Because you've coded to an implementation, the DAO isn't injectable. If you want to make the service testable, the DAO should be mockable such that you can test *just* the logic in the withdraw() method.
(I know it's just an example, or at least I assume it is, but the credit limit logic is (a) hardcoded, and (b) likely in the wrong place.)