Generally, no federal law requires PCI compliance. However, some states like Washington, Nevada and Minnesota mandate compliance with PCI DSS. Additionally, credit card companies may require compliance under their contracts with an organization.