The primary risk of noncompliance is an increased vulnerability to data breaches. The average cost to recover from a breach is approximately $215 per compromised card number, and 70% of small- to medium-sized businesses never fully recover after experiencing a breach.

Merchants may also face significant fines if a breach occurs. While PCI compliance does not eliminate all risk, it provides merchants with critical best practices and actionable steps to help prevent breaches. If a merchant is found to be out of compliance, additional penalties and fees may apply.

Unlike Basys, many payment providers take a reactive approach to PCI compliance. Merchants are often expected to complete compliance requirements independently, with little to no guidance or support.

In many cases, PCI DSS obligations are buried within agreement terms and may be easily overlooked. Some providers may even view noncompliance fees as an additional revenue source. It is also common for providers to have minimal direct communication with merchants regarding their compliance responsibilities.

PCI DSS stands for Payment Card Industry Data Security Standard. It is a set of requirements that govern how merchants and other entities securely process, store and transmit credit card information.

The PCI Security Standards Council, formed in 2006 by the five major card brands—Visa, MasterCard, American Express, Discover and JCB—developed and maintains the standard.