Subscription Billing: The Rules Behind Recurring Charges

Consent is a content list, not a checkbox

Visa's Table 5-20 sets out what a merchant must obtain express informed consent to before it stores a payment credential for a future transaction. The agreement has to contain a description of the goods or services, the total purchase price, and cancellation and refund policies including the date any cancellation privileges expire. It has to name the merchant: the location of the merchant outlet, plus an address, email address and phone number to use to contact the merchant about the transactions. And it has to carry the terms attached to the stored credential itself — the last four digits of the account number that will be used, as it may be updated from time to time; how the cardholder will be notified of any change to the agreement; the transaction amount or a description of how it will be determined; the transaction currency; how the stored credential will be used; the timing and frequency of transactions; the expiration date of the agreement if there is one; and the length of any trial period, introductory offer or promotional period. Visa adds a placement rule that quietly kills a lot of checkout designs: requirements related to specific transaction types must be clearly displayed at the time the cardholder gives consent, and displayed separately from the general purchase terms and conditions. Burying the renewal terms inside a terms-of-service link is not consent under that sentence.

The recurring row is four obligations long

Table 5-21 adds requirements by transaction type. For a recurring transaction the merchant must provide a simple cancellation procedure, and, if the cardholder's order was initially accepted online, at least an online cancellation procedure. It must include the fixed dates or intervals on which the transactions will be processed. And at least 7 days before a recurring transaction it must notify the cardholder, by email or another agreed method, if a trial period, introductory offer or promotional period is going to end — including in that message the transaction amount, the transaction date of subsequent recurring transactions, and a link or other simple mechanism letting the cardholder cancel easily online or by SMS. Table 5-20 also states flatly that a recurring transaction or an unscheduled credential-on-file transaction must not include any finance charges, interest or imputed interest, and that the merchant must refund the full amount paid if it has not adhered to the terms and conditions of the sale or service. The merchant must retain the agreement information for the duration of the agreement and provide it to the cardholder or the issuer on written request, which is the sentence that decides whether you can defend a dispute later.

ROSCA says it again, with penalties attached

The Restore Online Shoppers' Confidence Act, at 15 U.S.C. § 8403, makes it unlawful to charge or attempt to charge a consumer for goods or services sold in a transaction effected on the internet through a negative option feature unless the seller does three things: provides text that clearly and conspicuously discloses all material terms of the transaction before obtaining the consumer's billing information; obtains the consumer's express informed consent before charging the card, debit card, bank account or other financial account; and provides simple mechanisms for the consumer to stop recurring charges. Those three obligations map almost word for word onto the Visa requirements above, which is convenient: one design satisfies both. Note what the current Code of Federal Regulations does and does not contain. 16 CFR Part 425 is titled “Use of Prenotification Negative Option Plans” and addresses plans under which merchandise is shipped unless the subscriber declines by a stated date. It is not the rule that governs an online subscription's cancellation flow. For an internet negative option feature, § 8403 is the operative federal text.

Cancellation design is a chargeback control

The two rulebooks agree that cancellation must be simple, and the practical reason is the dispute that follows when it is not. Visa's Dispute Condition 13.2, Cancelled Recurring Transaction, lets an issuer dispute a charge where the cardholder withdrew permission to charge the credential, or where the acquirer or merchant received notification before the transaction was processed that the account was closed. The dispute amount is limited to the unused portion of the service or merchandise, and the issuer has 120 calendar days from the transaction processing date. Visa has also narrowed it: effective for disputes processed on or after 18 April 2026, a dispute is invalid where the cardholder's cancellation was after the date of the transaction. That cuts both ways. It protects a merchant that billed before the customer cancelled, and it leaves no protection at all for a merchant that received a cancellation and billed anyway. Our friendly fraud guide covers the evidence side of 13.2 in detail.

When the charge is declined

Table 5-22 has a requirement most billing systems do not implement. If an authorisation request for a merchant-initiated transaction with a stored credential is declined, the merchant must notify the cardholder in writing and allow the cardholder at least 7 calendar days to pay by other means. That is a rule about communication, not about retries — how and when to reattempt a declined recurring charge is a separate discipline, and our failed payment recovery guide covers the response-code side of it. The same table also fixes the mechanics of establishing the credential: after the cardholder agreement has been completed in writing and before the first transaction occurs, submit an authorisation request for the transaction amount, or an account verification for a currency unit of zero if no payment is due; if that initial request is not approved, do not store the credential.

An illustrative example of the notice window

Illustrative example, made-up round numbers. A software company offers a 30-day free trial starting 1 March, converting to a $40 monthly plan on 31 March. Under Table 5-21 the 7-day notice has to reach the customer on or before 24 March, and it has to say the amount ($40), the date of the subsequent recurring transactions (the 31st of each month) and carry a link or SMS mechanism that cancels the subscription. If the company instead emails on 30 March, or emails on 24 March with no cancellation link, the notice does not meet the requirement even though a message was sent. Nothing about that example depends on the numbers; substitute your own trial length and price and the deadline moves with them. This is general information, not legal advice (September 17, 2026). Confirm the current text of the rules and the statute before you change a billing flow, and check your own state's automatic renewal law, which may impose more than either.