Stored Credentials and Card on File: The Visa Rules
Visa treats saving a card as its own act, with consent, setup and flagging rules. A declined card can't be stored, and trials need seven days of notice.
By Jeffrey Anderson
- Visa treats storing a card as a separate act from taking a payment, with its own consent, setup, and processing requirements under section 5.8.11.
- Before you store a credential you must run an authorization or a zero-amount account verification. If it isn't approved, you're not allowed to store the card.
- The cardholder agreement has to disclose the last four digits, amount, currency, frequency, trial length, cancellation terms, and how changes get communicated, shown separately from your general terms.
- Trials, introductory offers, and promos need at least seven days of notice before the charge, including the amount, the next dates, and a one-click or SMS cancel route.
- A declined recurring charge obliges you to notify the cardholder in writing and give them at least seven calendar days to pay another way, not to retry the card repeatedly.
- Stored credential transactions must use POS Entry Mode code 10 plus the right indicator for recurring, installment, or unscheduled credential-on-file.
Stored credentials are payment details you keep on file to charge a customer again later. Visa calls the saved card a Stored Credential, and it treats storing one as a separate act from taking a payment, with its own consent, setup, and processing rules.
If you run subscriptions, memberships, retainers, installments, or any "save my card" checkout, these rules apply to you. They're published in the Visa Core Rules and Visa Product and Service Rules (18 April 2026), section 5.8.11, and most of the disputes we see on recurring accounts trace back to one of them being skipped.
You Have to Test the Card Before You Store It
This is the rule most merchants miss, and it's the easiest one to comply with.
After the cardholder agreement is completed in writing, and before the first transaction, you must either submit an authorization request for the transaction amount, or submit an account verification if no payment is due yet. An account verification is a zero-amount request that asks the issuer whether the account is good.
Then comes the part with teeth: "If the initial Authorization Request or Account Verification is not approved, the Merchant must not store the credential" (Table 5-22, ID# 0029267).
So a declined card cannot legally go on file. Storing it anyway and retrying later is a rule violation, and it's also how merchants build a book of dead credentials that quietly inflates their decline rate.
What the Cardholder Agreement Has to Say
Visa requires express informed consent to an agreement covering a specific list of items. Not a checkbox next to your general terms.
| Must be disclosed | Detail required |
|---|---|
| The card | Last four digits of the account number that will be charged |
| The amount | The transaction amount, or a description of how it will be determined |
| The currency | The transaction currency |
| The schedule | Timing and frequency of transactions |
| Trials | The length of any trial period, introductory offer, or promotional period |
| Changes | How the cardholder will be notified of changes to the agreement |
| Cancellation | Cancellation and refund policies, and when cancellation privileges expire |
| You | Merchant outlet location, plus address, email, and phone for contact |
| Expiry | The expiration date of the agreement, if there is one |
Two details are easy to get wrong. Transaction-type requirements have to be "clearly displayed at the time that the Cardholder gives their consent" and displayed separately from your general purchase terms. And you must keep this information for the life of the agreement and hand it over to the cardholder or the issuer on written request.
That last clause is the reason to store consent records properly. When an issuer asks, "separately from general T&Cs" is a claim you need to be able to evidence.
The Seven-Day Trial Notice
If you sell anything with a trial, an introductory offer, or a promotional period, this one directly affects your dispute rate.
At least 7 days before the recurring transaction that ends the promo, you must notify the cardholder by email or another agreed method. The notice has to include the transaction amount, the date of subsequent recurring transactions, and a link or other simple mechanism letting them cancel online or by SMS.
Free trials that convert silently are the single most reliable way to generate friendly fraud disputes. The customer forgot, sees a charge they don't recognise, and calls the bank instead of you. The seven-day notice exists precisely to stop that, and sending it is cheaper than fighting the chargebacks it prevents.
Cancellation Has to Be Simple
Visa requires a simple cancellation procedure. If the order was accepted online, you must offer at least an online cancellation route.
A phone-only cancellation line for a subscription sold on the web does not satisfy this. Neither does a retention flow that buries the cancel button.
