Credit Card on File: Visa's Rules for Consent, CIT vs MIT and Expired Cards

Keeping a credit card on file means storing a customer's card details, with their permission, so you can charge the card later without asking for it again. Visa calls this a stored credential, and its rules require the customer's express informed consent to written terms before you store the card, plus an approved authorization for the first charge (or a $0 account verification if no payment is due yet) before you rely on it. The security code (CVV2) is the one thing you can never keep: PCI rules forbid storing it after authorization.

What Does Card on File Mean?

Visa's rulebook defines a stored credential as information, including the card number, that a merchant or its agent stores to process future transactions. "Card on file," "credential on file" and "stored card" all describe the same arrangement.

Two kinds of charges can use a card on file, and most are card-not-present transactions:

• Customer-initiated (CIT): the customer starts the payment, such as clicking "pay" with a saved card in your app.
• Merchant-initiated (MIT): you start it under an agreement the customer already accepted, such as a monthly membership charge.

Rules here come from Visa's April 2026 rulebook unless another source is named. Other networks publish their own.

Is It Legal and Safe to Keep a Customer's Card on File?

The card networks allow it, with conditions. Visa's rules say a merchant must use a stored credential only as agreed with the cardholder. They also set out what the agreement must say and how the first transaction must be processed. Your acquirer's agreement can add requirements on top.

On safety, the PCI Security Standards Council's data storage guidance says that if you have a business need, the card number (PAN), cardholder name, expiration date and service code may be stored, as long as they are protected under PCI DSS. The card number must be rendered unreadable anywhere it is stored, including backups and logs. The same guidance says no card data should be stored at all unless the business needs it.

The CVV2 is different. PCI SSC FAQ 1280 says card verification codes must not be stored after authorization, are not needed for card-on-file or recurring transactions, and can't be kept even if the customer asks you to. Encrypting the code doesn't make storing it acceptable. Visa's rules separately say a merchant must not request the CVV2 on any written form.

This is general information, not legal advice. State and federal laws, and your processor contract, may add requirements.

What Consent Do You Need to Keep a Card on File?

Before you store a card for a future transaction, Visa requires the cardholder's express informed consent to an agreement that contains:

• About the transaction: a description of the goods or services, the total purchase price, and your cancellation and refund policies.
• About you: your location, plus an address, email and phone number for questions about the charges.
• About the stored card: the last four digits of the card that will be charged, how you'll notify the customer of changes to the agreement, the amount or how it will be determined, the currency, how the card will be used, and the timing and frequency of charges.
• For unscheduled charges: instead of a schedule, the event that will prompt a charge.
• If they apply: the agreement's expiration date and the length of any trial or promotional period.

Two details trip people up. The terms specific to the transaction type must be displayed at the moment the customer consents, separately from your general terms and conditions. And you must keep the agreement for as long as it runs and provide it to the cardholder or issuer on written request.

Visa also requires merchants that keep stored credentials to show the card's last four digits and the Visa brand mark or the word "Visa" on payment screens. For a ready-made card-on-file form, use the template in our credit card authorization form guide.

What happens on the first transaction?

After the agreement is in writing and before the first transaction, Visa requires you to either submit an authorization for the transaction amount or, if no payment is due yet, send an account verification, which is a zero-amount check that the card can be used. Recurring, installment and unscheduled transactions need the right indicator in the authorization message. If that first authorization or verification isn't approved, you must not store the card.

CIT vs MIT: Customer-Initiated and Merchant-Initiated Transactions

Visa's description of a merchant-initiated transaction: it relates to a previous customer-initiated transaction or a payment agreement, but happens without the cardholder's active participation, and the merchant can't validate or authenticate the cardholder. Visa's MIT framework requires the acquirer to send the identifier of the original transaction as proof of the earlier interaction.

For a customer-initiated charge on a stored card, Visa requires you to validate the customer's identity first, for example with a login and password. For any stored-credential charge, the authorization can't exceed the transaction amount.

