rachel123 and Leosghost, thanks again so much for your answers.
Leosghost, thanks for the links and the terminology to search for as well as the links. As you say, the legwork is up t me.
One thing is certain. We will NOT do this. Despite the attractiveness of the project as a whole, we will not on this liability and I will make it clear to them, that that ePCI compliant-part could well mean we'd pass on the liability to them directly. The levele of fines mentioned there are eloquent.