How recurring payments work: subscriptions, billing, and authorization

Five layers make a recurring payment

The layers need separate identifiers and states. In documentation fetched August 10, 2026, Stripe illustrates this with a subscription, invoice, and PaymentIntent: each payment due creates an invoice and payment object, and the payment outcome affects both invoice and subscription status. That is one vendor’s model, not a universal schema, but the design lesson is durable. “Customer is subscribed,” “invoice is open,” and “payment succeeded” answer different questions.

Card on file and ACH debit are different recurring mechanisms

Card-on-file billing starts with a consented first transaction

Visa defines a stored credential as account information or a payment token kept by a merchant or its agent for future transactions. Its framework distinguishes a cardholder-initiated transaction, where the cardholder actively participates, from a merchant-initiated transaction based on a prior interaction or standing instruction. A recurring subscription renewal is a merchant-initiated use of the stored credential. A customer clicking “pay now” with a saved card is still cardholder-initiated, even though no card number is re-entered.

Visa’s May 2017 stored-credential guide says a merchant must establish an agreement with the cardholder before storage, disclose how the credential will be used, identify initial storage and later usage with the appropriate transaction data, notify the cardholder of changes, and retain the agreement for the duration of consent. Its consent provisions include amount or calculation method, frequency or triggering event, cancellation and refund policies, and applicable fees. Because the guide dates to 2017, consult current acquirer and network rules rather than implementing from this summary alone.

Recurring ACH debit depends on the account and authorization

Nacha’s developer guide says a PPD entry can be a recurring credit or debit to a consumer account with authorization obtained in writing, while an internet or mobile authorization can produce a recurring WEB debit. The originator is responsible for obtaining and proving permission. Nacha says consumer debit authorization must be in writing or similarly authenticated, have clear terms, and explain how the receiver can revoke future recurring debits. For business-to-business payments, it says the partners need an agreement binding both to the rules, without prescribing the same consumer form.

Nacha’s WEB proof-of-authorization practices show the operational data a useful flow preserves: company, single or recurring status, amount, funding account, date or frequency, revocation method and lead time, confirmation number, authorization date, and expected payment date. The document labels its wording as a sample and recommends legal review. Copying the sample without matching the actual product, entry type, jurisdiction, and cancellation process would create evidence that the system cannot honor.

What US Regulation E requires for covered consumer accounts

Regulation E defines its covered “account” as a consumer asset account established primarily for personal, family, or household purposes, and defines a consumer as a natural person. It defines a preauthorized electronic fund transfer as one authorized in advance to recur at substantially regular intervals. Section 1005.10 says preauthorized transfers from a consumer’s account may be authorized only by a writing signed or similarly authenticated by the consumer, and the person obtaining authorization must provide a copy.

• The authorization must be readily identifiable, with clear and readily understandable terms.
• Electronic authorization can satisfy the writing and signature requirement when it evidences the consumer’s identity and assent, and a paper or electronic copy is provided.
• A consumer may notify the financial institution to stop a preauthorized transfer at least three business days before its scheduled date; an institution may request written confirmation under the rule’s conditions.
• For a transfer that varies from the previous or preauthorized amount, the payee or institution generally sends written amount-and-date notice at least 10 days before the scheduled transfer, unless the permitted range option applies.
• Once the institution has notice that authorization is no longer valid, the official interpretation says it must block future payments for that debit, subject to the confirmation procedure described there.

The billing engine creates a new obligation each cycle

A recurring authorization is not an amount calculator. The billing system still needs a versioned plan, billing anchor, period start and end, quantity or usage, discounts, tax treatment, credits, proration, minimums, rounding, and cancellation effective date. It should produce an invoice or charge record before collection. That record explains why this cycle differs from the last and gives support, finance, and the customer one object to discuss.

Do not grant irrevocable service access from an early payment state. In documentation fetched August 10, 2026, Stripe says asynchronous methods such as ACH Direct Debit can make a subscription active while the payment is still processing, and a later failure can void the invoice while the subscription remains active. Its documentation also distinguishes payment success, a need for a new method, and a need for authentication. A business must decide which products allow provisional access, for how long, and how later failure changes entitlements.

Dunning is reason-specific recovery, not repeated charging

Dunning is the process after a collection failure: classify the result, decide whether and when another attempt is permitted, notify the customer, collect corrected payment information or authentication, and apply the final access and accounting policy. In documentation fetched August 10, 2026, Stripe supports automatic or custom retry schedules, payment-failure webhooks, and final subscription states such as past due, canceled, or unpaid. Those are configurable product behaviors, not a legal entitlement to keep charging.

Cancellation must stop billing and preserve history

Cancellation changes at least three things: future service, future invoices, and future payment initiation. They may take effect at different times under the agreement, but the system must express each one. Visa’s May 2017 stored-credential guide says not to complete transactions beyond the agreed duration or after cancellation under the agreed policy. Regulation E separately gives covered consumers stop-payment and revocation protections for preauthorized transfers. Preserve the authorization and payment history after cancellation while disabling future collection credentials in the billing workflow.