A payment handler (e.g. Amazon, Netflix, Thames Water, Comcast) must not store CVV and must mask the PAN (card number), assuming that they are contractually bound to the Payment Card Industry Data Security Standard (PCI-DSS) by their bank.
The card issuer, however, has no such restrictions. They issued the card and they are ultimately responsible for storing its information safely. In all likelihood the card's funds will be protected by a mandatory insurance policy (either private or governmental), such as the Financial Services Compensation Scheme (FSCS) in the UK, and the bank will be liable for damages in the event of card fraud caused by their negligence.
Local law, however, may override this, though I am entirely unaware of any law governing the data security practices of financial institutes at this level of detail.