If you process < 20k online transactions per year you can skip a lot of the requirements.