I'd assume that for such restaurants there are no auditors, they would do 'self-certification' where they fill out a questionnaire where they assert that they a

I'd assume that for such restaurants there are no auditors, they would do 'self-certification' where they fill out a questionnaire where they assert that they are not doing anything like this. The consequence is that if the data is leaked (finding 'common point of purchase' is sometimes done for sets of fraud) they can become fully liable for the cost of fraud because of this lie in self-certification, otherwise it would generally fall on the receiving merchant.