A card on file, which Visa calls a stored credential, is card information a business or its processor keeps to charge future payments. Before storing it, the business must get the cardholder's express informed consent to an agreement that sets out the amounts, timing, how the card will be used and how changes are notified. The first payment, or a zero-amount check, must be approved before the card is stored. Later charges the business starts without the customer, such as plan installments, are merchant-initiated transactions and must be flagged as installment or recurring. If one is declined, Visa requires written notice and at least 7 days to pay another way.
What is a card on file?
Visa's rules call it a stored credential: information, including the card number, that a merchant, its agent or a payment facilitator stores to process future transactions. A card kept only to finish a single purchase doesn't count. Visa's own example is a hotel. A card kept on a guest's membership profile for future stays is a stored credential. A card given to cover one reservation is not.
Every charge to a stored card is a card-not-present payment under Visa's rules, whether or not the customer is on your site at the time.
What are cardholder-initiated and merchant-initiated transactions?
Visa's Stored Credential Transaction framework splits payments on a stored card into two kinds:
- Cardholder-initiated (CIT). The customer takes part, for example by paying with their saved card at checkout.
- Merchant-initiated (MIT). The business charges the card without the customer taking part, under an agreement made earlier.
Merchant-initiated payments come in two groups. Industry practice MITs finish an earlier purchase, such as a delayed charge or a no-show fee. Standing instruction MITs follow a pre-agreed instruction from the customer, and there are three types:
| Type | Visa's definition, in short | Indicator |
|---|---|---|
| Installment | A series of payments for a single purchase, over a fixed period, with no more than a year between payments | I |
| Recurring | A series at fixed, regular intervals, no more than a year apart, for goods or services provided at regular intervals | R |
| Unscheduled credential-on-file | A fixed or variable amount on no set date, such as an account top-up | C |
A payment plan for one program or project is an installment series. A monthly membership is recurring.
What must the customer agree to before you store the card?
Visa's Core Rules say that before a merchant stores a card for future payments, it must get the cardholder's express informed consent to an agreement that includes:
- The purchase. A description of the goods or services, the total price, and the cancellation and refund policies.
- A surcharge, if any. Where surcharging is permitted, acknowledgment of any surcharge and its disclosures.
- You. The location of your business and an address, email and phone number for questions about the payments.
- The card. The last four digits of the card that will be charged, as it may be updated.
- The payments. The amount or how it is worked out, the currency, how the card will be used, and the timing and frequency of the payments.
- Changes and end dates. How the customer will be told about changes, the agreement's expiry date if it has one, and any trial or promotional period.
These terms must be shown when the customer gives consent, separately from your general terms and conditions. You keep the agreement for as long as it runs and provide it to the cardholder or issuer on written request.
Stripe's documentation sets out the same duty from the processor's side. Before saving or charging a customer's card, it says to add terms stating how you'll use the card, the expected timing and frequency of payments and how the amount is set, use the card only for that purpose, collect explicit consent, and keep a record of the customer's written agreement.
What happens when the card is first stored?
After the agreement and before the first payment, Visa requires one of two things:
- An authorization for the first payment, such as the deposit.
- An account verification, a zero-amount check, if nothing is due yet.
That first message carries the installment or recurring indicator. If it is declined, the card must not be stored.
How are the later payments charged?
Each later charge is sent as a stored-credential payment (POS entry mode 10) with the installment or recurring indicator, for no more than that payment's amount. Visa's 2017 framework guide says identifying stored-credential payments this way helps issuers judge their risk, leads to higher approval rates and is required to take part in Real Time Visa Account Updater, which sends updated card details as part of the authorization.
On Stripe, a charge made while the customer isn't in your checkout is called off-session, and the PaymentIntent is created with off_session=true against the saved payment method.
What if a scheduled charge is declined?
Visa's rules say that if a merchant-initiated charge on a stored card is declined, the merchant must notify the cardholder in writing and give them at least 7 calendar days to pay by other means, such as a bank transfer. See failed payment.
What does Visa say about interest and late fees on a plan?
Visa calls a payment in an installment series a partial payment when the merchant charges no interest or imputed interest and the agreement is made before or at the first payment. For a partial payment, the merchant must not charge interest, and a late fee, if any, must be a flat fee applied only as a penalty for paying late. Recurring and unscheduled credential-on-file payments must not include finance charges, interest or imputed interest either. See finance charge.
Are there extra rules for recurring payments?
Yes. For a recurring series, Visa requires a simple way to cancel (online, if the customer signed up online), the fixed dates or intervals of the charges, and an email or other agreed notice at least 7 days before a recurring charge when a trial or introductory period is ending.
This page uses Visa's published rules. Mastercard and the other networks publish their own, and your processor applies them. General information, not legal advice.
- Visa Core Rules and Visa Product and Service Rules, 18 April 2026: section 5.8.11.1 (tables 5-20, 5-21 and 5-22), and the glossary entries for Stored Credential, Installment Transaction, Partial Payment, Recurring Transaction, Unscheduled Credential-on-File Transaction and Card-Absent Environment
- Visa: Improving Authorization Management for Transactions with Stored Credentials (2017)
- Stripe: Save a customer's payment method when they use it for a payment: Compliance, and Charge the saved payment method later
Every figure on this page was checked against these sources on Oct 21, 2026. General information, not legal or tax advice.