Guides
Payment card fines and assessments: does cyber insurance pay?
How card-brand fines and assessments reach a merchant, what Visa requires after a compromise, and three tests for whether a cyber policy pays PCI costs.
Sometimes, and only if the policy was built to. Card-brand fines and assessments come to a merchant through its acquiring bank under the merchant agreement, and a cyber policy pays them only if it has a PCI coverage grant, if its contractual liability exclusion is carved back for these amounts, and if the sublimit is big enough for what the card brands bill. A policy that lacks any of the three can leave a six-figure bill uninsured even though a breach claim is otherwise covered.
How PCI charges reach a merchant
The PCI Security Standards Council writes the Payment Card Industry Data Security Standard (PCI DSS) but does not enforce it. Its own guidance says the card brands run their own compliance programs, decide any non-compliance penalties, and delegate to acquiring banks to set what merchants must do. The version in force is PCI DSS v4.0.1: PCI SSC retired v4.0 on December 31, 2024, and the requirements that were future-dated became effective March 31, 2025. The Council opened a request for comments in June 2026 on whether to revise v4.0.1, but no new version had been announced when we checked.
The money moves in a chain. A card brand assesses the acquiring bank. The bank, under the merchant services agreement it holds with you, passes the charge to you, often by debiting your settlement account or demanding indemnity. Jones Day described this flow in a 2015 analysis of cyber policy wording. That is why PCI costs are a contract problem as much as an insurance problem.
| Charge | Source | Typically insured? |
|---|---|---|
| Forensic investigation (a PCI Forensic Investigator, or PFI) | Card brand requires it; you hire and pay | Usually under breach response, if the carrier consents |
| Fraud recovery and operational reimbursement (issuers' fraud losses and card reissue costs) | Card brand program, assessed through the acquirer | Only if the PCI grant includes them; check the definition |
| Fines and non-compliance assessments | Card brand rules or the merchant agreement | Often sublimited, sometimes excluded |
| Chargebacks and reimbursements | Acquirer under the merchant agreement | Depends on wording |
| Cost to fix your systems | Your own spending | Generally not; this is betterment |
What Visa requires after a compromise
Visa's What To Do If Compromised document (version 10.0, effective June 25, 2026) shows how fast the clock runs. Any merchant that suspects or confirms unauthorized access to Visa account data must report to Visa within three calendar days, send an incident report within three days after that, along with supporting PCI DSS compliance documentation when it is available or requested. If Visa requires a PFI, the entity has five business days to sign a contract with one, and Visa will not accept reports from a firm that has served the entity as a security consultant or assessor in the last three years. Level 1 and 2 merchants are more likely to be required to hire a PFI. Visa also tells entities not to turn off or reboot compromised systems, but to isolate them and preserve logs, which matches building an incident response plan your insurer will like.
Two cost features are in that document. If a PFI investigation is not finished within four full calendar months, Visa may impose a flat $3,000 fee on a Level 3 merchant investigation, or $10,000 per month for Level 1 and 2 merchants and others. And failure to meet the reporting and investigation steps can bring non-compliance assessments of up to $100,000 per incident, with a tiered schedule of $5,000, $10,000 or $25,000 for Level 3 merchants depending on annual transactions, which Visa may raise to $100,000 on the facts. Those assessments are written for Visa members, so for most merchants they arrive through the acquirer. Merchant levels follow annual Visa transaction counts: Level 1 is over 6 million, Level 2 is 1,000,001 to 6 million, and Level 3 is up to 1 million, since Visa merged Levels 3 and 4 on April 25, 2024.
Outsourcing payments does not remove the duty. PCI SSC says merchants that outsource all processing must still validate compliance, typically with a Self-Assessment Questionnaire such as SAQ A, and should confirm requirements with their acquirer or card brand.
Does cyber insurance pay: three tests
1. Is there a coverage grant, and what does it define? Policies word this differently. Jones Day compared one form that covers PCI amounts the insured is legally obligated to pay, one that excludes fines imposed by self-regulating organizations unless endorsed, and one that limits covered fines to those expressly defined and quantified in card company rules. Chubb's publicly posted Cyber ERM Version 2.2 (a UK form, not a U.S. policy) is a useful model of a clear definition. It defines Payment Card Loss as monetary assessments, fines, penalties, chargebacks, reimbursements and fraud recoveries that the insured must pay as a result of a privacy and network security wrongful act and that are due to non-compliance with PCI DSS. It does not include fines for continued non-compliance after three months from the initial assessment, or the cost of improving your controls.
