Subscription Payment Processing: From First Charge to Every Renewal

Subscription payment processing is how you charge the same customer again and again on one agreement, without them typing their card each time. Behind every renewal sits a chain of rules: the consent you collected at sign-up, the way you store the card, the flag on each charge, and what you're allowed to do when the bank says no. This guide follows a card subscription from the first charge to the tenth renewal, with the Visa rules, the European SCA rules and the processor checks that decide whether renewals keep going through. For supplement and skincare brands: subscriptions for supplement brands and subscriptions for skincare brands.

What is subscription payment processing?

It's the part of your stack that turns a subscription agreement into payments: it stores the customer's payment details, charges them on schedule, and handles the renewals that fail. The billing system decides what to charge and when. The processor sends each charge through the card network to the customer's bank, which approves or declines.

Card networks don't use the word "subscription". They classify payments on a stored card by how they're scheduled, and each type has its own flag and its own rules.1Visa Core Rules and Visa Product and Service Rules, April 18, 2026

Bank debits like ACH and SEPA work on mandates instead of card rules. They're covered further down.

How a recurring card payment works, step by step

The order matters. Visa says that after the agreement is in place and before the first transaction, you must either authorize the amount due or send an account verification. If that first request isn't approved, you must not store the card.1Visa Core Rules and Visa Product and Service Rules, April 18, 2026

Customer-initiated vs merchant-initiated transactions

Every subscription has two kinds of payments. The customer-initiated transaction (CIT) is the one the customer makes at sign-up. The merchant-initiated transactions (MIT) are the renewals you charge afterwards, on the strength of that first agreement.

Each processor exposes the flags differently, but they map to the same network framework:

Sources: Stripe3Stripe Docs, Save a customer's payment method when they use it for a payment and Adyen.7Adyen Docs, PSD2 SCA business models overview15Adyen Help Center, How can I choose the Recurring Processing Model? Adyen is explicit about the risk: if you don't send the scheme transaction identifier with later payments, issuers can return soft declines. If you store cards in your own vault or a third-party one, Adyen tells you to use the card schemes' MIT framework so the payment is classified correctly.7Adyen Docs, PSD2 SCA business models overview

What Visa requires before you store a card

Visa's rules for stored credentials start before the first charge. Before you store a card for future payments, you need the cardholder's express, informed consent to an agreement that covers, among other things:1Visa Core Rules and Visa Product and Service Rules, April 18, 2026

These terms must be shown when the customer gives consent, and separately from your general terms and conditions. You keep them for the length of the agreement and hand them over if the customer or the issuer asks in writing. A recurring or unscheduled credential-on-file charge can't include finance charges or interest. And if you don't respect your own terms, Visa says you refund the full amount paid.1Visa Core Rules and Visa Product and Service Rules, April 18, 2026

On each charge, Visa also has processing rules: a transaction with a stored credential uses POS entry mode 10 and the recurring, installment or unscheduled indicator; the authorization can't exceed the amount of that payment; and before a customer pays with a card you saved, you validate who they are, for example with a login.1Visa Core Rules and Visa Product and Service Rules, April 18, 2026 Your processor sets the technical fields. Your job is to tell it which kind of payment it is.

Visa rules for recurring transactions

On top of the stored-credential agreement, recurring transactions have their own requirements. Here is what they mean for a subscription business.1Visa Core Rules and Visa Product and Service Rules, April 18, 2026

Trials and "until cancelled" offers carry more rules, from the FTC and US states as well as Visa. They're covered in our guide to negative option billing.

That last rule is easy to miss. A declined renewal isn't only a retry problem: it starts a 7-day window in which the customer must be told and offered another way to pay. Plan your dunning emails around it.

SCA and subscriptions in Europe

In the EEA and the UK, strong customer authentication applies to online payments the customer initiates. A subscription fits that rule in two parts.

• The sign-up needs SCA. The European technical standards require authentication when the payer creates, changes or makes the first payment of a series of recurring transactions with the same amount and payee; later payments in that series can be exempt.9Commission Delegated Regulation (EU) 2018/389, RTS on strong customer authentication The EBA adds that payments the merchant starts on the basis of a mandate, without action from the payer, are outside SCA, but setting up that mandate online is itself subject to it.10EBA Single Rulebook Q&A 2018_4031, payee-initiated card payments
• Renewals are merchant-initiated. Stripe's guidance is to authenticate the card at the first payment, or with a setup flow when nothing is charged, then flag later payments as off-session.11Stripe Docs, Strong Customer Authentication readiness Variable amounts work the same way.
• The issuer keeps the last word. It can still decline an off-session renewal and ask for authentication.11Stripe Docs, Strong Customer Authentication readiness At Stripe, authentication_required is a hard decline for Billing retries: the payment only runs again once the customer acts.4Stripe Docs, Automate payment retries Send them a payment link.

Merchant-initiated renewals also skip the liability shift: a fraud dispute on a renewal stays with you. The detail of exemptions and liability is in our guide to payment authentication.

