Does your client have a Credit Card Merchant to process credit cards?
If so, who is that merchant?
Does you client use a secure webhost (SSL account)? or will you be using
some remote processing, like PayPal? You can't accept customer credit card
account numbers, and information without a secure server.