A statistical package fee and a PCI non-compliance fee are line items that often pad a processor's revenue rather than cover a real cost to you, and many of them can be questioned or removed once you name them. PCI compliance itself is a real, required security standard, but the fee a processor charges for it is a separate charge that every owner should ask about.
The PCI fee versus PCI compliance, untangled
This is the distinction that confuses the most owners, so let us separate the two cleanly. PCI DSS, the Payment Card Industry Data Security Standard, is the security standard every business that touches card data must follow. Most small merchants validate it through an annual self-assessment questionnaire and, in some cases, network scans. Skipping it risks fines and real liability if you are breached. The compliance is genuine and not optional.
The PCI compliance fee is a different thing entirely. It is a charge most processors add to your statement, often 5 to 20 dollars a month, framed as the cost of keeping you compliant. For many processors it is simply a standard line item that pads revenue, and on a transparent plan it is often smaller or absent. The compliance is real. The fee is worth asking about.
Then there is the PCI non-compliance fee, the one that stings. When your annual questionnaire lapses or is never completed, processors quietly start charging a penalty, typically 20 to 200 dollars a month, and it recurs silently until someone catches it. The good news is that it usually disappears the moment you complete the questionnaire correctly. This is a fee for missing paperwork, not for any service rendered.
The statistical package fee and its cousins
The statistical package fee, sometimes called a statement fee or service fee, is one of the clearest examples of markup dressed up as a service. It is usually a flat monthly charge, often 5 to 25 dollars, presented as the cost of preparing your statement and reporting. The reporting is automated and costs the processor almost nothing, which is why this fee is frequently negotiable or simply absent on a transparent plan.
It rarely travels alone. Watch for a monthly minimum fee, charged when your processing does not generate enough in fees to hit a floor the processor set. Watch for daily batch fees, a small charge each time you settle your terminal, which quietly multiply across a month. Watch for per-transaction authorization fees stacked on top of the percentage rate, and for annual fees that appear once a year when you have stopped looking.
The pattern across all of these is the same. None of them are interchange, the real wholesale cost covered in our guide on what interchange is and why your rate changes. They are margin, and naming them out loud is the first step to removing them.
The contract traps that hide behind the fees
Some charges are not on the statement at all, they are in the contract. Older technology is a red flag worth taking seriously. Some major processors still require faxing chargeback documents, which slows every dispute you try to fight. Some bundle a separate equipment lease that survives even after you switch processors, a trap covered in our guide on how to spot a leased-terminal scam.
The most serious one is a personal guarantee. Some third-party ISOs require you to sign one, which means they can pursue your personal assets, not just business funds, if anything goes wrong. A fair processing relationship does not need to reach into your house, and you should know before you sign whether yours does.
Which ones you can have removed
Many of these charges vanish once they are named. A recurring PCI non-compliance fee usually disappears with one corrected questionnaire. A statistical package fee is frequently negotiable or absent on a transparent plan. A monthly minimum can often be waived or restructured. The leverage comes from knowing exactly what each line is, which is why the first move is always to total your fees and find your real effective rate.
Going direct to North lets you bypass the third-party ISOs that stack their own charges on top of the processor's buy rates. North is PCI DSS validated with certified point-to-point encryption and tokenization, and because it is a true end-to-end processor, your data is not passing through extra hands. That is a real cost difference, not a line on a statement.
Find your number first with our savings and effective-rate calculator, then send me your statement through the free statement review. I will name every line for you, tell you which ones should not be there, and show you what the same volume looks like on transparent North interchange-plus pricing.
Want this read for your own statement?
Send your last processing statement and Alex will show you your true effective rate, what is interchange, and what is pure markup. It costs nothing either way.
