PCI-DSS can be quite an issue.
I've done about 8 audits and they are quite peaky about every single requirement.
But a lot of payment providers do handle payments PCI-DSS complient - so as long as you do not store credit card information but tokens or uids you are fine.
But still a good...