It took us months to get a payment system for my start up in Australia. Its a nightmare. You are correct in thinking there are only two options - a merchant account or a service like paypal or authorize.net. However, if you have a merchant bank account and use a 3rd party gateway, you are submitting and storing the credit card information on the gateway and not on your own server, therefore PCI DSS complaince is not required. Many credit card gateways have APIs so that you can create a seamless experience if you wish. I would certainly try approaching the banks for a merchant account. Our company was fairly new when we got our merchant facility and there was never any concern about how old the business was. They were more interested in the type of product and thus the risk of getting charge backs. The bank may also be happy to provide the facility for a security deposit. Also, before you make a final decision, compare all the charges and how much the facility is going to cost your business. The charges seem to vary dramatically between banks and providers.