I’ve worked on payment systems. It is very hard to federate unless something like Stripe is used for actual payment.

Credit card companies simply won’t interface with you unless you prove their data is safe. It isn’t a process that scales well.

Brick and mortar companies get around this by having payment terminals which are insanely locked down. (Which is also why those terminals mostly suck)