seansquared - 4:01 am on Aug 22, 2010 (gmt 0)

dickbaker, ALL businesses in the USA that accept payment cards (including Visa, MasterCard, Discover, American Express and JCB) are required to adhere to PCI-DSS.

Even those companies intelligent enough to offload the complete CC transaction stack as has been discussed above are required to adhere to PCI-DSS. They just have a much easier and cheaper time doing so than those companies who internalize any part of payment acceptance.