So banks are known as "issuers" in PCI DSS, in section 3.2 of PCI DSS you can note in the guidance
Entities that issue payment cards or that perform or support issuing services will often create and control sensitive authentication data as part of the issuing function. It is allowable for companies that perform, facilitate, or support issuing services to store sensitive authentication data ONLY IF they have a legitimate business need to store such data.
Further it states that,
For non-issuing entities, retaining sensitive authentication data post-authorization is not permitted.
Because they issue cards, they're allowed.
To answer your second question, if you need the CVV code to authenticate a recurring payment, tokenization is generally how to work around needing the CVV. You submit the payment information to the processor, they give you a token back representing the information, which can then be used later to submit a payment with their payment credentials, but does not contain any actual information of the client and can be safely stored. This allows you to submit payment without the CVV for recurring payments.