Firing was the correct move. You may be protected for refusing to commit a crime, but violating PCI-DSS isn't a crime. Businesses are free to choose which of their contracts to violate and accept the risk attached to that. You could have anonymously reported the violation to the bank.
