Compliance Basics for SMBs
- Do now: file your PCI SAQ every year. Add quarterly ASV scans if your own site redirects to or embeds the payment form. Track chargebacks against your processor's written limit. Use a billing descriptor people recognize.
- Do if you bill recurring: a clear cancel flow, renewal notices seven days out, an easy opt-out.
- Can wait: formal audits, AML/KYC programs, PSD2/SCA unless you sell into the EU.
- Most SMBs need three things: the PCI questionnaire, chargeback monitoring, a clear refund policy.
- Set an early warning before your processor's limit. Check network program conditions separately; a ratio alone doesn't establish enrollment.
Compliance sounds enormous, but at SMB size it's three things and the rest can wait.
The 3-Thing Checklist
If you do nothing else, do these three things:
1. Complete Your PCI Questionnaire
The SAQ is an annual self-assessment questionnaire. It confirms you're handling card data safely.
What to do:
- Hosted checkout (Stripe Checkout, Square, Shopify Payments) usually means SAQ A, the simplest form. If your own site redirects to or embeds the payment form, SAQ A still needs quarterly ASV scans of those pages. See PCI DSS.
- Embed a processor's payment form in an iframe and you may still qualify for SAQ A, with a script-attack check. Your own JavaScript handling the payment page usually means SAQ A-EP.
- Touch card numbers directly and you're on SAQ D. Switch to hosted checkout instead.
Skip it: your processor bills a PCI non-compliance fee, $10-150 a month. You're also on your own if you get breached.
See PCI DSS for the full guide.
2. Monitor Your Chargeback Ratio
Your ratio is the share of transactions that turn into chargebacks. Your processor can set its own limit. Get the metric and limit in writing.
What to do:
- Check your ratio monthly: total chargebacks / total transactions
- Set an internal alarm before your processor's limit
- If you're approaching it, start reducing chargebacks immediately
Your own alarm should leave time to act. Confirm which metric your processor measures and what it expects before the limit is reached.
- Visa VAMP (live April 2025): the ratio combines fraud reports and disputes, with exclusions. Merchant excessive tests depend on region and your acquirer's status. Check Network Programs for the formula and full conditions.
- Mastercard ECM: 100-299 chargebacks and a 1.50-2.99% ratio. Both, not either. Go past 299 and 3.00% together and it's HECM. Its base assessment matches ECM in month 2, then doubles from month 3. Sourced ladders.
Don't wait for enforcement. Start fixing the causes before you breach a limit. See Monitoring Thresholds for the full breakdown.
Skip it: you can miss a network program or processor warning. Acquirer sources report VAMP merchant-excessive assessments at US$8 per TC40 fraud report or TC15 dispute, with entry tests, grace conditions and exclusions. Your pass-through can differ. Mastercard ECM's USD base assessment is $0 in month 1, $1,000 in months 2-3, rising to $100,000 from month 19. Sources and full schedules. REPORTED Checked 22 October 2026. MATCH can follow termination when a reason code applies. It isn't an automatic next step after a fine.
See Chargeback Ratio Crisis for emergency response.
3. Post a Clear Refund Policy
The policy is a visible page telling customers how to get a refund, return something, or cancel.
What to do:
- Link your refund policy in your website footer, checkout page, and order confirmation emails
- Make cancellation possible in 3 clicks or fewer
- Include timeframes ("Refund within 30 days of purchase")
Skip it: customers who can't find your refund process call their bank. That's a chargeback.
See Refund Policy Design for templates.
What Matters at Your Size
| Your Monthly Volume | What to Focus On | What Can Wait |
|---|---|---|
| Under $10K | PCI SAQ, quarterly ASV scans if your site redirects to or embeds the payment form, clear refund policy, recognizable billing descriptor | Other items in this table |
| $10K-$50K | Above + monthly chargeback monitoring, subscription compliance if applicable | Formal audits, international compliance |
| $50K-$100K | Above + chargeback alerts, dispute monitoring | AML/KYC, multi-network optimization |
| $100K-$500K | Above + quarterly compliance review, network threshold tracking | Direct network relationships |
| Over $500K | Formal compliance program, consider outside counsel | Nothing - everything matters now |
Common Mistakes
| Mistake | What Happens | Fix |
|---|---|---|
| Ignoring PCI SAQ | Non-compliance fee + breach liability | Complete your SAQ every year, plus any required ASV scans |
| No billing descriptor | Customers don't recognize charges, file chargebacks | Set descriptor to your business name |
| Hard-to-cancel subscriptions | Chargebacks from frustrated customers | 3-click cancellation, pre-renewal emails |
| No chargeback monitoring | Breach threshold without warning | Monthly ratio check, alert before your processor's limit |
| Ignoring processor emails | Escalation to monitoring program | Check it's real in your provider account, then reply within 24 hours |
Subscription Businesses: Extra Requirements
Recurring billing adds obligations.
□ Disclose recurring terms before first charge (amount, frequency, duration)
□ Send renewal/billing reminders 7+ days before each charge
□ Make cancellation available online (no phone-only cancellation)
□ Cancellation flow completes in 3 clicks or fewer
□ Send confirmation when customer cancels
□ Stop charging within 3 business days of cancellation
Break these and the chargebacks pile up fast, and regulators notice too.
See Subscription Rules for the full requirements.
When to Get Professional Help
You need a compliance consultant or payment attorney when:
- Your chargeback ratio is climbing toward or above your processor's limit
- You're entering a network monitoring program
- You process over $500K/month
- You're expanding internationally (PSD2/SCA requirements)
- You receive a processor termination notice
- You handle sensitive data beyond basic card processing
This site and your processor's support team cover the rest.
Next Steps
Just starting out?
- Complete your annual PCI SAQ. If your own site redirects to or embeds the payment form, arrange quarterly ASV scans too.
- Check your billing descriptor
- Post a refund policy
Already processing?
- Calculate your chargeback ratio
- Review your subscription compliance if applicable
- Set up chargeback alerts
See Also
- PCI DSS - Cardholder data security requirements
- Network Rules - Visa and Mastercard mandates
- Dispute Monitoring - VAMP, ECM thresholds
- Chargeback Prevention - Stop disputes before they start
- Reduce Chargebacks Fast - Emergency playbook
- MATCH List - The merchant blacklist and how to avoid it