I'm surprised with how strict PCI compliance rules are for most integrations that a crusty OS with all sorts of holes is allowed to continue as the backbone of so many ATMs. I would think that something *NIX-y would be a solid bet at this point. Can't be worse than XP.