Is PCI compliance required by law