Hand-drawn card-on-file title card illustration
Back to Blog

Card on File: 4 Consent Fields and Visa Indicators for Merchants

Merchant Solutions Corp10/15/2026

Card on File: 4 Consent Fields and Visa Indicators for Merchants

Hand-drawn card-on-file title card illustration

Card on file authorization is a cardholder’s documented permission for a business to store and charge their payment card for future transactions. The first steps are straightforward: collect affirmative, written or electronically authenticated consent, keep proof of that consent for audits, use tokenization instead of storing raw card numbers, and never retain the CVV after the initial authorization.

TL;DR:

  • Recurring billing consent must be affirmative and separate from general terms, disclose the amount, frequency, cancellation method, and business contact, and remain on file for three years.
  • Use tokenization instead of storing raw card numbers, mask displayed numbers, and permanently delete CVVs and other sensitive authentication data after initial authorization.
  • Mark the initial authorization or verification with C in POS Environment, then use POS Entry Mode Code 10 for merchant initiated charges; do not reuse declined credentials.
  • Classify recurring subscriptions and installment plans correctly: Visa uses R or I indicators according to whether payments are fixed or billed in parts, and C for applicable initial storage events.
Merchantsolutionscorp
Set Up Payments for Stored Credentials
Merchant Solutions Corp provides payment processing and POS systems for businesses, with support from onboarding through daily operations.
Explore payment solutions

Table of Contents

What card on file authorization means for your business

A stored credential is a cardholder’s payment card information kept on file so you can charge it again without asking for the number each time. We see this most often with subscriptions, membership dues, and saved customer profiles at retailers and service providers.

There is a meaningful difference between the first authorization (when you capture the card and confirm it works), an account verification (a check that confirms the card is valid without a purchase), and later merchant-initiated charges that use the credential you already stored. Some transactions also involve estimated or incremental authorizations, where the final amount is not known upfront, such as a hotel stay or a tab that grows over time. Each of these moments requires its own handling, and mixing them up is one of the most common sources of declines.

A card on file consent form needs to do two jobs: protect the cardholder’s right to clear information, and protect your business if a charge is ever disputed. Build the form around these fields:

  • Cardholder’s full name and billing address matching the card
  • Truncated card number plus expiration date
  • Plain-language consent statement describing what the cardholder is agreeing to
  • Signature or e-signature with a timestamp

The consent language itself should spell out the charge frequency, the amount or how it will be calculated, how the customer can cancel, and your business name and contact information. Useful extras include a consent expiration date, a preferred contact method, and a receipt preference, which cuts down on confused customers calling about charges they forgot they approved.

Types and use cases for stored credentials

Not every stored credential works the same way, and the stored-credential transaction framework from Visa lays out distinct categories merchants need to tag correctly:

  • Recurring subscriptions and installment plans use an ‘R’ or ‘I’ indicator depending on whether the amount is fixed or billed in parts.
  • Unscheduled credential-on-file (UCOF) covers variable charges, like a utility bill or a tab that changes month to month, and the initial storage event is tagged with a ‘C’ value where applicable.
  • Cardholder-initiated stored-credential transactions happen when the customer themselves starts the charge using a saved card, which is handled differently in processing than a charge you initiate on their behalf.

Picking the right category up front keeps your authorizations clean and reduces the chance of a processor flagging the transaction later.

Two federal frameworks set the baseline for card on file consent in the United States, and both demand more than a buried line in your terms of service.

The FTC’s amended Negative Option Rule requires that consent for recurring charges be affirmative and separate from general terms and conditions, with clear disclosure of cost, frequency, and cancellation presented where the customer actually agrees to the charge. The CFPB’s rule on preauthorized transfers goes further for electronic fund transfers, requiring that preauthorized transfers be authorized in writing or through a similarly authenticated method, with a copy of that authorization given to the consumer.

In practice, this means your form or checkout flow should cover:

  • A clear statement of the amount or how it is calculated
  • The charge frequency and what triggers each charge
  • A simple way to cancel
  • Your business name and a way to reach you

Keep your proof of consent on file. The FTC’s guidance points to retaining evidence of consent for at least three years, which gives you a defensible record if a chargeback or regulatory inquiry comes up.

What you can store securely and what you cannot

PCI DSS Requirement 3.2 draws a hard line: sensitive authentication data, including the CVV, full magnetic stripe data, and PIN blocks, cannot be stored after the initial authorization. This data must be permanently removed from every system it touches, including logs, cache, and backups.

