Document Customer Consent for Card-on-File Payments

Describe the future use before saving a method

Tell the customer why a method will be saved and which future payment actions it supports. A card saved for a buyer to select at a later checkout is different from an agreement permitting the merchant to charge it later. Ask the processor which approval steps and transaction indicators apply.

Store a provider reference and a consent record

• Record the agreement version, acceptance time, and permitted future use.
• Keep the provider’s saved payment identifier with the customer record using the approved storage method.
• Keep verification codes out of saved records. PCI SSC prohibits retaining those codes after authorization.

Update billing when the agreement changes

Give customers a clear way to remove a saved method or cancel future billing. In the staff workflow, show which upcoming payments are affected and who confirms the change. When the billing amount, timing, or purpose changes, check whether updated consent is needed before charging.