A recurring credit card payment is a charge a business makes to a customer's stored card on a fixed schedule, under an agreement the cardholder gave once. The customer takes part in the first payment. After that, the business starts each charge itself.
That split decides the rest: what the customer must agree to, how each charge is labeled for the card issuer, what you may store, and what happens when a charge is declined or disputed.
Quick answer: A recurring credit card payment uses a stored credential (a card number or token kept on file) to charge the customer at fixed, regular intervals. The cardholder takes part in the first payment and consents to the card being stored. Later charges are merchant-initiated transactions, sent without the cardholder's involvement, and they are valid only while the agreement is.
What a recurring credit card payment is
Card networks define the term narrowly. Visa's guide to stored credential transactions, published in 2017, describes a recurring payment as one of a series of transactions that use a stored credential and are processed at fixed, regular intervals, no more than one year apart, under the cardholder's agreement that the merchant will initiate them.
A stored credential, in the same guide, is information such as an account number or a payment token that a merchant or its agent keeps to process future transactions. "Card on file" is the everyday name. A card kept only to finish one purchase doesn't count. The guide was still on Visa's site when checked in October 2026, but it is from 2017, so confirm current requirements with your acquirer.
Visa sorts charges made under a standing instruction from the cardholder into three types.
| Type | What it is, in Visa's terms | Example |
|---|---|---|
| Recurring | Charges at fixed, regular intervals, no more than a year apart | A magazine subscription (Visa's example) |
| Installment | One or more future charges over a period for a single purchase | One purchase paid off in three monthly parts (illustration) |
| Unscheduled credential on file | A fixed or variable amount with no scheduled date | An automatic account top-up (Visa's example) |
The definition turns on the schedule, not on a fixed price. Visa's consent rules ask for the transaction amount "or how it will be calculated".
The first payment and the ones after it
Every recurring series has two phases, and the card networks treat them differently.
One sign-up with the cardholder taking part, then scheduled charges the business starts itself.
The first payment is cardholder-initiated. Visa calls any transaction in which the cardholder actively takes part a cardholder-initiated transaction, or CIT. When a card is stored for the first time, the guide requires the merchant to follow Visa's disclosure and consent rules and to send a payment, or an account verification request if nothing is due yet, that identifies the card as being stored. If that first request is declined, the card can't be treated as stored and must not be used for later charges.
Later payments are merchant-initiated. A merchant-initiated transaction, or MIT, is one the merchant starts without the cardholder's active participation. Each one is sent with indicators showing that it uses a stored credential and belongs to a recurring series. Visa's guide says that identifying these transactions gives issuers greater visibility of risk and results in higher approval rates. Your payment processor or gateway sets the indicators, so ask how it marks the first charge and the later ones.
Take a customer who signs up on January 12, 2026 for a plan at $120 a month. The $120 paid that day is the cardholder-initiated payment. The charges on February 12, March 12, April 12, May 12 and June 12 are merchant-initiated. By June 12 the business has collected 6 × $120 = $720 on one act of consent.
In the EU, the customer authenticates at set-up
The EU's revised Payment Services Directive requires strong customer authentication for electronic payments. The European Central Bank describes it as two or more of three elements: something the customer knows, something they hold, and something they are.
An answer the European Banking Authority published in March 2019, Q&A 2018_4031, covers card payments that a payee initiates under a mandate from the payer. When the mandate is given through a remote channel, it says, setting it up is subject to strong customer authentication. Later payments that need no specific action by the payer can be treated as payee-initiated, and payments initiated by the payee alone are not subject to it.
Expect an EU customer to confirm their identity with their bank at sign-up. The step protects them, and it isn't something to design around. The Q&A is an unofficial opinion, not a binding ruling, so have your acquirer or a lawyer confirm what applies to you.
The agreement and notices card networks expect
The cardholder's agreement is what makes each later charge legitimate. Visa's guide says it must be in place before the card is stored, and lists its contents.
For any stored card:
- a truncated version of the card number, such as the last four digits
- how the stored card will be used
- how the cardholder will be told about changes to the agreement
- when the agreement expires, if it does
When the merchant will start the charges, also:
- the amount, or how it will be calculated
- the frequency of the charges, or the event that triggers them
- the cancellation and refund policies
- the merchant's location
- any convenience fee or surcharge, where one is permitted
The merchant must keep the agreement for as long as the consent lasts and give it to the issuer on request. No charge may be completed after the agreed duration has ended, after the cardholder cancels under the agreed policy, or after they ask to change the payment method.
Notices come on top. Visa's policy for subscription merchants that offer free trials or introductory offers, a June 2019 notice for its regions outside Europe, restates an existing rule that the cardholder must expressly consent to an ongoing subscription at enrollment. For merchants that offer free trials or introductory offers that roll into a subscription, it adds an electronic copy of the terms, an easy way to cancel online, and a reminder, with a link to online cancellation, at least seven days before a charge when the trial has ended or the terms have changed.
