What you can do, is to reduce the risks to yourself, with reasonable means. By order of importance and least effort:
First, use a unique password for this company, do not reuse it elsewhere, even in part. That way, when the company leaks its database, your other accounts will stay safe.
Second, apply this advice for every website, because you never know, they could be insecure, too. Use a password manager to remember all those passwords; it can even generate new ones for you.
Third, as much as possible, limit the amount of identifying information to send them to the strict minimum. For example, use a dedicated e-mail address, or a redirection to your main address. You can open an (online) bank account just for them.
Fourth, call your bank and your debit/credit card provider (Mastercard, Visa...) to inform them that this company does not store your banking data securely and that you suspect they are not compliant with local laws and PCI-DSS. Tell them you are afraid this put your money at risk. Maybe they will do something, but most probably not: they might just let their insurance cover the costs in case of an incident. But at least you will have done what you can.