Payments glossary · Methods

Card-on-File and Recurring Payments

Card-on-file, or a stored credential, means a merchant or its provider keeps a customer's card details, usually as a token, with the customer's consent so they can be charged later for one-click checkout, subscriptions, instalments or usage-based billing.

How Card-on-File and Recurring Payments works

Card schemes distinguish two kinds of payment with stored cards. Cardholder-initiated transactions (CITs) happen while the customer is actively paying, for example clicking buy with a saved card. Merchant-initiated transactions (MITs) are charged without the customer present under an earlier agreement: recurring subscriptions, instalments, unscheduled top-ups, delayed charges and no-show fees. Visa's rules require the customer's express informed consent to an agreement before a card is stored, covering how the credential will be used, the amount or how it is worked out, timing and any trial period.

Correct flagging matters. It tells the issuer why a payment is happening without the customer present and links each MIT back to the original authorisation, which supports higher approval rates. In the EEA and UK, it is also what lets later merchant-initiated payments go ahead without strong customer authentication, as long as the customer authenticated when the agreement was set up. Stored-card payments that are not flagged correctly are more likely to be declined.

Stored cards expire and are replaced, a major cause of failed renewals. Network tokens and account updater services help keep credentials current automatically. Subscription merchants should also plan retries within scheme limits, send clear reminders before renewals, make cancellation easy, and consider direct debit for customers who prefer to pay from a bank account.

Compare providers

Related terms

Sources

  1. Visa Core Rules and Visa Product and Service Rules (April 2026)
  2. Visa Acceptance Solutions: Supporting merchant-initiated transactions and credential-on-file
  3. Commission Delegated Regulation (EU) 2018/389 (SCA RTS), EUR-Lex

← All payments terms