There's no reason for each site to roll their own card provider or for there to be a central authority. There could easily be 5 or 7 companies providing this product and sites could choose to accept any or all of them.