The only thing that would worry me would be the liability potential. Is there a greater legal risk that a merchant runs if they process the data themself, rather than have it encrypted and send it straight to the gateway or bank software?