Ok, so basically the third party processors are very likely already compliant or close enough that they can likely get there with some minor policy and security tweaks to meet the audit.
Those doing their own merchant account may find their hosting and transaction processing just got a bit more complicated. If you store credit card numbers on your server, your ISP is going to have to secure it enough to withstand the audit. That could get funky to say the least.
20,000 transactions eliminates small sites. But if you have 1000 or so members you're going to push close to 20,000 by the time you figure in recurring and churn transactions, especially if you offer trials.
|