Unless you are a big company, PCI-DSS is "verified" by self-assessment. They can say whatever they want.

Volume is too low, but if there is a breach the business is done.