PCI scanning is required when credit card data is being accepted on your own web site or when your PoS machines are accessible remotely from the Internet. In the latter case, justification must me provided as to why they are accessible remotely.