That article is very much a scare tactic. The actual stipulations listed in Visa's terms do not sound nearly as bad: http://usa.visa.com/merchants/risk_manage

That article is very much a scare tactic. The actual stipulations listed in Visa's terms do not sound nearly as bad: http://usa.visa.com/merchants/risk_management/cisp_payment_applications.html#anchor_3 http://usa.visa.com/merchants/risk_management/cisp_payment_a... While the use of PA-DSS validated payment applications is recommended, a payment application need not be included on Visa’s list of PABP validated payment applications or PCI SSC’s list of PA-DSS validated payment applications in order to comply with Phase 2, Phase 3 and Phase 5 requirements for use of PA-DSS compliant applications. Acquirers may determine the PA-DSS compliancy of a payment application through alternate validation processes, which should confirm that payment applications meet PA-DSS requirements and should facilitate compliance with the PCI DSS. I was unable to find the corresponding clause for MasterCard, American Express, or Discover, and various forum posts I came across seemed to indicate it was a Visa-only mandate currently.