2. Does the contractual liability exclusion get out of the way? In P.F. Chang's China Bistro, Inc. v. Federal Insurance Co. (D. Ariz. 2016, No. CV-15-01322-PHX-SMM), a federal court held there was no cyber coverage for more than $1.9 million of card assessments because the restaurant's liability arose from its indemnity agreement with its acquiring bank, and the policy excluded liability assumed by contract without the usual carve-outs. Covington's 2016 summary is on Inside Privacy. The case settled on appeal, so the district court opinion stands as the main authority. Many forms now restore coverage. The Chubb form's contract exclusion, for instance, does not apply to Payment Card Loss. Ask for that sentence in your policy. See common cyber insurance exclusions and contractual liability.
3. How big is the sublimit, and does it erode the aggregate? PCI coverage is usually a sublimit. Chubb's form lists Payment Card Loss as a separate sublimit on the schedule. A sublimit that sits inside the policy aggregate also uses up the aggregate, and a sublimit that is too low for your volume leaves you retaining the difference.
An additional point: some carriers may sublimit or exclude PCI costs if you cannot show compliance, and Corvus says in a 2022 article that after a breach the burden of proving compliance falls on the merchant. Keep your current Attestation of Compliance and SAQ in the file.
State laws that add liability
Several states have written card-data rules that change the merchant's exposure.
- Minnesota. Minn. Stat. 325E.64 bars a business from keeping the card security code, PIN verification code or full magnetic stripe contents after a transaction is authorized (48 hours for PIN debit). If the business, or its service provider, violates this and a breach follows, it must reimburse the issuing financial institution for reasonable costs such as reissuing cards, blocking accounts and notifying cardholders. See Minnesota.
- Nevada. NRS 603A.215 requires a data collector that accepts payment cards to follow the current PCI DSS and gives a safe harbor from breach damages if it complied and was not grossly negligent. See Nevada.
- Washington. RCW 19.255.020 makes businesses processing more than six million card transactions a year, processors and vendors liable to financial institutions for reasonable reissuance costs caused by a failure to use reasonable care, with safe harbors for encrypted data and for entities validated as PCI compliant in the year before the breach. See Washington.
Laws vary and change, so check your state in state privacy laws and what they mean for business insurance and with counsel.
A court has also enforced card-brand assessments
In Visa, Inc. v. Sally Beauty Holdings, Inc. (Tex. App.-Fort Worth, No. 02-20-00339-CV, Dec. 9, 2021), the court of appeals held that the trial court erred in treating a Visa liquidated-damages provision as an unenforceable penalty, finding it presumed valid. The Texas Supreme Court denied review on June 16, 2023. It is one court's view under the contracts and law involved, but it shows that merchants have not always been able to escape card-brand assessments by calling them penalties, which makes the insurance question more important.
A hypothetical: a restaurant group
Say a three-location restaurant group (Restaurant insurance) is a Level 3 merchant and has POS malware that exposes card numbers for several months. This is invented to show the mechanics. It has a $1 million cyber limit with a $250,000 sublimit for PCI costs inside the aggregate. Its acquirer bills it $400,000 under the merchant agreement. The PFI invoice falls under breach response. The policy pays the PCI amount to the sublimit, if the form carves back the contract exclusion, and the group retains the remaining $150,000. If the form lacks the carve-back, the group may be arguing the whole $400,000 with its carrier.
What to do before you need it
- Read the merchant agreement for indemnity, chargeback, reserve and assessment pass-through terms. Ask your acquirer for your merchant level and validation method.
- Ask your broker for the PCI wording, the sublimit, whether it erodes the aggregate, and whether the contract exclusion is carved back.
- Match the sublimit to realistic exposure: number of card records, card-present or online, and how many months a compromise could run undetected.
- Shrink your scope with hosted payment pages, tokenization or point-to-point encryption, and never store sensitive authentication data.
- Write the card-brand notice steps into your incident plan, and call the carrier the same day as the acquirer.
- Keep the compliance paperwork current. See the cyber insurance readiness checklist.
Key takeaways
- PCI SSC sets the standard. Card brands and acquirers collect, and the cost reaches you through the merchant agreement.
- A cyber policy pays PCI costs only if it has a PCI grant, a contract-exclusion carve-back and a sufficient sublimit. P.F. Chang's shows what happens without them.
- Visa's current rules require a report within three calendar days and, if directed, a PFI contract within five business days.
- Minnesota, Nevada and Washington impose their own card-data rules, so state law can raise your exposure.
- Read the merchant agreement with your broker before a breach, not after.