Is PCI compliance mandatory? The bottom line