Recurring billing: how card-on-file payments work

Recurring billing is how a business charges a customer's card automatically on a schedule after the customer agrees to it once. A gym bills members on the first of the month, a pilates studio charges for an unlimited class pass every four weeks, an accounting firm runs a monthly retainer. The customer doesn't re-enter the card each time, and you don't chase invoices.

It's one of the best tools a service business has, and one of the easiest to get wrong. The card networks have rules for storing cards and charging them later. Federal law covers consent and cancellation. And stored cards go stale every time a bank reissues one. Here's how to handle all of it, with a setup checklist at the end.

How does recurring billing work?

Recurring billing works in two stages: one payment the customer starts, where they agree to the terms and you store the card, followed by a series of charges you start on the agreed schedule. Here's the full cycle:

1. Enrollment. The customer sees the terms (price, how often they'll be charged, when billing starts, and how to cancel) and agrees to them.
2. First transaction. You charge the first payment. If nothing is due yet, as with a free first week, you run an account verification instead, which checks the card without charging it.
3. Storage. The card is stored with your payment provider, not in a spreadsheet or your customer files.
4. Scheduled charges. Your system charges the stored card on the agreed dates, and each charge is flagged as a recurring, merchant-initiated transaction.
5. Receipts. The customer gets a receipt each time, so the charge never comes as a surprise.
6. Upkeep. Expired and replaced cards get updated, declines get retried within the rules, and cancellations take effect right away.

Steps 2 and 4 involve data flags your gateway sets behind the scenes, but you're the one who has to make sure they're right, because they affect approvals and disputes.

Which businesses use recurring billing?

Any business with an ongoing relationship can use it, but some lean on it heavily:

• Gyms, fitness studios, and wellness businesses with memberships, class packs, and personal training plans. Our wellness and fitness page covers membership billing in more detail.
• Professional service firms that bill retainers or fixed monthly fees, such as bookkeepers, IT support, consultants, and marketing agencies. See our professional services page.
• Subscription businesses, maintenance plans, and anything sold as a monthly or annual plan.

Picture a yoga studio in Minneapolis with 400 members on a $150 monthly plan, or an accounting firm in Columbus billing 40 clients a $600 retainer. That's $60,000 and $24,000 a month that should arrive without anyone sending an invoice. Both depend on the same mechanics.

What card network rules apply to card-on-file billing?

The card networks treat a stored card differently from a card swiped at a counter, and they expect you to say so in every transaction. The main rules come from Visa's stored credential framework, the networks' subscription policies, and PCI DSS.

Visa's stored credential rules

Visa's framework for transactions with stored credentials requires merchants to obtain the cardholder's consent before storing card details for future use, and to identify both the initial storage and the later uses of the card in the transaction data. Since October 2017, if no amount is due when the card is stored, the merchant has to submit an account verification instead of a charge.

In practice, your gateway or virtual terminal sets these indicators. Your job is to make sure the consent step happens and to ask your provider to confirm the flags are set. Mislabeled charges can confuse the card issuer, which doesn't help when a customer later disputes one.

Rules for free trials and introductory prices

If your subscription starts with a free trial or an introductory price, the networks add more. Visa's subscription merchant policy requires merchants that offer free trials or introductory promotions to notify the cardholder at least seven days before the trial or promotional period ends, with a link or other simple way to cancel online or by text. If the trial is shorter than seven days, those details belong in the initial confirmation. Visa strongly recommends the same practices for other subscription merchants, even though they're only mandatory with a trial or promotion.

Mastercard's standards for subscription and recurring payment merchants took effect on September 22, 2022, and its FAQ says the reminder requirement for free trials applies when the trial is longer than seven days.

Never store the security code

You need the card number and expiration date for future charges. You never need the three- or four-digit security code. PCI SSC says these codes aren't needed for card-on-file or recurring transactions, and storing them for those purposes is prohibited.

What do US consumer protection laws require in 2026?

Federal law focuses on two things: clear consent before you charge, and an easy way to stop the charges. Here's where things stood as of October 2026.

The FTC's click-to-cancel rule is not in effect

In 2024 the FTC adopted amendments to its Negative Option Rule, often called the click-to-cancel rule. The US Court of Appeals for the Eighth Circuit vacated the 2024 rule, finding the FTC's failure to issue a preliminary regulatory analysis "procedurally insufficient," and in February 2026 the FTC published a revision conforming the rule to that decision. The FTC's own business blog now describes the Negative Option Rule as one that currently covers only prenotification plans.

The FTC isn't done. On March 11, 2026, it announced an advance notice of proposed rulemaking asking whether the rule should be amended, including whether to adopt provisions of the vacated 2024 rule, and the comment period ran until April 13. An advance notice only asks questions. Any new rule would still have to be proposed and finalized, so check the FTC's Negative Option Rule page for the latest.

