The data controller would be responsible for compliance, not its subcontractors or vendors. But this is theoretical, since GDPR is unlikely to apply in any case.
There are two cases to consider here: either the US merchant is subject to the GDPR, or it isn't.
If the merchant is not subject to the GDPR, then they can't violate the GDPR and there is no reason for authorities to pursue anyone else either.
Whether some processing of personal data is subject to the GDPR depends solely on the data controller, who determines the purposes and means of processing.
This does not depend on where, how, or by whom their processing activities are carried out.
But if the merchant (data controller) is subject to the GDPR, they have various responsibilities, for example only outsourcing activities to vendors or “data processors” that contractually guarantee certain data protection aspects. If the data controller fails to enter into such contracts, that's alone the data controller's fault.
On the other hand, a vendor cannot claim processor status without such a contract. They might otherwise be a data controller of their own. But this is very unlikely to be the case in this scenario, or more precisely: they are quite likely to be out of scope for the GDPR.
To determine whether data controllers (the merchant, and maybe their vendors) are subject to the GDPR, it is not sufficient to look at their disclosures. A controller can't “elect to not comply”, just as you can't “elect” not to pay taxes. Instead, the main question for non-European data controllers is whether they offer goods or services to people in Europe. Here, “offering” means an active intention such as targeting or marketing towards, or at least a reasonable expectation that there will be substantial amounts of users who are in Europe. Unless the merchant starts accepting Euros or advertises their shipping rates for customers in the EU, they are unlikely to fulfill this targeting criterion. Similarly, the regional US banks clearly do not target European customers, even if they process the occasional wire transfer to or from such people.
A vendor or service that wants to protect themselves could proactively require all its customers to enter into a GDPR-style data processing contract, though this is generally unnecessary. It's also unsuitable when the service needs to use the personal data for their own purposes. For example, a payment processor generally won't bind itself as a data processor, and needs to be a controller themselves.
Vendors should still take reasonable care and do due diligence regarding to how they perform their services. If they notice that they have a lot of European data subjects, it might be the time to start asking questions about whether GDPR would apply. I know of at least one company that got in trouble for offering services to people in Europe while claiming that it “did not know” that GDPR applied.
In this answer, “Europe” means EU/EEA/UK as appropriate.
