Recurring Payment / Subscription Payment is a charge the customer authorises once and the merchant then collects automatically at agreed intervals, such as weekly, monthly or annually, until the customer cancels, over cards, SEPA Direct Debit or open banking mandates. On cards, the sign-up is a customer-initiated transaction that stores the credential, and each renewal is a merchant-initiated transaction linked to it; network tokens update automatically when cards are reissued. Under PSD2, setting up the mandate remotely needs strong customer authentication, but later payee-initiated charges fall outside it. Failed renewals from expired cards or insufficient funds lose revenue unless retried, and forgotten subscriptions often return as chargebacks that count towards scheme dispute ratios.
How do recurring payments work
On cards, the first payment is a customer-initiated transaction: the customer enters card details and the merchant stores the credential with consent to future charges. Each renewal is then sent as a merchant-initiated transaction (MIT), flagged as recurring and linked to the original transaction's identifier, so the issuer can see it belongs to an existing agreement rather than a new purchase. Stored card numbers are increasingly replaced by network tokens, which the card scheme updates automatically when a card is reissued or expires.
Recurring payments and SCA
Under PSD2, the European Banking Authority's position is that payments initiated by the payee under a mandate, without a specific action by the payer, are outside the scope of strong customer authentication. Setting up that mandate through a remote channel does require SCA. In practice, the sign-up payment goes through 3-D Secure and later renewals carry a reference to it.
A separate exemption in Article 14 of the SCA regulatory technical standards covers a payer-initiated series of payments of the same amount to the same payee. A usage-based subscription whose amount changes each month cannot rely on that exemption, but it can still be sent as an MIT.
What failed renewals cost
Illustrative: a SaaS business with 20,000 subscribers at €29 a month bills €580,000 monthly. If 6% of renewals fail on the first attempt because of expired cards, insufficient funds or issuer declines, that is 1,200 failed charges worth €34,800. Recovering half through retry logic timed around paydays, plus card-updater services, keeps €17,400 a month, about €208,800 a year, from customers who never meant to leave.
The other cost is disputes. Customers who forget a subscription often file a fraud or "cancelled recurring" chargeback instead of asking for a refund, and each one carries a fee and counts towards the merchant's dispute ratio with the card schemes.
Rules on cancelling subscriptions
In the US, the Federal Trade Commission's "click-to-cancel" amendments to its Negative Option Rule were vacated by the Eighth Circuit in July 2025, days before compliance was due, leaving state automatic-renewal laws as the main constraint. In the UK, the Digital Markets, Competition and Consumers Act 2024 introduces a subscription contracts regime, expected to take effect in spring 2027. It adds a 14-day cooling-off period at the start of a contract and after a free trial or the renewal of a contract of 12 months or more, and bans making cancellation disproportionately difficult.
For a buyer of a subscription business or the PSP that serves it, the useful figures are first-attempt and recovered approval rates on renewals, dispute rates on recurring charges, and the share of stored credentials held as network tokens.