Correct - PCI Compliance requires the holding company to pay for auditing of their systems quarterly I believe. You also have to ensure that the data is encryp

Correct - PCI Compliance requires the holding company to pay for auditing of their systems quarterly I believe. You also have to ensure that the data is encrypted at rest and in flight, etc. A distributed black box may pose more risks as well.