My other counter argument is that if a PAN is included in a SAR, it is likely connected to fraudulent activity and is no longer active so I do not see any PCI risk.
_________________________
Sola Gratia, Sola Fides, Sola Scriptura, Solus Christus, Soli Deo Gloria!
www.tcaregs.com