Recurring billing compliance title card illustration
Back to Blog

5 Critical Recurring Billing Setup Steps for SMBs to Avoid FTC Risk

Merchant Solutions Corp10/6/2026

5 Critical Recurring Billing Setup Steps for SMBs to Avoid FTC Risk

Recurring billing compliance title card illustration

To turn on recurring billing, you need five things working together: a merchant account and gateway that support stored credentials, explicit customer consent captured before the first charge, a correctly flagged initial authorization followed by merchant-initiated transactions, an automated retry and dunning sequence, and a full test run before you go live—for practical insights on integrating order management with billing, see our guide on OMS software for resellers. Skip the compliance or testing pieces and you risk declined payments, chargebacks, or a regulatory problem you did not see coming.

TL;DR:

  • Ensuring proper order of setup tasks, including merchant account, billing model, consent capture, and webhook configuration, prevents costly rework later.
  • Correctly flagging initial customer-initiated transactions and subsequent merchant-initiated charges using stored credentials is critical to avoid declines and disputes.
  • Building a straightforward cancellation flow and obtaining explicit consent reduces legal risks and customer complaints, especially under FTC regulations.
  • Implementing a tested retry and dunning process tailored to card and bank transfer behaviors helps recover missed payments efficiently.
  • Running comprehensive pre-launch tests and ongoing monitoring of decline, webhook, and revenue metrics safeguards billing stability and revenue.
Merchantsolutionscorp
Build A More Reliable Payment Setup
Merchant Solutions Corp provides payment processing, POS systems, and configured equipment for businesses accepting card and ACH payments.
Explore payment solutions

Table of Contents

Quick-Start Checklist: What You Need and in What Order

Before you write a line of configuration, line up the pieces in the right sequence. Getting the order wrong usually means redoing consent flows or re-mapping gateway fields after you have already onboarded customers.

  1. Open a merchant account and connect a payment gateway. Your bank relationship and your gateway (the system that tokenizes and routes transactions) need to talk to each other before anything else happens.
  2. Decide your billing model. Subscription, installment plan, or membership each carries different proration and cancellation logic, so pick one before building objects in your platform.
  3. Draft your pre-billing disclosure and consent capture. You need the price, frequency, and cancellation terms shown clearly before the customer agrees to anything.
  4. Choose accepted payment methods. Cards settle fast but carry higher processing costs; ACH/eCheck costs less per transaction but takes longer to clear and carries different return codes.
  5. Build your subscription or invoice templates. Set pricing tiers, trial periods, and proration rules so upgrades and downgrades calculate correctly from day one.

Your billing model choice shapes everything downstream. A simple monthly subscription needs less proration logic than a membership program with mid-cycle upgrades, and an installment plan needs a fixed end date that a subscription object does not. If you sell into retail or service verticals, look at how replenishment and membership programs structure their billing cycles. Those patterns translate directly to most subscription software.

On payment methods, cards and ACH are not interchangeable in how they fail. A card decline often resolves on a retry within days. An ACH return can take longer to surface and uses a different set of reason codes, which matters once you build your dunning logic in the next section. If you expect a meaningful share of customers to pay by bank transfer, review ACH processing considerations before you finalize your retry schedule, since bank-to-bank transfers do not behave like card networks.

Once the checklist items are in place, you are ready for the configuration work that makes the system actually run.

Step-by-Step Configuration Tasks Every Platform Needs

Every recurring billing platform, whether you build on a gateway’s API or use an off-the-shelf subscription tool, requires the same underlying configuration. The vendor names change; the tasks do not.

Create your subscription or plan objects first. Name them clearly (monthly-basic, annual-premium) so your support team and your reporting dashboards stay readable as you add tiers. Decide trial length and whether proration applies when a customer upgrades mid-cycle. Most platforms let you choose between prorating the difference immediately or applying it to the next invoice; pick one and apply it consistently across plans.

Store the compliance metadata alongside the customer record, not in a separate system. At minimum, capture:

  • The exact disclosure text shown to the customer at the moment of signup
  • A timestamp of consent (the checkbox click or signed agreement)
  • The customer’s IP address at the time of consent
  • A copy of the confirmation email or receipt sent afterward

These records matter because the FTC’s amended Negative Option Rule expects businesses to show, on request, that a customer gave express informed consent. If that data lives in three different systems, you will not produce it quickly during an audit or a dispute.

Implement the authentication sequence correctly. The first transaction in a recurring series is a customer-initiated transaction, or CIT: the cardholder is present, actively authorizing the charge, and the issuer authenticates it in real time. Every charge after that is merchant-initiated, or MIT, meaning you submit it without the cardholder present, using the stored credential from the first authorization. Your gateway needs to flag the first transaction correctly and then mark every subsequent charge as MIT using the stored credential indicator your processor requires. CyberSource’s developer documentation lays out the required fields for both the initial CIT authorization and the MIT charges that follow, and most major gateways follow a similar pattern.