Recurring, installment and unscheduled credential-on-file

Visa groups three MIT types as "standing instruction" MITs, each with its own indicator:

Recurring transactions carry extra duties. You must offer a simple way to cancel (online, if the customer signed up online) and include the fixed dates or intervals of the charges. When a trial, introductory or promotional period is about to end, you must notify the customer at least 7 days before the charge with the amount, the date and an easy way to cancel. Neither recurring nor unscheduled charges may include finance charges or interest.

Incremental, delayed charge, no-show and resubmission

Visa's stored-credential agreement rules don't apply when the card is used for a single transaction in these situations:

• A no-show transaction, which Visa defines as a charge for a guaranteed reservation the cardholder didn't cancel or claim.
• An amended amount or delayed charge, such as a rental company billing a parking ticket after return.
• An incremental authorization, which adds to an approved estimated authorization when the original estimate falls short.
• A new authorization request for the same transaction, where the rules allow one.
• A resubmission after a decline response.

These carry their own conditions. Guaranteed reservations are limited to listed merchant types: lodging, and aircraft, bicycle, boat, equipment, motor home, motorcycle and vehicle rental, plus trailer parks and campgrounds. Resubmissions follow Visa's decline-category limits: after a "never approve" decline such as a closed account, you can't retry that card at all, while most other declines allow up to 20 attempts in 30 days. Our guide to credit card decline codes lists the categories.

Worked Example: A Salon No-Show Fee on a Stored Card

This example is hypothetical. Fern & Fade, a fictional salon, takes bookings online and saves a card at booking.

Its policy: cancel less than 24 hours before the appointment, or don't show up, and you pay 50% of the booked service. A client books a $180 color appointment, so the fee is $180 x 0.50 = $90.

A salon isn't on Visa's guaranteed-reservation list, so its fee doesn't fit Visa's "no-show transaction" category. It is an ordinary merchant-initiated charge on a stored card, and the full agreement requirements apply. At booking, the salon's screen showed, separately from its general terms and next to a "click to accept" checkbox:

1. The service and its $180 price.
2. The cancellation policy, with the 24-hour deadline.
3. The salon's address, email and phone number.
4. The card's last four digits.
5. How the amount is set: 50% of the booked service, in US dollars.
6. The event that triggers a charge: a missed appointment or late cancellation.
7. How the client will hear about changes to the policy.

The booking system then sent a $0 account verification. It was approved, so the card was stored. When the client missed the appointment, the salon charged $90 as a merchant-initiated transaction. Ask your processor which indicator it uses for this kind of charge. Visa's April 2026 rules don't name an industry-specific category for salon no-shows, so an unscheduled credential-on-file flag is the likely fit. Confirm it rather than assume it.

Four such no-shows in a month recover 4 x $90 = $360, but only if every client agreed to the terms first. If the $90 charge declines, Visa requires the salon to notify the client in writing and allow at least 7 calendar days to pay by other means.

Running a salon? See our page for salons and spas.

Card on File vs Tokenization

Card on file is what you do; tokenization is how the card is kept. A substitute value stands in for the real card number, so a breach of your system exposes tokens, not card numbers.

The PCI SSC lists index tokens among the accepted ways to render a stored card number unreadable. Network tokens go a step further. Visa describes its card-on-file tokens as domain-restricted to the merchant, and since its October 2022 processing release, standing instruction MITs initiated by tokens must use card-on-file tokens rather than tokens taken from a digital wallet payment.

Visa now requires Visa Tokens for stored-credential transactions in a list of countries in its CEMEA and Latin America and Caribbean regions. In the April 2026 rules, that list includes Puerto Rico and the US Virgin Islands effective 25 July 2026. Visa's US Region isn't on it, but if you sell in those territories, ask your processor about network tokens. If your payment gateway stores the card and hands you a token, your own systems never hold the card number.

What Happens When a Card on File Expires?

An account updater service passes reissued card details to merchants so stored-card charges keep working. Visa Account Updater (VAU) handles account number changes, new expiration dates, account closures and product or brand conversions. Under Visa's rules, US issuers must enroll all their BINs except commercial and prepaid card BINs and a few other categories, so updates for business and prepaid cards aren't guaranteed. Issuers must submit a new number or expiration date within 2 business days of activating the card.

