PCI DSS Non-Compliance Fines and Penalties Explained

What Mastercard Publishes (SDP Table 2.2)

Mastercard Security Rules and Procedures - Merchant Edition (verified Table 2.2, section 2.2.5) lists assessments for SDP noncompliance as up to the following amounts per violation, per calendar year, imposed in the Mastercard Customer (acquirer) context:

• Level 1-2 merchants and Level 1-2 service providers: up to USD 25,000 / 50,000 / 100,000 / 200,000 for first through fourth violations
• Level 3 merchants: up to USD 10,000 / 20,000 / 40,000 / 80,000 for first through fourth violations

Noncompliance may also lead to merchant termination or service-provider deregistration or delisting. Confirm current figures in the live Mastercard manual - ceilings can be updated.

What Visa Publishes (and Does Not)

• AIS program: Visa states members must ensure merchant and service-provider PCI DSS compliance and that Visa may assess the issuer or acquirer for non-compliance. The numeric AIS schedule is not published on the public AIS overview - do not invent Visa monthly amounts.
• What To Do If Compromised: Failure to meet required compromise reporting and investigation timelines can trigger a non-compliance assessment of up to USD 100,000 per incident on the Member (among other duties, including reporting within three calendar days).

Costs Beyond Table Assessments

PFI investigation, issuer recovery and card reissue programs, elevated remediation mandates, suspension of card acceptance, regulatory or civil exposure after a breach, and contractual indemnities often dwarf table assessments. American Express, Discover, and JCB each have their own programs - do not assume Mastercard ceilings apply to every brand.

How CyberSilo Helps

• Continuous control evidence reduces "paper compliant, operationally non-compliant" risk that shows up in forensics
• ThreatHawk and Agentic SOC for detection and IR evidence
• CSA for year-round requirement status

Frequently Asked Questions

Who pays Mastercard Table 2.2 amounts?

They are framed as Customer (acquirer) assessments; merchants typically see pass-through via contract.

Are Amex, Discover, and JCB the same numbers?

No. Each brand has its own program - do not assume Mastercard ceilings apply to all brands.

If we have an AOC, can brands still assess?

Validation helps but does not create safe harbor if controls failed or compromise duties were missed. Confirm with counsel and brand documents.

Related PCI Resources

Certification myth · Cost · Incident response plan · ROC and AOC · USA PCI services