I have a requirement to store a credit card number(not token) on a supplier employee record.

I have a requirement to store a credit card number(not token) on a supplier employee record. We have 2 options identified: 1 store at supplier header in a DFF and maintain directly on the supplier record and 2 put in a hidden DFF on the supplier site and maintain through FBDI sheet. Any other ideas where to store and best to maintain with the lowest risk?

Oracle recommends not storing any credit card numbers in DFFs but the client knows this and still wants to move forward. We have reporting requirements around this for p-card integrations.