Card-on-File Rules: Visa Stored Credential Requirements

Read this first

Not legal advice. This page is general information dated September 17, 2026, summarizing the Visa Core Rules and Visa Product and Service Rules (18 April 2026 edition) and Visa's stored credential framework guide. It covers Visa only; Mastercard, American Express and Discover have their own rules, and state and federal laws on automatic renewals also apply. Your acquirer can add requirements. Check the current rules with your processor. CELER Merchants is an independent merchant services agent, not a law firm.

What counts as a stored credential

Visa's stored credential framework guide defines a stored credential as information, such as an account number or payment token, stored by a merchant or its agent, a payment facilitator or a staged digital wallet operator to process future purchases for a cardholder. It is not a stored credential when the card is kept only to complete a single transaction or purchase. Visa's example: a card given to a hotel for future reservations as part of a membership profile is a stored credential; a card given for one specific reservation is not.

Cardholder-initiated vs merchant-initiated

The guide separates cardholder-initiated transactions (CITs), where the cardholder actively takes part, such as a checkout using a saved profile, from merchant-initiated transactions (MITs), which the merchant starts without the cardholder's active participation.

What the customer must agree to

Table 5-20 of the Visa rules says that before storing a payment credential for a future transaction, the merchant must obtain the cardholder's express informed consent to an agreement that includes: a description of the goods or services; the total purchase price; cancellation and refund policies; any surcharge and its disclosures where surcharging is permitted; the merchant outlet location and contact address, email and phone; the last four digits of the account number; how the cardholder will be notified of changes; the transaction amount or how it will be determined; the currency; how the stored credential will be used; the timing and frequency of charges, or for unscheduled charges the event that triggers them; the agreement's expiration date if any; and the length of any trial, introductory or promotional period. The rules say these terms must be shown when the cardholder consents and displayed separately from the general purchase terms. The merchant must keep the information for the duration of the agreement and provide it to the cardholder or issuer on written request.

Extra rules for recurring charges

Table 5-21 says a merchant running recurring transactions must provide a simple cancellation procedure (at least an online one if the order was accepted online) and include the fixed dates or intervals of the charges. At least 7 days before a recurring charge, the merchant must notify the cardholder if a trial, introductory offer or promotional period is ending, including the amount and date of later charges and a simple way to cancel online or by text message. The rules also say recurring and unscheduled credential-on-file transactions must not include finance charges or interest.

The first transaction and indicators

Table 5-22 says that after the agreement is completed and before the first transaction, the merchant must submit an authorization request for the amount, or an account verification if no payment is due. If that is not approved, the merchant must not store the credential. Transactions using a stored credential must use POS entry mode code 10, and recurring, installment and unscheduled credential-on-file transactions must carry the appropriate indicator in the POS environment field. Before a cardholder-initiated transaction on a stored credential, the merchant must validate the cardholder's identity, for example with a login ID and password. Your gateway usually sets these values, so ask your provider how it flags stored credential transactions.

When a stored-card charge is declined

Table 5-22 says that if an authorization request for a merchant-initiated transaction with a stored credential is declined, the merchant must notify the cardholder in writing and allow the cardholder at least 7 calendar days to pay by other means. Build this into your failed payment process. See our guide to failed payment recovery.

Setup checklist

1. Write a card-on-file agreement that covers every item in Table 5-20 and show it separately from your general terms. 2. Record the customer's consent and keep it for the life of the agreement. 3. Run an authorization or account verification before storing the card, and do not store it if declined. 4. Confirm your gateway flags stored credential, recurring, installment and unscheduled transactions correctly. 5. Send trial-ending notices at least 7 days ahead and offer simple online cancellation. 6. Send a written notice and allow at least 7 calendar days after a declined merchant-initiated charge. 7. Check other card brands' rules and any automatic renewal laws where you sell.