What happens to a Merchant who has been designated as a CPP?
When fraudulent use of credit cards has been detected, usually the payment brand or the Acquiring Bank will have a QSA investigate the cause(s) of the compromise. The Merchant must comply with the investigation and if the merchant is determined to be non-compliant with the PCI-DSS, they will incur significant penalties, charge backs, and fines.