The annual fee, the PCI fee,
the "regulatory" fee: which are real costs

Every merchant statement eventually reaches a section titled something like "Other Fees" or "Regulatory & Compliance," and it is the section most owners skim past fastest — the names sound official, so the fees feel non-negotiable. Some of them genuinely are. Visa and Mastercard set network fees that every acquirer in the country passes through identically; no amount of relationship-building moves those numbers. But "PCI compliance fee," "annual fee," and "regulatory fee" are not network fees. They are line items your processor invented, priced, and can just as easily remove. Conflating the two categories is how a fair statement and a padded one end up looking identical at a glance.

This is a plain accounting of which fees are genuinely fixed by the card networks, which are processor markup wearing a compliance costume, and what changed in 2026 that makes one of the most common "regulatory" line items harder to justify than it used to be.

The fees nobody negotiates: real network costs

These come from Visa and Mastercard directly. They apply to every acquirer and every processor equally, they show up itemized (or buried) on every interchange-plus statement, and no sales rep — however aggressive — can talk them down, because the rep isn't the one setting them.

• Assessment fee — a percentage the card brands charge on your total volume, typically 0.13%–0.165% depending on the network and transaction type. It funds the brand itself, not your processor.
• Visa Network Access and Brand Usage fee (FANF-adjacent, per-transaction) — $0.0195 per domestic settled transaction, $0.0295 for international. This is a flat per-swipe charge layered under the percentage rate.
• Visa Base II Network Access Fee — a smaller per-transaction network fee, currently $0.0025 per settled transaction, covering the base clearing and settlement network.
• Mastercard cross-border assessment — for non-DCC cross-border transactions, this rate is rising from 60 basis points to 100 basis points effective July 20, 2026, a real, brand-mandated increase that will show up on statements for merchants with any international card mix.
• Mastercard Digital Enablement Fee — restructured April 6, 2026, to a tiered per-transaction model: roughly $0.025 minimum on tickets under $100, scaling to $0.50 on tickets over $2,000.

A processor can waive its own PCI fee tomorrow with one phone call. It cannot waive Visa's assessment fee — that check goes to Visa either way.

The fees your processor invented: markup with a compliance name

These three show up on nearly every statement in the industry, and every one of them is set — and can be un-set — by your processor, not by a card network.

• PCI compliance fee — commonly $5–$20/month. The PCI Security Standards Council does not bill merchants directly; filing your annual Self-Assessment Questionnaire (SAQ) costs nothing from the Council itself. The one real, external cost is a quarterly external vulnerability scan from a PCI-Approved Scanning Vendor, required only for merchants storing or transmitting card data over the internet — those scans run roughly $100–$500 per quarter. If your processor charges a flat monthly PCI fee regardless of whether a scan applies to you, or on top of a scan you already pay for separately, that gap is pure markup.
• Annual fee — a flat charge, often $79–$149, billed once a year for no specific deliverable beyond "maintaining your account." There is no card-brand equivalent to point to; it is simply a margin line a processor chose to add.
• "Regulatory" or 1099-K fee — a monthly or annual charge tied to the processor's obligation to report your card volume to the IRS on Form 1099-K. That reporting obligation is real for the processor. But the threshold that triggers it changed materially in 2026: the One Big Beautiful Bill Act, signed July 2025, reversed a multi-year phase-down and restored the original $20,000-and-200-transaction threshold for 2025 and beyond. A large share of small merchants never cross that line, which means many are paying a monthly "regulatory fee" for a filing obligation that, for their account, does not currently exist.

Why the distinction changes the negotiation

When a merchant calls a processor to push back on fees, the two categories deserve completely different scripts. Pushing a rep to lower the Visa assessment fee is a wasted call — they are contractually required to pass that cost through, and doing otherwise would put their own acquiring relationship at risk. Pushing them on the $15/month PCI fee, the $99 annual fee, or a "regulatory" line that predates the 2025 threshold reversal is a call with real room to move, because that money was never obligated to a third party in the first place — it stayed with the processor.

The practical move: ask your processor for an itemized breakdown that separates "network fees" (Visa/Mastercard-set, pass-through, non-negotiable) from "processor fees" (everything it chose to add). A processor that resists giving you that split is usually the one with the most to lose by showing it — see our line-by-line guide to reading a merchant statement for the exact labels to look for.

A short, honest checklist

• Ask directly: "Which of my fees are set by Visa or Mastercard, and which do you set?" A processor should answer this without hedging.
• Confirm your SAQ status. If it's filed and current, ask why a monthly PCI fee is still charged — and whether a quarterly scan even applies to your business type.
• Ask whether your account crosses $20,000/200 transactions annually with any single processor. If not, ask what the "regulatory fee" is actually funding for your account specifically.
• Request the annual fee in writing before renewal and ask what it buys beyond account maintenance you're already paying for through your rate.

Frequently asked questions

Is the PCI compliance fee a real cost or processor markup?

Both, depending on what it covers. The PCI Security Standards Council does not charge merchants directly — a self-assessment questionnaire (SAQ) costs nothing to file. Your processor's monthly PCI fee is its own charge for administering that process, and quarterly external vulnerability scans from an Approved Scanning Vendor run roughly $100 to $500 per quarter if your business type requires them. The fee is legitimate only up to the actual scanning cost; anything charged on top, or charged when no scan is required, is markup.

What network fees can a merchant not negotiate away?

Visa and Mastercard assessment fees (roughly 0.13% to 0.165% of volume) and per-transaction network fees like Visa's Network Access and Brand Usage fee ($0.0195 domestic, $0.0295 international per settled transaction) are set by the card brands and passed through by every processor identically. No processor negotiates these down — they can only choose whether to mark them up further inside a bundled rate.

Do merchants still need to worry about the $600 1099-K threshold?

No. The IRS had phased the Form 1099-K reporting threshold down toward $600, but the One Big Beautiful Bill Act, signed July 2025, restored the original $20,000-and-200-transaction threshold for 2025 and beyond. Most small merchants processing under that volume will not receive a 1099-K at all, which makes a processor's ongoing "1099-K regulatory fee" worth questioning directly.

What is a fair way to sort a merchant statement's fixed fees?

Split every flat and percentage line into two buckets: fees set by Visa or Mastercard (assessment fees, network access fees) that are identical across every processor and cannot move, and fees your processor sets itself (annual fee, PCI fee, regulatory fee) that exist because it chose to charge them and can just as easily choose to waive them.