What does card-on-file consent require?
Card-on-file consent requires the merchant to tell the cardholder, before storing the card, how it will be used: amount or calculation method, frequency, duration and how to cancel. Visa’s stored credential framework also requires the first transaction to be identified as such. The merchant must keep proof of the agreement and notify changes.
In detail
Card-on-file consent is the cardholder’s agreement that a merchant may store a card and use it again. Visa’s stored credential framework, in force since October 2017, makes it a condition for any later charge.
What the agreement must cover
- Purpose: what the stored card will be used for.
- Amount: a fixed price, or how a variable amount is calculated.
- Timing: frequency of charges and duration of the agreement.
- Cancellation: how the cardholder can stop it, and the refund policy.
- Changes: how the cardholder will be told if terms change.
What the merchant must do
The first payment is a customer-initiated transaction, flagged as the start of a stored-credential series and authenticated where rules require it. The merchant keeps a record of the terms shown, the date and the first transaction. This record is the main evidence if a later charge is disputed.
For subscriptions with trials, Visa and Mastercard add reminders before the trial ends and clear cancellation instructions. Operators can build these steps into checkout and billing: see CIT vs MIT for the flow, and the subscription engine page for how recurring plans are managed.