The requirements for PCI compliance have been described as 'woefully inadequate'.