The practical fix is tokenization: replacing the card number with a secure token that has no value outside your payment system. A few rules to build around:

  • Never store the CVV, even with the customer’s permission
  • Use a tokenized gateway so the raw card number never sits on your servers
  • Mask the card number in any display or receipt
  • Keep your token system segmented with strong access controls, since it still falls inside your cardholder data environment

Pro Tip: Ask your processor or gateway provider directly whether they offer tokenization and whether they can share validated payment application documentation before you build a card on file workflow around their system.

How stored-credential transactions get processed and flagged

Card networks need to know when a charge is coming from a stored credential rather than a card swiped or typed in real time. Visa’s stored-credential transaction framework requires that when you first capture a credential for future use, you submit an authorization or account verification identified with a ‘C’ value in the POS Environment field.

Every subsequent merchant-initiated charge against that stored credential must carry a POS Entry Mode Code of ‘10’. If that first authorization or verification is declined, you should not treat the credential as successfully stored and should not attempt to charge it later. Getting these indicators right matters: they reduce unnecessary declines and make reconciliation with your processor far easier when questions come up.

Stored-credential authorization and charge sequence

Building and adapting your authorization form

A workable card on file template needs a few adjustable parts depending on your channel. Start with the core elements, then adjust for how you collect consent:

  1. Define the charge description, what triggers it, how often it recurs, and your refund and cancellation terms.
  2. For e-sign forms, use a separate checkbox for consent, generate a timestamped record, and send the customer a stored copy automatically.
  3. For in-person or phone consent, use a wet-signature form or a recorded verbal authorization with the same disclosure elements.
  4. Before launch, confirm your gateway supports tokenization, check that your system applies the correct stored-credential indicators, and make sure consent records are easy to pull up during a dispute.

Keeping records straight after the sale

Retention and timing matter as much as the initial consent. Keep your authorization logs and proof of consent for at least three years, matching FTC guidance for recurring billing models.

Re-verify a stored card when it expires, when a long stretch of time has passed since the last charge, or whenever the customer asks you to confirm it. Pay attention to authorization validity windows, and clear captures promptly where your processor requires it.

If a dispute lands on your desk, your response should include the original consent record, the full transaction sequence, and any communication you had with the customer about the charge. A complete file here is often the difference between winning and losing a chargeback.

Why tokenized, compliant card on file setups matter

Card on file consent is only half the job. The other half is making sure the credential is stored and processed in a way that actually holds up to PCI scrutiny and network rules. We pair our payment solutions with fast onboarding and POS and eCommerce systems, because a compliant setup should not slow down a sale.

This combination keeps your PCI scope smaller, lowers the chance of a disputed charge turning into a loss, and gets recurring billing running without the back and forth of fixing authorization indicators after the fact.

— Jonathan

Setting up compliant card on file payments with us

We help businesses put a compliant card on file system in place without the guesswork of building one from scratch. Our Online & eCommerce payment solutions and POS systems, including Clover and Square, support card payment processing.

A few ways we support this setup:

  • Payment processing solutions for businesses that handle sensitive payment data
  • Onboarding support that gets your authorization workflow configured correctly from day one
  • Industry-specific setups for restaurants, retail, and high-risk or specialty businesses
  • Hardware programs with upfront options for qualifying accounts

If you handle recurring billing or saved customer cards and want ACH as an added option, current prices for our Gateway + eCheck plan are on our website.

Reach out to us to get your compliant card on file payment system configured and running.

This article is general information, not a substitute for advice from a qualified financial advisor. Consult a qualified financial professional about your own circumstances before acting on anything here.

FAQ

Yes, provided you get the cardholder’s affirmative consent and follow data security rules. The FTC’s negative option guidance requires clear, separate consent for recurring charges, and PCI DSS governs how the underlying card data must be protected.

How long does an authorization stay on a credit card?

Authorization validity windows vary by transaction type and card network, and Visa updated its timing rules in 2024 to simplify these windows. Check with your processor for the specific hold period that applies to your transaction type, since clearing promptly avoids unnecessary holds on the cardholder’s account.

What does it mean to have a card on file?

It means a business has stored a customer’s payment card information, typically as a secure token, so it can charge that card again without asking for the number each time. This is common for subscriptions, memberships, and repeat customers at retail or service businesses.

How do I create an authorization for a credit card?

Start with a form that includes the cardholder’s name, truncated card number, billing address, and clear consent language covering amount, frequency, and cancellation terms. Have the cardholder sign or e-sign it, then store that record securely for at least three years in case you need it for a dispute.

Sources

card on file authorization

Share this article:

Post on XFacebookLinkedIn