Ep. 5: Why is PCI compliance important? Savannah Keys of Aperia Compliance explains merchant risk and security

Key Topics Discussed:

• Why small merchants struggle to understand and complete PCI compliance

• How PCI SAQs work for level-three and level-four merchants

• The commercial tension around PCI non-compliance fees

• Whether acquirers and ISOs are doing enough to educate merchants

• Why PCI compliance does not guarantee protection from a data breach

• How merchant risk management is becoming more personalised

• The role of payment page monitoring, endpoint protection and breach insurance

• Why payments technology can never be treated as “set it and forget it”

This episode gets into why PCI compliance is important, and why it can be particularly difficult for smaller merchants to manage. Savannah Keys, Director of Strategic Partnerships at Aperia Compliance, joins Justin Hanna at Money20/20 USA to discuss merchant education, non-compliance fees, security and the changing relationship between compliance and risk.

The conversation looks at a difficult commercial tension for acquirers and ISOs. Merchants need practical help to understand their responsibilities, but non-compliance fees can also represent a significant revenue stream for payment providers. Savannah explains why simply giving a merchant access to a compliance tool is rarely enough, particularly when that merchant has limited time, limited resources and little prior knowledge of PCI DSS.

PCI compliance matters because businesses accepting card payments need to demonstrate that they are handling payment data appropriately. For many smaller merchants, that means completing a PCI self-assessment questionnaire, commonly known as an SAQ. Failing to complete the process may lead to non-compliance fees from an acquirer or payment provider.

However, one point runs through the entire discussion: PCI compliance does not equal security. Completing an assessment can support good payment data practices, but it does not guarantee that a merchant will avoid a breach.

Why do small merchants struggle with PCI compliance?

Smaller level-three and level-four merchants often do not have dedicated compliance or security teams. They may be running a shop, restaurant or other small organisation where payments compliance is one task among many.

When the first meaningful communication they receive is a warning that they could be charged a non-compliance fee, the process can feel confusing and punitive. The forms may be unfamiliar, the language may be technical and the merchant may not know where to begin.

Savannah argues that education is therefore central to improving merchant compliance. A platform can make the process easier, but providers also need to explain what merchants are being asked to do, why it matters and what action they need to take.

What is a PCI SAQ?

A PCI SAQ is a self-assessment questionnaire used by eligible merchants to evaluate their compliance with relevant PCI DSS controls.

Aperia Compliance provides a white-labelled platform through which level-three and level-four merchants can complete these questionnaires. Acquirers, ISOs, banks and other organisations with merchant portfolios can offer the platform under their own brand.

The episode does not explore the different SAQ types or formal validation requirements. Its focus is on making the process more understandable and manageable for merchants that may otherwise fail to complete it.

Are non-compliance fees helping or hurting merchants?

The discussion is candid about the role of PCI non-compliance fees. Some acquirers and ISOs provide merchants with a tool, then charge a fee when the merchant does not use it. In some organisations, those charges can produce substantial revenue.

That creates a real tension. Payment providers want merchants to become compliant, but successful merchant education may reduce income generated through non-compliance fees. Savannah does not argue that every provider takes the same approach. Some partners actively work to raise compliance rates and offer additional tools covering areas such as website accessibility, privacy and payment page monitoring.

For acquirers and ISOs, the commercial question is whether compliance should be treated mainly as an enforcement mechanism or as part of a stronger merchant service proposition. Better support may reduce fee revenue in the short term, but it can also improve trust, retention and the overall quality of the merchant portfolio.

Does PCI compliance prevent data breaches?

No. A merchant can be PCI compliant and still experience a breach. Compliance provides a baseline, but merchants may need additional protection based on their business model, payment environment and risk profile. Savannah points to tools including endpoint protection, payment page script monitoring, data breach insurance and website compliance services.

This distinction matters because merchants can easily assume that completing an annual questionnaire means the job is finished. In practice, fraud methods, technology and payment risks continue to change. For payment providers, that creates an opportunity to move beyond a standardised annual process. Instead of offering every merchant the same package, they can assess individual risk and recommend relevant products or controls.

How are compliance and merchant risk coming together?

Aperia is exploring a model that connects merchant compliance with a broader view of risk. Savannah compares the idea to credit monitoring: a merchant could log in, see how its risk compares with others and receive recommendations based on how the business operates and processes payments.

A higher-risk merchant might be advised to complete its PCI assessment while also adopting data breach insurance, payment page monitoring or another security control. A lower-risk merchant may need a different combination.

This merchant-by-merchant approach could make compliance more useful for both providers and their customers. 

Acquirers gain a clearer view of portfolio risk, while merchants receive guidance connected to their actual circumstances rather than a generic checklist.

Why compliance cannot be “set it and forget it”

Savannah’s nomination for The Shelf of Shame is the phrase “set it and forget it”. That approach does not fit payments. Fraud evolves, technology changes and new compliance obligations continue to appear. A tool that was correctly configured once may still need monitoring, reassessment and updates.

The same principle applies to merchant relationships. Giving somebody access to a portal does not guarantee that they understand the process, will complete it or remain secure afterwards. Providers need to keep educating merchants and reviewing how compliance services fit alongside wider risk controls.

What this episode answers

Why is PCI compliance important?

PCI compliance helps merchants assess how they handle payment card data and demonstrate that they meet relevant PCI DSS controls. It can also help them avoid contractual non-compliance fees. However, it should be treated as one part of a broader security and risk strategy.

Does PCI compliance prevent data breaches?

No. PCI compliance establishes a baseline but cannot guarantee that a merchant will not be breached. Additional controls may be needed, including endpoint protection, payment page monitoring and appropriate insurance.

Why do small merchants struggle with PCI compliance?

Many smaller merchants lack dedicated compliance resources and may not understand PCI terminology or the assessment process. Clear education, accessible tools and practical support can make completion more likely.

What is a PCI SAQ?

A PCI SAQ is a self-assessment questionnaire used by eligible merchants to evaluate their compliance with relevant PCI DSS requirements. The correct questionnaire depends on how the merchant accepts and processes card payments.

How can acquirers and ISOs support merchant compliance?

They can provide clearer education, simpler assessment tools and support based on the merchant’s specific risk profile. They can also help merchants understand which security and compliance-adjacent services may be relevant beyond the basic assessment.

The big takeaway: PCI compliance should be the starting point for merchant protection, not the end of the conversation. For acquirers, ISOs and payment providers, that means combining accessible compliance tools with better education and risk-based support. Get that right, and merchants are more likely to complete the process, understand their exposure and build stronger security practices. Get it wrong, and compliance becomes another confusing fee rather than a useful part of the merchant relationship.