Merchants enroll through their acquirer, and only card-on-file business models qualify. Visa's FAQ describes two main channels. In batch, the acquirer forwards responses within two business days and you update your records. Real Time VAU returns the update in the authorization response, and individual merchants don't need to enroll for it. Other card brands run their own updater services; ask your processor which ones you're enrolled in.

Worked example: a gym membership after the card expired

This example is hypothetical. Summit Strength, a fictional gym, bills members $49 on the 1st as a recurring transaction.

A member's issuer activates a reissued card on Tuesday, September 22, 2026, so its deadline to send the update to VAU is two business days later, Thursday, September 24. The gym's processor sends a batch inquiry on Monday, September 28. Visa's FAQ gives the acquirer two business days to forward VAU's response to the merchant; in this illustration the new expiration date reaches the gym on Wednesday, September 30. The gym updates its record, and the $49 charge on Thursday, October 1, is approved.

Without the update, the charge would carry the old date. Visa lists decline code 54, "Expired card or expiration date missing," among its data-quality declines. Retrying the same stale date won't fix that. Visa requires the gym to notify the member in writing after a declined merchant-initiated charge and allow at least 7 calendar days, through Thursday, October 8, to pay another way. One lost member at $49 a month is $49 x 12 = $588 a year. For more on subscription billing, see our recurring billing guide.

Credit Card on File Policy for Medical and Dental Offices

Medical offices and dental practices that keep a card on file to collect the patient's share after insurance processes a claim are running, under Visa's rules, an unscheduled credential-on-file arrangement: the amount varies, and there's no fixed date. The network rules shape what the policy should say:

• Name the triggering event. For example, the balance left after insurance processes the claim, or a missed-appointment fee.
• Say how the amount is determined, since you won't know it at signing.
• Show the last four digits of the card on the agreement, not the full number.
• Leave the CVV2 off the form. Visa forbids requesting it on any written form, and PCI rules forbid keeping it after authorization.
• List how the patient can reach you about a charge, and how you'll tell them if the policy changes.
• No interest or finance charges on the stored-card charge.
• Keep the signed agreement for as long as it's in effect, so you can produce it if the issuer asks.

A completed paper form is stored card data too. The PCI SSC's guidance is to keep stored card data only as long as the business needs it and to keep unauthorized people away from it. This section covers card network and PCI rules only. Healthcare privacy, billing and consumer laws may impose separate requirements; check them with your own counsel.

Card on File Payments Checklist

1. Put the agreement in writing, with every Visa-required term shown separately from your general terms.
2. Run an authorization or a $0 account verification first, and don't store a card that fails.
3. Flag each charge correctly: customer-initiated, or recurring, installment or unscheduled.
4. Never store the CVV2. Render stored card numbers unreadable, or let your gateway hold them.
5. Ask your processor about account updater enrollment and network tokens.
6. When a merchant-initiated charge declines, notify the customer in writing and allow at least 7 calendar days.

If you'd like a second look at what you're paying for stored-card and recurring transactions, send us a recent statement for a free statement review.

Sources

• Visa, "Visa Core Rules and Visa Product and Service Rules," 18 April 2026 edition (sections 3.2.1.3, 5.4.3.1, 5.7.2.1, 5.8.8.2, 5.8.11.1 with Tables 5-20, 5-21 and 5-22, 7.3.6.3 with Table 7-2, and 8.6.1.1; glossary entries for Stored Credential, Recurring Transaction, Installment Transaction, Unscheduled Credential-on-File Transaction, No-Show Transaction and Account Verification), observed October 2026.
• Visa, "Visa Merchant-Initiated Transaction (MIT) Service" program overview (2022), observed October 2026.
• Visa, "Introduction of the Visa Network Merchant-Initiated Transaction Service," Visa Merchant Business News Digest, February 2022, observed October 2026.
• Visa, "Restrictions on Standing Instruction MITs Related to Card-on-File Tokens," Article AI11237, 30 September 2021, observed October 2026.
• Visa Developer, "Visa Account Updater (VAU) FAQs", observed October 2026.
• PCI Security Standards Council, "FAQ: Can card verification codes/values be stored for card-on-file or recurring transactions?" (FAQ 1280), observed October 2026.
• PCI Security Standards Council, "PCI Data Storage Do's and Don'ts" (2008), observed October 2026.