When a Recurring Charge Declines
If an authorization request for a merchant-initiated stored-credential transaction is declined, you must notify the cardholder in writing and allow at least 7 calendar days to pay by other means.
Note the shape of that. It's not an invitation to retry the card aggressively for a week. It's an obligation to tell the customer and give them a window. Hammering a declined credential with retries is what drives issuers to start blocking your descriptor, and it does nothing the notice wouldn't do better.
The Processing Flags Your Gateway Must Send
Stored credential transactions carry specific data. Getting this wrong is invisible until an interchange bill or a dispute goes against you.
Transactions with a stored credential must use POS Entry Mode code 10. For a recurring transaction, an installment transaction, or an unscheduled credential-on-file transaction, the appropriate indicator has to go in the POS environment field.
There's also a rule about who is driving the charge. Before processing a cardholder-initiated transaction, you must validate the cardholder's identity, for example with a login ID and password. A customer clicking "pay with saved card" is a different transaction type from your billing system charging them on schedule, and the flags have to reflect which one happened.
Worth asking your gateway to confirm what it sends on each of your transaction types. This is a common gap in older integrations, particularly ones that predate the stored credential framework.
Two Rules on Money
A recurring transaction or an unscheduled credential-on-file transaction must not include finance charges, interest, or imputed interest. If you're spreading a cost over time and adding a carrying charge, that's not a recurring transaction under these rules.
And on refunds: you must refund the full amount paid if you haven't adhered to the terms and conditions of the sale or service. Not a prorated amount. The full amount.
Where Tokens Come In
Several regions now mandate tokenization for stored credentials rather than merely encouraging it. Visa already requires a Visa Token for stored credential transactions in Jordan and Pakistan, with Belarus, Kazakhstan and Ukraine added in April 2025, much of the Gulf from 18 April 2026, and a long list of Latin American and Caribbean countries phasing in through 25 July 2026.
The US is not on that list today. That said, if you're storing cards, tokenization removes the raw number from your systems and keeps the credential working when the customer's card is reissued. The compliance direction of travel is clear enough that it's worth doing before someone requires it.
What Doesn't Count as a Stored Credential
The framework doesn't apply when you use a stored credential for a single transaction or a single purchase in these cases: a no-show transaction, an amended amount or delayed charge, an incremental authorization, a transaction where you're allowed to submit a new authorization request for the same transaction, and a resubmission after a decline.
Useful mainly for hotels, car rental, and travel merchants, where delayed charges and no-shows are routine and get confused with recurring billing.
Frequently Asked Questions
Do these rules apply to a one-off "save my card for next time" checkout?
Yes. Storing the credential is the trigger, not the billing frequency. An unscheduled credential-on-file arrangement still needs consent, the pre-storage authorization or account verification, and the correct processing flags.
What is an account verification exactly?
A zero-amount request that asks the issuer to confirm the account is valid, without charging anything. Use it when you're storing a card but no payment is due yet, such as at the start of a free trial.
How much notice do I owe before a free trial converts?
At least seven days, by email or another agreed method, including the amount, the date of subsequent charges, and a simple way to cancel online or by SMS.
Does a passing [AVS](/blog/what-is-avs-address-verification-service) check help here?
Not with these obligations. AVS checks an address at authorization time. The stored credential rules are about consent, disclosure, notice, and how the transaction is flagged, and none of that is covered by an address match.
What happens if my gateway sends the wrong indicator?
The transaction can be treated as something other than what it was, which affects interchange qualification and weakens your position in a dispute. Ask your provider to confirm the entry mode and indicators on every stored credential transaction type you run.
Running subscriptions or retainers and not certain your billing flow lines up with these rules? Apply free and we'll go through it with you, or talk to a specialist about your recurring setup and dispute numbers.
Jeffrey Anderson, Merchant Placement Specialist
Merchant placement specialist at Gray Merchants. Jeffrey works directly with acquiring-bank underwriting teams across the firm’s 70+ banking relationships to place high-risk and hard-to-place businesses, structure multi-MID accounts, and keep flagged merchants processing. His writing draws on the placement files he works every week: what underwriters ask for, why accounts get declined, and what keeps an approved account open.