The reason Authorize.net won't store the CVV number is because it's illegal to keep the CVV.(1)
Out of curiosity, do you say this is illegal b/c of some contract or b/c of the PCI security standards? It's my understanding you may be penalized if you say you're PCI compliant but not, but I'm not sure you can be prosecuted for this unless you have a link to a clearer explanation of how the rules apply. 
Joined: 08/07/2007