Route and secure your webhooks. Webhooks tell your system when a payment succeeds, fails, or a card is about to expire. At minimum, listen for:

  • Successful charge events, so you can update invoice status and trigger receipts
  • Failed charge events, so dunning logic can start immediately
  • Subscription cancellation events, so access shuts off on schedule
  • Card-expiration warnings, so you can prompt customers before a charge fails

Verify webhook signatures on every incoming event and log failures so a dropped webhook does not silently stall your billing pipeline.

Place disclosure copy everywhere the customer sees price and terms. That means the checkout screen itself, the confirmation email sent immediately after signup, and every recurring receipt. Repetition here is not redundant; it is what regulators and customers both expect to see.

Pro Tip: Build your cancellation flow before you build your upsell flow. A rushed cancellation path is the most common compliance gap we see in new recurring billing setups.

With the technical plumbing in place, the next question is whether your consent and disclosure process actually satisfies the legal standard you are operating under.

How to Comply with the FTC Negative Option Rule in Your Billing Flows

The FTC’s modernized Negative Option Rule sets three core requirements for any business that bills customers on a recurring basis without requiring them to re-affirm each charge: clear disclosure before billing, express informed consent, and a cancellation mechanism that is no harder to use than signing up. The full rule text spells out the prohibited practices and the procedural elements the FTC expects businesses to follow.

In practice, this breaks down into a handful of operational habits:

  • Show the price, billing frequency, and renewal terms before you ever collect payment information.
  • Require an affirmative action for consent, such as a checkbox that is not pre-checked, rather than assuming consent from continued use.
  • Build cancellation as a visible, low-friction path: a button or link, not a required phone call or a multi-step retention flow.
  • Log every cancellation with a timestamp and confirmation sent to the customer.
  • Retain consent records (disclosure text, timestamp, IP address) for as long as your legal counsel recommends for your industry.

The FTC received close to 70 consumer complaints a day on average in 2024 about recurring enrollment practices, a volume that shaped the push toward the click-to-cancel standard. That number is a useful reminder that cancellation friction is not a minor UX detail; it is the part of your billing flow most likely to generate a complaint.

Design your cancellation path to mirror your signup path in complexity. If a customer could subscribe in two clicks, they should be able to cancel in roughly the same number. Businesses that make this symmetrical tend to see fewer disputes and chargebacks tied to “I couldn’t cancel” complaints, since the customer never needed to escalate in the first place.

Symmetrical signup and cancellation flow

Once your consent and cancellation flows meet that standard, the remaining risk shifts from legal exposure to payment network mechanics, which is where authentication and stored-credential rules come in.

Card Network Rules and Stored-Credential Requirements

Card networks distinguish sharply between the first transaction in a recurring series and every transaction after it, and getting this distinction wrong is one of the most common reasons recurring charges get declined.

A customer-initiated transaction (CIT) happens when the cardholder is actively present, authorizing the charge in real time, such as the moment they sign up for a subscription. A merchant-initiated transaction (MIT) happens afterward, when you charge the stored card without the cardholder taking any action. Visa’s acquirer and merchant implementation guide requires the first transaction to be authenticated, with every subsequent charge processed using the recurring indicator and related fields rather than treated as a fresh, one-time sale.

The fields your gateway needs to populate correctly include:

  • A recurring transaction indicator on every MIT charge
  • The recurring expiration date of the agreement
  • The billing frequency (monthly, quarterly, annual)
  • A reference to the original, authenticated transaction

Misflagging a recurring charge as a one-time sale, or failing to pass the recurring indicator at all, can trigger unnecessary declines and, in a dispute, weaken your ability to rely on the liability protections that correctly flagged stored-credential transactions normally carry. Guidance on this topic also warns against storing certain authentication data, like the cardholder authentication verification value, for reuse on subsequent charges, since that value is tied to the original authenticated transaction only.

If you are implementing this yourself rather than through a managed gateway, your developer checklist should confirm: the first transaction captures and stores the credential correctly, every subsequent charge references that stored credential with the correct MIT flag, and your gateway’s recurring fields match what your processor expects before you process a single live transaction.

Getting the authentication sequence right reduces declines, but declines will still happen, which is why your recovery process matters as much as your setup.

Designing Retry and Dunning Workflows to Recover Revenue

Failed payments are routine, not exceptional, and a well-built retry sequence recovers a meaningful share of them without you lifting a finger.

  1. Triage the decline reason first. Insufficient funds, an expired card, and a bank-side block each call for a different response; retrying a hard decline immediately just wastes a processing attempt.
  2. Schedule soft retries over several days. A common pattern is a retry at 24 to 72 hours, then again a few days later, spacing attempts out rather than hammering the card repeatedly.
  3. Escalate to customer outreach after the second failed attempt. Send an email or text asking the customer to update their payment method, with a direct link to do so.
  4. Set a final collection attempt and a hard stop. After a defined number of failures, either pause the subscription or move the account to manual collections rather than retrying indefinitely.
  5. Track recovery rate, decline rate, and time-to-recovery on a recurring dashboard so you can see whether your schedule is actually working.

