Non-compliance costs money before anything goes wrong. Card brands assess a monthly penalty for as long as a merchant stays out of compliance, and the amount escalates the longer it runs. Requirements 6.4.3 and 11.6.1 became mandatory on 31 March 2025.
Assessment this month
$5,000 to $10,000 published range
Total assessed so far
$15,000 to $30,000 published range
Card brands publish an escalating scale rather than a single figure. Widely reported bands are $5,000 to $10,000 a month for the first three months, $25,000 to $50,000 for months four to six, and $50,000 to $100,000 from month seven onward. Within a band, the higher your card volume the closer to the top you are assessed, so this calculator uses merchant level to pick a point between the published low and high. It does not invent a figure of its own.
These assessments are only the visible part. A breach discovered while non-compliant adds a mandatory forensic investigation, card reissuance at $5 to $15 per card, credit monitoring, and higher processing rates. None of that is included above, which makes this a floor rather than an estimate.
Report URI produces a timestamped script inventory, continuous change detection and an exportable record of what browsers blocked and allowed — the evidence an assessor asks for.