Can a merchant obtain PCI DSS certification without the involvement of their acquiring bank?