An eCommerce application I worked on several years ago underwent a security audit and one of their recommendations was to disable autocomplete for sensitive fields.
It wasn't a strict requirement, but it probably will be at some point, given how eCommerce standards are these days..