For ACH and eCheck payments, build a separate track: bank returns carry their own reason codes and often take longer to post than a card decline, so a retry schedule built for cards will fire at the wrong times for bank transfers.

Pro Tip: Send the “update your card” message before the retry, not after. Customers who update proactively convert faster than those who wait for a failed charge notification.

A disciplined retry sequence protects revenue, but only if the underlying pipeline is actually working the way you built it, which is why testing comes before any of this goes live.

Pre-Launch Test Checklist and Production Monitoring

Run a full end-to-end test in your sandbox environment before a single real customer is billed. Walk through checkout, the initial CIT authorization, webhook receipt and handling, a simulated retry, and the cancellation flow, confirming each step logs correctly and triggers the right downstream action.

Specifically simulate these failure modes:

  • An expired or declined card on the first charge
  • A network-level decline on a retry attempt
  • A webhook that fails to deliver or arrives out of order
  • A cancellation submitted mid-billing-cycle

Once you are live, set monitoring and alerts for:

  • A sudden spike in decline rate, which often signals a gateway or network issue rather than a wave of bad cards
  • Webhook delivery failures, which can silently stall your billing records if left unnoticed
  • A rising dunning churn rate, meaning more customers are leaving during the retry sequence than usual

For ongoing reporting, track monthly recurring revenue trends, your payment recovery rate, and your raw decline rate side by side. Watching these together shows you whether a revenue dip is a sales problem or a payments problem, which call for very different fixes.

How Merchant Solutions Corp Can Help With Recurring Billing Setup

Not every business wants to configure stored-credential flags and webhook routing in-house, and we built our subscription payment processing services for exactly that gap.

Here is how our setup maps to the tasks above:

  • Our services include gateway and ACH/eCheck processing to support card and bank-transfer recurring charges through a connected system.
  • We offer POS integrations, which can be useful for businesses that take initial in-person payments before converting customers to recurring plans.
  • Our onboarding process covers application through go-live, providing support at each stage instead of transferring responsibility after contract signing.
  • We have hardware programs that can include options with no upfront cost for businesses needing point-of-sale equipment alongside recurring billing setup.

Businesses running high-risk or specialty operations often need setup help that generic platforms are not built to give, and our account team works through those configurations directly rather than leaving merchants to self-serve.

Prioritize Automation, Compliance, and Measurement

The businesses that struggle with recurring billing almost never fail on the technical build. They fail by adding complexity, tiered plans, add-ons, custom proration, before the basic flow is even stable.

Start with a simple, compliant billing cycle and automated retries. Get that working cleanly first. In the first 90 days, watch three numbers closely: your payment recovery rate, your raw decline rate, and how often customers struggle to cancel.

Clear consent and an easy cancellation path are not just a legal requirement. They are the cheapest insurance you can buy against disputes and complaints down the line.

— Jonathan

Get Your Recurring Billing Set Up With Merchant Solutions Corp

If you would rather have your recurring billing built for you than build it yourself, we handle the setup end to end. Our team connects your merchant account, gateway, and ACH/eCheck processing, configures your subscription or invoice templates, and walks you through onboarding from application to go-live.

For bank-transfer billing, our Gateway + eCheck plan runs $25 per month and covers the eCheck processing most recurring billing setups need alongside card payments. If you are weighing card processing structures, our merchant services page outlines the account options available, including Clover-based setups for businesses that want integrated POS and recurring billing in one system.

Reach out through our site to get your account reviewed and your billing pipeline configured with support from day one.

FAQ

What are the best recurring billing platforms?

The right platform depends on whether you need card processing, ACH/eCheck, or both, and how much compliance and retry logic you want handled for you versus built in-house. Look for stored-credential support, built-in dunning, and clear consent-logging tools rather than judging on price alone.

Can I set up automatic payments for bills?

Yes, most billers and subscription services let you authorize automatic payments by card or bank transfer once you provide consent and payment details. You should receive a disclosure of the amount, frequency, and cancellation terms before the first automatic charge runs, under the FTC’s Negative Option Rule.

How do I turn recurring billing on?

You need a merchant account connected to a gateway that supports stored credentials, a disclosure and consent flow completed before the first charge, and a tested retry sequence for failed payments. Once those pieces are configured and tested in a sandbox environment, you can move the setup into production.

What happens if I turn on recurring billing?

Your system authenticates the first charge as a customer-initiated transaction, stores the payment credential, and then submits every later charge as a merchant-initiated transaction using that stored credential. Customers should receive a receipt after each charge and retain an easy way to cancel at any point in the cycle.

Sources

recurring billing setup

Share this article:

Post on XFacebookLinkedIn