Merely touching plaintext data at some point is enough to get scoped into PCI requirements, even if only in memory. Of course because they're not processing th

Merely touching plaintext data at some point is enough to get scoped into PCI requirements, even if only in memory. Of course because they're not processing the payments, there's not a damn thing the networks can do to stop them; compliance can only be enforced when there's something to turn off (your merchant account) when you're not compliant. That's not the case here.