Keeping stored cards alive: account updater and network tokens

Cards expire, get reissued after a loss, or get replaced by a new number. A subscription stored on the old details fails at the next renewal unless something updates them. Two tools do that job.

A card account updater lets the processor fetch new card details from the network. Visa requires issuers in most regions, including the US, Canada and Europe (except Hungary and Türkiye), to enroll their BINs in Visa Account Updater; prepaid BINs are excluded, and commercial BINs in several regions. Issuers must send a new number and expiry within 2 business days of activating the account.1Visa Core Rules and Visa Product and Service Rules, April 18, 2026 A network token goes further: it's a substitute for the card number, issued by the network, that keeps working when the underlying card changes. Stripe uses both on saved cards, and Adyen offers both, requesting network tokens automatically for stored cards where possible.6Stripe Docs, Payments optimization (Authorization Boost)8Adyen Docs, Tokenization

The updater doesn't always return a new card. Visa defines the answers an issuer can send, and each calls for a different move:1Visa Core Rules and Visa Product and Service Rules, April 18, 2026

Two limits to know. Updater coverage is wide in the US, but Stripe says international support varies by country and that you can't tell in advance which cards support it.5Stripe Docs, How cards work (automatic card updates) And keeping stale cards costs money: Stripe notes that Mastercard charges a Credential Continuity Program fee when a payment is attempted with outdated card details, and that network tokens can avoid it.6Stripe Docs, Payments optimization (Authorization Boost) If you route renewals across several processors, check that each one runs the updater and network tokens on the cards it charges.

When a renewal is declined: retries and network limits

Most failed renewals can be recovered, but not all of them, and not without limits. The card networks set how often you may try again, and the limit counts per card across all your processors.

Source: Visa Core Rules, Table 7-2, p. 538-541.1Visa Core Rules and Visa Product and Service Rules, April 18, 2026 R0, R1 and R3 deserve attention in a subscription business: they mean the customer told the bank to stop paying you. Retrying them is a breach, and a dispute waiting to happen.

Billing tools apply their own limits inside the network's. Stripe Billing's Smart Retries picks retry times from signals like the time of day and how the card was recently used; you set a number of attempts over 1 week to 2 months, with 8 tries within 2 weeks as the recommended default. Stripe won't retry after hard declines such as lost_card, stolen_card, revocation_of_authorization or authentication_required until a new payment method is added. When retries run out, the subscription is canceled, marked unpaid, left past due or paused, depending on your setting.4Stripe Docs, Automate payment retries

What causes failed renewals and how to prevent them is covered in subscription payment failures. The retry rules across several processors are in dynamic payment routing, and how to measure them in payment acceptance rate.

Cards, ACH or SEPA for subscriptions

Cards aren't the only way to bill on a schedule. In the US, ACH debit pulls from a bank account; in the euro area, SEPA Direct Debit does. Both work on a mandate the customer accepts, and both behave very differently from cards when something goes wrong.

Sources: Stripe's ACH and SEPA documentation13Stripe Docs, ACH Direct Debit payments12Stripe Docs, SEPA Direct Debit payments and retry settings.4Stripe Docs, Automate payment retries A disputed ACH payment invalidates the mandate, and a SEPA dispute can deactivate it: you need a new mandate before charging again.13Stripe Docs, ACH Direct Debit payments12Stripe Docs, SEPA Direct Debit payments Bank debits cost less to run and never expire like cards, but the customer holds stronger dispute rights. They fit best as a second method you offer, not a replacement. More in ACH payment processing and alternative payment methods.

Do processors accept subscription businesses?

Most do. Recurring billing is a standard feature at Stripe, Adyen and most acquirers. What they review is how you sell it.

That last point is about your merchant category code. Visa's MCC 5968, Direct Marketing, Continuity and Subscription Merchants, covers goods like books, cosmetics, food, clothing or nutraceuticals sold on subscription through direct marketing. A merchant that simply offers recurring billing without direct marketing keeps the code of its main business; streaming uses 4899 and digital subscriptions 5815 to 5818.2Visa, Merchant Data Standards Manual, April 2026 Visa lists 5968 among its high-risk codes for card-absent sales.2Visa, Merchant Data Standards Manual, April 2026 If your offer fits it, expect a closer review and plan for it. See MCC 5968 and our guide to high-risk MCC codes.

How to choose a payment processor for subscriptions

The rate is the easiest thing to compare and the least specific to subscriptions. These questions tell you more about how renewals will go.

If you already run more than one processor, the same questions apply to the layer that sits above them: where the cards are stored, and who keeps the reference of each customer's first payment. That's covered in what payment orchestration is.

Running subscriptions across several processors

A second processor protects you if the first one reviews or closes your account. It only works for subscriptions if the stored cards can follow. A card stored in one processor's vault can't be charged through another without migrating it.

Before you move renewals to a new account, check with that processor how it handles a card first authenticated elsewhere, and send the original transaction reference where it accepts one. The retry count stays per card, whichever account charges it.

By industry