- Short answer
- Vendors estimate $300–$10,000 a year for a small store; Shopify's Level 1 certification covers your store, not the SAQ or scans your acquirer wants.
- PCI SSC
- No page we read prices a merchant's SAQ, scan or audit; its fee schedule prices assessor, vendor and training programs.
- Level 1 merchants
- Over 6 million Visa transactions a year, or a global merchant Visa names Level 1: a ROC, not an SAQ.
- Who decides
- Typically your acquirer or the card brands, which receive the SAQ, decide which one applies, if any.
- ASV scans
- Part of SAQ A under PCI DSS v4.x, even with processing fully outsourced.
- Shopify Payments
- No separate PCI fee on the Shopify pages we read.
What do vendors estimate PCI compliance costs?
No PCI SSC page we read on October 19, 2026 prices a merchant's SAQ, scan or audit; its fee schedule prices assessor, vendor and training programs. Below are estimates from Stripe, SecurityMetrics and Shopify's enterprise guide.
Vendor estimates
| Source | Small business | Larger businesses |
|---|---|---|
| Stripe | $1,000–$10,000 a year | $10,000–$50,000 a year midsize; $50,000–$250,000 a year large |
| SecurityMetrics | Around $300 a year, up to $10,000 | $70,000+ a year enterprise |
| Shopify's enterprise guide | From $300 a year (SAQ and scans) | Over $70,000 for full PCI DSS assessments; onsite audits about $40,000; a QSA audit averages $15,000 |
Vendor estimates, not PCI SSC prices; read October 19, 2026.
SecurityMetrics' low end assumes small scopes; its high end depends on your environment. Price your own scope, not an average.
What does the budget pay for?
- The SAQ: at least $300 for smaller businesses, Stripe says; SecurityMetrics lists $50–$200.
- ASV scans: part of SAQ A under PCI DSS v4.x even where processing is fully outsourced, PCI SSC says.
- Training and penetration tests, per Stripe, plus consulting for midsize companies; remediation, per SecurityMetrics.
- A ROC instead of an SAQ at Level 1, Stripe says; Visa puts you there at over 6 million Visa transactions a year, or as a global merchant Visa names Level 1.
- A processor fee: some processors charge a small annual PCI fee, Stripe notes.
What does Shopify cover, and what stays yours?
Shopify is certified Level 1 PCI DSS compliant, and says its certification "covers your store, its shopping cart and web hosting." Stripe says hosted payment systems "can decrease audit scope and annual compliance costs considerably" but names no figure. The certification is Shopify's, not yours: Shopify's enterprise guide says even on a hosted platform "you'll still have to fill out a self-assessment questionnaire if you're a Level 2–4 merchant." Typically, your acquirer or the card brands decide which SAQ, if any.
Shopify attests its own quarterly ASV scans; our PCI guide covers who pays for your scans.
On a custom site, your payment page decides the SAQ.
Shopify Payments lists "no monthly fees, no hidden fees, and no setup fees" beyond the card rate and subscription, and no Shopify page we read on October 19, 2026 (Payments help, pricing, security, terms) names a separate PCI fee.
This page was written by AI. Separate AI agents that did not write it check its figures and claims against official sources and test its links and interactive tools. A human editor sets the site's editorial direction, topics and rules and checks that pages are complete and display correctly, but does not check their facts or edit their text. Details may change — always confirm critical data at shopify.com.
Editorial Policy