contact](https://www.comforte.com/contact/) - [About us](https://www.comforte.com/company/) - [Blog](https://insights.comforte.com/) - [Press Releases](https://www.comforte.com/company/press-releases/) - [Career](https://www.comforte.com/company/career/) - [Resources](https://www.comforte.com/resources/) ### EMEA comforte AG Abraham-Lincoln-Str. 22 65189 Wiesbaden Germany Phone: + 49 611 93199 00 Fax: + 49 611 93199 05 ### Asia-Pacific comforte PTY Suite 20, 1 Rivett Road North Ryde NSW 2113 Australia Postal Address: PO Box 1710 Lane Cove NSW 1595 Australia Phone: +61 2 8197 0272 ### Americas comforte Inc. 30 Wall Street, 8th Floor New York, NY 10005-2205 USA Phone: +1-646-438-5716 ### Southeast Asia comforte Asia Pte. Ltd. 1 Raffles Place, #19-61 Tower 2  Singapore 048616 Phone: +65 6808 5507 - [Sitemap](https://www.comforte.com/sitemap/) - [Legal Notice](https://www.comforte.com/legal-notice/) - [Privacy Policy](https://www.comforte.com/privacy-policy/) © comforte AG 2026