> If the bank processes the payment, but you've collected no information, you can't run afoul of the law (since you have no information).

Don't have server logs with IP addresses? Don't collect an email for the user to use to log in? Don't receive customer support recieve from these users?