Mastercard's FAQ on its standards for subscription merchants, updated in November 2022, says the standards took effect on September 22, 2022 and apply equally to business and consumer customers. A merchant in scope sends a confirmation email with the subscription's terms, and an electronic receipt after each billing, with instructions for canceling, is recommended (both checked October 2026).
A real agreement can fit on one page. The University of Guam's credit card authorization form has the cardholder authorize a stated amount on the 30th of every month, says the authorization stays in effect until it is canceled in writing, and asks for 15 days' notice before the next billing date of any change or termination.
Note: Network rules are not the law. Consumer laws add consent and cancellation requirements of their own, summarized in the guide to setting up recurring payments. Have a lawyer review your sign-up wording.
Tokens and account updater services
A token is a substitute for the card number. EMVCo's payment tokenisation framework describes a payment token as a unique alternative value that replaces the primary account number (PAN) and can be limited to a specific merchant, device or payment scenario. EMVCo says this reduces the value of payment data that is stolen or compromised.
Stored cards also go stale. Cards expire, get reissued with new numbers, or are closed, and a charge sent with out-of-date details can be declined. Visa describes its Account Updater as a service through which issuers report new account numbers, new expiration dates and closed accounts, and enrolled merchants ask about their stored cards through their acquirer. Ask your processor whether it runs updates for you, and for which card brands.
Security duties when you keep cards on file
Anyone who stores, processes or transmits card data falls under PCI DSS, the card industry's data security standard. The PCI Security Standards Council's page for merchants says it applies regardless of size or transaction volume, and that validation requirements come from the payment brands and the merchant's acquirer.
One rule bears directly on recurring billing. The three- or four-digit card verification code may not be kept once the transaction it was collected for has been authorized. A PCI SSC FAQ says these codes are not needed for card-on-file or recurring transactions, that encryption doesn't make storing them acceptable, and that a customer's permission doesn't either.
An institution can set stricter rules of its own. Boston University's card data policy forbids departments from keeping card numbers on any computer, server or database, spreadsheets included, and lets them store only the last four digits (checked October 2026). The less card data sits in your own systems, the less there is to protect.
Why recurring card payments fail
A renewal can be declined even when the customer wants to keep paying. The causes include an expired or replaced card, insufficient funds, an issuer decline, and a request for authentication that an absent customer can't answer.
What you may do next depends on the reason. Visa's rules allow no reattempt for declines the issuer will never approve and up to 15 reattempts in 30 days for declines it may approve later. The guide to handling a failed payment explains those categories and gives a retry and reminder schedule.
Cost and dispute exposure compared with bank debits
Take one processor's published US prices as an illustration, not a recommendation: Stripe's pricing page lists 2.9% + $0.30 for a domestic card payment and 0.8%, capped at $5.00, for an ACH Direct Debit (checked October 2026).
For the $120 monthly charge above:
- Card: $120 × 2.9% = $3.48, plus $0.30, is $3.78.
- Bank debit: $120 × 0.8% = $0.96.
- Over 12 payments: $3.78 × 12 = $45.36 by card and $0.96 × 12 = $11.52 by bank debit, a difference of $33.84.
On a $1,500 payment the card fee is $1,500 × 2.9% + $0.30 = $43.80, while the debit fee stops at the $5.00 cap. The guide to payment processing fees explains where the card fee goes.
| Recurring card payment | Recurring ACH debit (US) | |
|---|---|---|
| Fee on $120 at the example prices | $3.78 | $0.96 |
| Answer at the time of the charge | The issuer approves or declines | None. A return can arrive days later |
| How the customer reverses it | A dispute through the card issuer | A return through their bank |
| Average payment in 2024 | $96 for general-purpose credit cards | $1,647 |
The averages are from the Federal Reserve Payments Study. The guide to the recurring ACH payment covers the debit side, including the 60 days in which an unauthorized consumer debit can be returned.
Cards leave money open to challenge as well. In the United States, Regulation Z gives a consumer with a credit card 60 days from the statement to notify the issuer of a billing error, and card network rules run alongside. Visa's dispute guide for merchants (June 2024) has a dispute condition named Cancelled Recurring Transaction, which applies when the cardholder withdrew permission to charge the account. Acting on a cancellation the day it arrives removes that dispute reason, and chargeback prevention covers the others.
Frequently asked questions
Is a recurring credit card payment the same as a subscription?
No. The subscription is the commercial agreement: a plan, a price and a renewal date. The recurring credit card payment is one way to collect it, alongside bank debit and invoicing.
Do I need the card's security code for each recurring charge?
No. The PCI Security Standards Council says card verification codes are not needed for card-on-file or recurring transactions and may not be stored after authorization. Ask your acquirer or processor how later charges should be submitted.
Can I keep charging the card after a customer cancels if they still owe money?
No. Visa's dispute guide says a merchant is prohibited from billing the account after a cancellation request and must ask for another form of payment if a balance is due.
