Processing payments is all about security. Because PSP’s themselves are PCI-certified, we don’t have to explain to you how important online security is on the internet. 

Market security, strengthen your branding. Why won’t you offer PCI-services to your merchants? Every merchant being hacked, means also risk and branding damage for the PSP. The chain is as strong as the weakest link…

Also from a legal perspective it’s better to secure your merchants as well. 

Although most merchants use URL-forward payment pages (PSP-hosted), the following situations may still occur:

• Merchants still could posses credit card numbers based on other MO/TO-channels
• Some merchants provide service by processing card transactions filled in on their own e-commerce payment pages (card numbers kept on file at the merchant location)
• Because of chargeback’s; the merchant keeps credit card numbers on their own systems
• Merchants can be hacked and the user-id/password combination of the PSP-admin is misused. Credit card numbers misused due to this situation still fall within the responsibility of the merchant. Penalties of Visa International/MasterCard International will go directly from acquirer to merchant. 
• Due to the fact that the PSP is not mentioned in the contract between acquirer & merchant… Are you as PSP willing to explain this to your merchants?
• If a PSP is hacked (like CardSystems, 40.000.000 credit card numbers stolen) the merchant keep liable to any damage of stolen card numbers being fraudulent used afterwards…