It would be illegal to do this in the US or Europe without the business being PCI compliant first.

You might want to offer up the country's laws you are familiar with before making offers like this.