ROSCA still applies to online sign-ups

The vacated rule doesn't leave online subscriptions unregulated. The FTC's enforcement policy statement on negative option marketing explains that the Restore Online Shoppers' Confidence Act (ROSCA), enacted in 2010, prohibits charging consumers for goods or services sold online through a negative option feature unless the marketer clearly and conspicuously discloses all material terms before getting billing information, obtains the consumer's express informed consent before charging, and provides simple mechanisms to stop recurring charges.

The FTC's March 2026 blog post lists ROSCA, Section 5 of the FTC Act, and the Telemarketing Sales Rule among the laws it uses against unfair negative option practices.

Regulation E covers recurring debit card charges

If customers pay with a debit card, the Consumer Financial Protection Bureau's Regulation E applies to preauthorized transfers from their accounts. They must be authorized in a writing signed or similarly authenticated by the consumer, and electronic signatures count. A payee can't meet the rule by signing on the customer's behalf after an oral authorization.

Two details matter for card billing. The CFPB's commentary says asking customers whether the card they're giving you is a debit or a credit card is generally a reasonable procedure, since recurring debit card charges need that written authorization. And if a recurring debit charge will vary in amount from the previous one or the preauthorized amount, the payee or the customer's bank must send written notice of the amount and date at least 10 days before the transfer, unless the customer has been offered and accepted a range of amounts.

Check whether your state has its own automatic renewal law, too. Our advice is to build to the strictest standard you face: plain terms, an explicit checkbox or signature, a receipt every time, and a cancel option that's as easy as signing up.

How do account updater services reduce failed payments?

Cards expire, get lost, and get reissued after fraud, and every one of those changes can break a stored card. Account updater services fix most of that before you run the charge.

Visa's account updater FAQ says Visa Account Updater exchanges account number changes, new expiration dates, closed-account notices, and "contact cardholder" advices among participating issuers, acquirers, and merchants. It also gives a sense of scale: on average, 30% of the card accounts in an issuer's portfolio that participate in the service change their number or expiration date, or close, every year.

Mastercard's Automatic Billing Updater does the same job for Mastercard cards, letting issuers and acquirers send account changes for card-on-file and recurring payments to merchants, including automatic notices for accounts a merchant has subscribed to.

Run the yoga studio's numbers. If its 400 members' cards changed at that 30% rate, about 120 stored cards would go stale in a year. Without an updater, each one is a failed charge and an awkward email, and some of those members won't come back. Ask your processor whether it supports account updater services for both networks and how updates reach your billing system.

How should you handle failed recurring payments?

Not every decline is the same, and the card networks limit how often you can try again. Visa's rules group decline codes into categories. When a decline falls into the "issuer will never approve" category, the merchant is not permitted to reattempt the transaction. For declines in the categories that do allow retries, including "issuer cannot approve at this time," Visa's merchant business news digest says 15 retries in 30 days are permitted.

You'll rarely need anywhere near 15 tries. We'd rather see a short, polite dunning sequence than a card hammered with retries:

Adjust the timing to your business. A gym can pause access at the front desk; a law firm on retainer might prefer a phone call. Whatever you choose, write it down, put it in your terms, and apply it the same way to everyone.

Recurring billing setup checklist

Work through this list before you charge your first subscriber:

1. Write plain-language terms: price, billing frequency, start date, and exactly how to cancel.
2. Get an explicit agreement, such as an unchecked box the customer checks or a signature, and keep a record of it.
3. Ask whether the card is debit or credit, and get a signed or electronically authenticated authorization for debit cards.
4. Send a confirmation with the terms right after enrollment.
5. Store cards only with your payment provider, and never store security codes.
6. Confirm your gateway flags the first transaction as storing the card, and later charges as recurring.
7. Run an account verification when nothing is due at signup.
8. Send reminders before free trials or introductory prices convert, at least seven days ahead.
9. Give advance notice before a price increase, and at least 10 days' notice for a changed amount on debit cards.
10. Send a receipt for every charge.
11. Turn on account updater services for Visa and Mastercard.
12. Set retry rules that stop on hard declines and stay well inside network limits.
13. Make canceling as easy as signing up, and process cancellations immediately.
14. Use a billing descriptor customers will recognize on their statements.

Mistakes that turn recurring billing into chargebacks

Watch for these avoidable mistakes, because each one invites a dispute:

• Charging after a customer canceled, even once. Process cancellations the moment they arrive.
• Raising prices without notice. A surprise increase reads like an unauthorized charge.
• A billing name customers don't recognize, which sends them straight to their bank.
• Hiding the cancel option behind a phone call or a retention script.
• Retrying a "never approve" decline, which Visa's rules don't permit.

If disputes do come in, Clearo's chargeback management tools help you respond with the consent records and receipts you've been keeping.

Set up recurring billing the right way

Recurring billing should make your revenue predictable, not your inbox busier. Clearo's virtual terminal includes recurring billing alongside phone payments, invoices, and payment links, so you can enroll members at the front desk or clients over the phone. Our guide to taking card payments by phone covers the phone side. If you already bill on a schedule, send us a statement for a free statement review and we'll check what those recurring charges are costing you, or contact our team to set it up with interchange-plus pricing and no long-term contract.