Rather than focusing on the nasty PCI compliance stuff there could be a bigger opportunity to work a layer higher. Think business tools for managing and measuring subscriptions across different services. Recurly, Chargify et al seem to have stagnated on that front, probably because they're having to spend so much time on retaining PCI compliance while scaling.