PCI compliance mandate's power raises conflict-of-interest questions