This is probably driven more to 'which logged in customer to an account set the credit card on their account' than an internal control, but both are important for PCI compliance.