it's a way to exhert maximum control with minimal effort (in this case, talking about flow of capital)

https://en.m.wikipedia.org/wiki/Normalization_(sociology)

nice try mr sales person.

PCI tokenizer is pure snake oil.

"dear auditor, i do not store the credit card number, only an unique index to fetch it at any time on this rest service. i promisse it is totally not the same thing"

good luck trying to make thay avoid compliance work.