Who sent you the email? Intuit or Security Metrics? I haven't received anything from Intuit stating I had to use Security Metrics to be PCI compliant. I am PCI Compliant, but I don't use Security Metrics. They did hound me until I showed them proof I was compliant. Then they literally disappeared. While I'm very disappointed in Intuit at the moment from subscription transfer issues to QB checking envelopes for autopayroll that do not work as described all the time, I think the Security Metrics has overstepped their boundaries unless Intuit has bought them out too and we now have to follow their rules. Until I see this, I'm listening to QB Payments rules and staying PCI compliant as I have been and will continue to do so. So I'm not leaving until they tell me to.