The short answer
PCI compliance means following the Payment Card Industry Data Security Standard, known as PCI DSS. The PCI Security Standards Council says it “provides a baseline of technical and operational requirements designed to protect payment account data” (PCI Security Standards Council).
It’s set by the card industry, not by the Canadian government. If you take card payments, it applies to you. If your provider handles the card data, the Council’s guidance points mainly to a self-assessment questionnaire and some checks on that provider.
Who has to comply
The Council says PCI DSS applies to “All entities that store, process, or transmit cardholder data” (PCI SSC). Its list includes retailers, processors, acquiring banks, card issuers and service providers.
What if your provider handles all the card data? The Council says PCI DSS “is intended for any entity that stores, processes, or transmits cardholder data,” and that using a third party “does not remove the merchant’s responsibility to ensure account data is properly protected by the third party.” It adds: “Merchants are still required to validate PCI DSS compliance, typically through a Self-Assessment Questionnaire” (PCI SSC FAQ).
So a provider that handles the card numbers makes your job much smaller. It doesn’t make it go away.
Who sets the rules, and who checks
- The PCI Security Standards Council writes the standard. It’s led by an executive committee with representatives from American Express, Discover, JCB International, Mastercard, UnionPay and Visa (PCI SSC).
- The card brands and acquiring banks enforce it. The Council says “Compliance and enforcement of PCI Standards is the role of the payment brands and acquiring banks, not the PCI SSC.” It also says it “does not receive copies of compliance assessment reports, nor is it involved in and has no information about penalties or fines for non-compliance.”
The Council’s merchant page adds: “Whether a small merchant is required to validate compliance is determined by the individual payment brands” (PCI SSC). In practice, your provider or acquirer tells you what to do.
What a small business typically does
Here’s what the Council’s guidance points to for a business that uses a provider for its card payments:
- Ask your provider which questionnaire applies. The Council says merchants “should also consult with their acquirer (merchant bank) or payment brand” to find out whether they must submit a Self-Assessment Questionnaire, or SAQ, and which one (PCI SSC). For businesses that outsource all card handling, the Council names SAQ A as a typical example.
- Confirm your provider is compliant. The Council says to confirm the provider is PCI DSS compliant for the services it gives you.
- Keep a written agreement. It says to keep written agreements with the provider that set out each side’s responsibilities.
- Check on your provider. It says to monitor “the provider’s compliance status at least annually” (PCI SSC FAQ).
- Know where the line is. Understand which security jobs are yours and which are your provider’s.
A simple habit keeps your part small: let card numbers go straight into the terminal or online checkout your provider gives you. Don’t write them down, and don’t take them by email or text, so they never sit on your own systems.
The Council has free small merchant guides on its merchant resources page, including a guide to safe payments.
What Canadian providers charge for PCI
A PCI fee on your statement is set by your provider. The Council says it has no information about penalties or fines for non-compliance.
What the providers we compare publish:
- Clover: its Canadian pricing page says “NO PCI CHARGE.”
- Helcim: says “No account monthly fees. No minimums, software fees, or statement fees.” It doesn’t list a PCI fee on its pricing page.
- Stripe: says “No setup fees, monthly fees, or hidden fees.”
- Everyone else we compare: we haven’t found a published PCI fee amount.
If your statement shows a PCI fee, ask your provider three things in writing: what it covers, what you need to do to stop paying it, and whether another plan includes it.
Keep reading
- Credit card processing fees in Canada, explained: every line on your statement, PCI included.
- What is a merchant account?: your own account or a payment facilitator’s.
- What is a chargeback?: the other fee that shows up when something goes wrong.
Common questions
What is PCI compliance?
It means meeting the Payment Card Industry Data Security Standard, or PCI DSS. The PCI Security Standards Council says the standard provides a baseline of technical and operational requirements designed to protect payment account data. It's a global card industry standard, so it applies in Canada the same way it does elsewhere.
Do small businesses in Canada need to be PCI compliant?
Yes. The PCI Security Standards Council says PCI DSS applies to all entities that store, process or transmit cardholder data. Even if your provider handles every card number, the Council says you must still make sure that provider protects the data, and still validate your own compliance, typically with a Self-Assessment Questionnaire.
Who enforces PCI compliance in Canada?
The card brands and acquiring banks, not the Council that writes the standard. The PCI Security Standards Council says compliance and enforcement are the role of the payment brands and acquiring banks, and that it has no information about penalties or fines. Your provider or acquirer tells you what you must submit.
Do Canadian providers charge a PCI fee?
Most of the providers we compare don't publish one. Clover's Canadian pricing page says no PCI charge. Helcim says it charges no minimums, software fees or statement fees, and Stripe says it has no setup fees, monthly fees or hidden fees. If your statement shows a PCI fee, ask your provider what it covers.