Cards on File and Recurring Billing: Complete Compliance Guide (2026)

If your organization collects regular payments from the same people, you have probably thought about putting payment methods on file. Monthly insurance premiums, utility bills, HOA dues, healthcare copays, membership fees. Maybe you already do it. But having a card on file and doing it correctly are two very different things. The gap between them is where compliance problems, failed payments, and cardholder disputes quietly pile up.

Here is what cards on file actually require, what the rules say, and how to set up recurring billing in a way that reduces costs and protects your organization.

What "Card on File" Actually Means

A card on file is a stored payment credential, whether that is a credit card, debit card, or bank account, that a cardholder authorizes your organization to charge later. Simple enough. But how you use that authorization matters a lot, because card networks treat different types of stored-credential transactions differently.^[1] Use the wrong type and you will see more declines and lose more disputes.

There are three types you need to know:

• Recurring billing Same amount, predictable schedule. Monthly water bills, quarterly dues, annual memberships. The customer knows what is coming and when.
• Installment billing A fixed total split into a set number of payments. A tax bill in six installments, a healthcare payment plan with a known end date. The schedule is agreed to upfront.
• Unscheduled CoF transactions No fixed schedule, no fixed amount. The charge fires when a condition is met, not a calendar date. An insurance premium after an annual review. A variable utility bill. These require the most careful setup and documentation.

Visa, Mastercard, and the other networks have specific rules for each one. The rules affect how your processor flags the transaction when it is submitted. Get it wrong and your decline rates go up. Get it really wrong and you lose chargebacks you should have won.

Why the Rules Around Stored Credentials Have Gotten Stricter

Card network rules on stored credentials have tightened considerably over the last several years. And they are not going back. Here is what has changed and why it affects you.

Issuer scrutiny and transaction flagging

Banks are paying closer attention to recurring charges. Card networks now require explicit flagging on stored-credential transactions, both the initial cardholder-initiated transaction (CIT) and every subsequent merchant-initiated transaction (MIT) that follows it.^[2] Visa also strongly recommends using the Original Transaction ID (OTID) to link every MIT back to the original CIT. This tells the issuing bank the charge is authorized. Without it, your processor is sending transactions that look unfamiliar to banks, and banks are increasingly quick to decline anything that does not look right.

Chargebacks on recurring billing are going up. "I didn't authorize this" and "I already canceled" are two of the most common chargeback reasons in recurring billing. Without a clean authorization trail linking every MIT to its original CIT, those disputes are hard to win. With one, they often get resolved before they even become chargebacks.

Network tokenization and stored credentials

How stored credentials work is changing. The old approach, saving a raw card number against a customer account, is giving way to network tokens. A network token is a credential substitute issued directly by the card network. When a card is renewed or replaced, the token can update automatically. That means fewer failed payments and less time spent chasing down updated card numbers. If you run any volume of recurring billing, this is worth knowing. IntelliPay's tokenization and security approach covers how we handle stored credential security on our platform.

Before You Store a Single Card Number: The Authorization Requirements

There are three things you need before storing a card. All three. Not two out of three.

1. Clear, informed consent The cardholder needs to know they are agreeing to future charges. A checkbox buried in your terms of service does not cut it. The language needs to be visible and specific. It should spell out the amount or how it will be calculated, the schedule or the conditions that trigger a charge, and how the cardholder can cancel.
2. A record you can actually produce When a dispute comes in, and eventually one will, you need to show exactly what the cardholder agreed to and when. That means storing authorization records where you can retrieve them, not just a checkbox flag in a database. Without a record, you have no defense.
3. Correct transaction flagging on every charge Every charge after the initial authorization needs to go out with MIT indicators that tell the issuing bank this is a stored-credential charge the cardholder previously authorized. Ask your processor whether they are submitting MIT indicators per current Visa and Mastercard requirements, and whether they use OTID to link each MIT back to the original CIT.

For government agencies and utilities, it can get stricter. Several states have rules on recurring billing disclosures, cancellation rights, and required notice periods that go beyond what the card networks require. Some of those rules apply specifically to utilities and public agencies. Our utility billing regulations guide covers the state-by-state landscape.

Reducing Failed Payments: The Practical Side of Recurring Billing

Even with everything set up correctly, recurring transactions still fail. Cards expire, banks reissue numbers after fraud, accounts get closed. For organizations billing hundreds or thousands of people a month, a 2 to 5 percent failure rate is not unusual. If you are not handling it systematically, that turns into uncollected revenue and staff time spent on outreach.

Here are four things that meaningfully reduce failure rates:

Cancellation and Consumer Rights

Making cancellation easy might seem like it works against you. It does not. Cardholders who cannot figure out how to cancel do not just stop paying. They call their bank and dispute the charge. Now you are not just losing future billing. You are potentially losing the disputed transactions too, paying chargeback fees, and risking a higher dispute ratio that puts your account under scrutiny.

Government agencies have additional obligations here. A resident who sets up autopay for property taxes should be able to cancel online, not by calling a number that is only staffed three days a week.

Do You Have a Cards-on-File Policy?

If not, now is a good time to create one. It does not need to be complicated. At minimum it should cover:

• Authorization language and storage what consent language you use, where it is stored, how long you keep it
• Transaction type classification whether your charges are recurring, installment, or unscheduled, and confirmation your processor is flagging them correctly with CIT and MIT indicators and OTID
• Pre-charge notification how and when payers are notified before a charge runs, especially for variable-amount billing
• Credential update and removal how payers update or remove a stored payment method
• Cancellation processing how cancellation requests are received, confirmed, and acted on within the required timeframe
• Failed payment handling retry timing, payer notification, escalation path for continued failures

Healthcare and insurance organizations also need to account for HIPAA when payment data touches protected health information. Our healthcare payment processing page covers where payment compliance and healthcare privacy requirements intersect.

Five Questions to Ask Your Payment Processor

Not sure if your current setup is handling stored credentials correctly? Ask your processor these five questions directly:

1. Are you submitting MIT indicators on all recurring charges, and are you using OTID to link them back to the original authorization?
2. Do you offer account updater services, and does the refresh happen before a charge runs or only after a decline?
3. How does your platform handle retry logic for failed recurring transactions, and does it follow current Visa and Mastercard retry rules?
4. Does your platform store a network token or a raw card number (PAN)?
5. What reporting do you provide on upcoming card expirations?

A processor who handles recurring billing well should answer all five without hesitation. Vague answers, or hearing about MIT indicators and OTID for the first time in this conversation, are worth paying attention to.

Frequently Asked Questions