In my inbox from the credit card department:
12 CFR 226.12(d) "states that the credit card issuer cannot offset a consumer's deposit account to pay an outstanding credit card balance"; but what about a card that is to a business?
I'm assuming it's the same if the card is to a business, but I haven't found anything explicitly saying that. (I cannot find anything in Illinois (GO ILLINI) state law either)