[igetspam]

It could but they should be able to provide an Attestation of Compliance. If they can't, then you can trust that they're PCI compliant.