I am going to sound contrarian, but I don't mean to be.
How does this violate PCI-DSS? The data itself is likely stored somewhere secure (who knows) – what's being displayed in the web app is the last four digits of the card and expiration date, this isn't where it's stored.
There is obviously a question of what the retention should be, but it's definitely the case that payment information can be transferred between companies.
The whole situation exudes a lack of trust, but it's not clear to me that PCI compliance is a problem here.
How does this violate PCI-DSS? The data itself is likely stored somewhere secure (who knows) – what's being displayed in the web app is the last four digits of the card and expiration date, this isn't where it's stored.
There is obviously a question of what the retention should be, but it's definitely the case that payment information can be transferred between companies.
The whole situation exudes a lack of trust, but it's not clear to me that PCI compliance is a problem here.