Is Square Up PCI Compliant? What the Answer Does and Does Not Mean for High-Risk Businesses

The Short Answer: Yes, Square Is PCI Compliant

Yes. Square is a Level 1 PCI-DSS compliant processor, the highest certification level under the standard. Because Square acts as the merchant of record, sellers who run their payments entirely through Square's hardware and software do not complete a Self-Assessment Questionnaire and do not validate PCI compliance on their own. Square states this plainly in its own documentation, and it is accurate.

If that is all you needed to know, you have your answer. For many of the business owners who ask this question, though, PCI compliance is not the thing that will decide whether Square works for them. We will get to that.

What Square's PCI Compliance Covers

When you process through Square's own stack, Square takes on the obligations most merchants associate with PCI:

• Certification. Square maintains its PCI certification as the merchant of record, so there is no annual validation on your side.
• No SAQ. Square does not require sellers to complete a Self-Assessment Questionnaire when its hardware and software handle the card data.
• No PCI compliance fees. Square does not charge a separate PCI compliance or noncompliance fee, which some processors do.

For a small, low-risk business running everything through a Square reader or Square's online checkout, that arrangement removes real administrative work. Credit where it is due.

Where Responsibility Stays With You

Square's compliance covers Square's environment. The moment card data touches something Square does not control, responsibility for that environment is yours.

That includes custom integrations, a separate checkout flow, card numbers taken over the phone and keyed into another system, and card details stored anywhere in your own records. Square cannot certify infrastructure it never sees. If your setup extends beyond Square's stack, you carry PCI obligations for that portion, and you should know exactly where the line sits before an acquirer or partner asks you to prove compliance.

What PCI Compliance Does Not Protect: Your Account

Here is the part Square's pages do not dwell on. PCI compliance protects card data. It does not protect your ability to accept payments.

Square is an aggregator. You are approved in minutes because the real underwriting happens after you start processing, not before. For most retail businesses, that trade-off never surfaces. For businesses in categories banks treat as high-risk, it surfaces as a hold or a closure, often after months of normal processing, and often with little explanation.

If your previous processor exited, or you operate in an industry aggregators restrict, the question is not whether Square is PCI compliant. It is whether Square will still be processing your payments in six months. A dedicated high-risk merchant account answers that differently: underwriting happens up front, the acquiring bank approves your business model before you take a single payment, and reserves, rolling holds and chargeback thresholds are put in writing before you sign. Approval takes longer than a Square signup. What you get in return is an account built to stay open.

PCI Compliance With a Dedicated High-Risk Account

Leaving an aggregator does not mean taking on PCI validation alone. A properly structured dedicated account pairs you with compliant infrastructure at every point where card data moves.

For in-person payments, we supply PCI-compliant POS systems and card readers. For online payments, the gateway handles encryption and tokenization. If you are comparing gateways, start with what to require from a PCI-compliant payment gateway, and see our breakdown of whether Authorize.net is PCI compliant.

One note for healthcare merchants: PCI and HIPAA are separate obligations, and meeting one does not satisfy the other. If you handle patient payments, you need HIPAA-compliant payment processing alongside PCI-compliant card handling. We can structure both in the same account.

Next Steps

If Square's model fits your business, its PCI coverage is a genuine convenience and you should use it. If your industry is one aggregators restrict, PCI compliance will not keep your account open — the fix is underwriting that happens before you process rather than after. Send us your recent processing statements and we will tell you within two business days whether we can place your business and under what terms.