We just got blindsided with a $16,500 charge from Experian for a security audit. Previously they accepted out PCI letter now they insist on selecting an auditor and sending them onsite for us to continue using their API. Maybe this will become the norm gong forward? Any vendor you get PII from will insist on you paying for an audit of their choice?