Alternatively, could they have meant that it was too risky from a technology/security standpoint? Since it relates to a credit card company, I wonder if they want demonstrated data-security to mitigate risk on that level… Like perhaps being able to demonstrate PCI Compliance. Might be worth the question. Good luck!