You're a code monkey. Your CEO stubbornly insists on a partnership with another company that potentially exposes customer financial data to hackers, and wants you to incorporate their product into your software.
The vulnerability exists in the first place because the other company's self-styled "security consultant" is demonstrably ignorant. You've already described in detail to the CEOs of both companies how the attack could be carried out, and how the "security consultant" is wrong. You've dumbed it down as much as you can and provided links to the technical explanations. The execs have stopped short of acknowledging that the risk actually exists, or that it could be mitigated very cheaply.
Has your obligation to your own company's customers and investors been fulfilled? If not, what should your next step be?
To avoid opinions or legal advice:
- Are there any government or industry guidelines regarding the risks and benefits of industry standard vs. "clever" DIY encryption schemes (similar to the guidelines regarding the use of SSNs in this answer) that can help bridge the gap between a programmer and a non-technical CEO?
- Are there any government or industry watchdog agencies that whistleblowers can turn to in this kind of situation?
- How would an employee obtain legal guidance on these kinds of issues? The company has no legal department, and outside lawyers are apparently only interested if you've already been fired or sued.