Subscription and Continuity Payment Processing: Billing Forever Without Losing the Account

The first month of a subscription business looks like the safest merchant account a processor could write. Small tickets, repeat customers, predictable volume, almost no disputes. Month four is where it turns. The cohort that signed up on a trial in month one starts hitting statements at full price, the customers who forgot they subscribed dispute instead of cancelling, and the ratio triples without a single new marketing decision. Then the card expirations start, the retries pile up on the same declined credentials, and the processor sees a merchant hammering dead cards while the dispute count climbs. The review email arrives, and with it a hold on a balance that was supposed to fund next month's inventory. The billing model simply matured. This is a guide to why recurring billing is underwritten as risk, what the card networks now require of a subscription merchant, and how to structure the stack so a single processor's decision cannot end the revenue.

Why continuity is priced as risk

Recurring billing concentrates three things acquirers dislike into one account.

The customer relationship is long, so the acquirer's liability window is long. A subscriber who charges back nine months of billing is reaching further into the past than any one-time buyer can, and the acquirer, not you, is the party on the hook if your balance cannot cover it.

The consent is easy to dispute. Every rebill is a charge the cardholder did not actively initiate that day, which makes "I did not authorize this" both plausible to an issuer and unusually cheap for the cardholder to claim.

And the category has a long history of abuse. Free-trial-to-forced-continuity schemes, buried cancellation flows, and shipped-until-you-notice models trained a generation of underwriters to treat continuity billing as guilty until documented. Legitimate subscription brands inherit that posture whether or not they earned it, and the deferred-underwriting trap is the usual one: approval is instant, scrutiny arrives with your fourth-month dispute curve.

The rules you are actually being held to

Two layers govern negative-option billing, and they move at different speeds.

The legal layer in the United States rests primarily on ROSCA, the Restore Online Shoppers' Confidence Act, which requires clear disclosure of terms, informed consent before a card is charged, and a simple mechanism to stop recurring charges. The FTC's broader "click to cancel" negative option rule was struck down by a federal appeals court in 2025 before it took effect, so the specific obligations in that rule are not currently enforceable. Do not read that as deregulation. ROSCA remains in force, the FTC continues to bring enforcement actions under it, and state auto-renewal laws, California's in particular, impose their own disclosure, reminder, and easy-cancellation duties on anyone billing residents of those states. This is genuinely unsettled territory, so build to the strictest standard you are exposed to rather than the loosest one currently in effect.

The card network layer is the one that decides whether you keep processing. Visa and Mastercard both maintain specific requirements for subscription and trial merchants, and while the details change, the shape has been stable for several years:

• Disclose the price, billing interval, and cancellation method at the point of consent, and keep a record of that consent.
• Send an electronic receipt or notification after the initial transaction and, for trials, before the first full-price charge lands.
• Provide an online cancellation method that does not require a phone call.
• Flag stored-credential transactions correctly, distinguishing the cardholder-initiated first transaction from the merchant-initiated rebills that follow.
• Use a billing descriptor that identifies the subscription, not a holding company nobody recognizes.

That last one is not paperwork. Descriptor mismatch is one of the most common causes of fraud-coded disputes on rebills, and fraud-coded disputes are the most expensive kind to carry.

Where the disputes actually come from

Subscription disputes are rarely fraud in any meaningful sense, but they get coded as fraud constantly.

The dominant driver is forgotten consent. A customer signs up during a promotion, does not recognize the charge six weeks later, and calls the bank instead of you because the bank is one tap away in an app and your cancellation flow is not. The second driver is the trial conversion cliff, where an entire signup cohort converts to full price on the same few days and disputes in a cluster large enough to move a monthly ratio on its own. The third is failed cancellation, where the customer believes they cancelled, the charge arrives anyway, and the dispute is both justified and indefensible.

Because the denominator is your billing count rather than your new-customer count, the math is not intuitive. A growing subscriber base means more rebills every month, so a stable dispute rate per subscriber still produces a rising absolute dispute count, and a shrinking base does the opposite in a way that can flatter you right up to the month it does not. Work through the chargeback ratio explainer with your rebill volume rather than your order volume, because the monitoring programs count the transactions, and card networks have been consolidating their fraud and dispute monitoring into unified thresholds that leave less room to sit just under a line.

Prevention alerts earn their keep here more than in almost any other vertical. A cancellation-and-refund triggered by an alert costs you one month of revenue. The same event as a chargeback costs the revenue, the fee, a slot in the ratio, and eventually the account.

Dunning is a compliance function, not a growth hack

Every subscription business loses cards to expiration, reissue, and insufficient funds, and the instinct is to retry until something sticks. That instinct is how accounts get fined.

The networks distinguish between soft declines, where a retry is legitimate, and hard declines, where the issuer has told you the credential is dead. Retrying a hard decline is a rules violation with per-transaction penalties attached, and both major networks cap how many times a declined recurring transaction may be reattempted within a set window. An aggressive dunning schedule that ignores the response code also signals to your processor's risk team that you are billing customers who no longer want to be billed.

Build retries around the decline reason instead of a fixed calendar. Stop immediately on hard declines and route the customer to a card-update flow. Space soft-decline retries out and cap them well below the network limits. Enroll in account updater services and use network tokens where your processor supports them, because a token that survives a card reissue prevents the decline instead of recovering from it. Handling decline codes correctly is the highest-leverage operational change most continuity merchants can make, and it lifts approval rates while lowering dispute counts.

What processing looks like across the three tiers

	Aggregator	Dedicated high-risk MID	Offshore acquiring
Continuity appetite	Accepted at signup, reviewed later	Underwritten for recurring from day one	Available, jurisdiction dependent
Trial and negative-option offers	Frequently prohibited in policy	Boardable with disclosed flow and terms	Negotiated
Onboarding	Minutes	1 to 3 weeks	3 to 6 weeks
Reserve	None, then a 90 to 180 day hold	Rolling reserve, commonly 5% to 10%	Often higher
Behavior at the month-four dispute curve	Review, hold, or termination	Conversation and remediation	Varies
Realistic role	Not a home for a subscriber base	Primary processing	Redundancy and international

The tier structure is the same one laid out in the high-risk merchant account guide, but continuity changes the stakes of getting it wrong.

A one-time-purchase brand that loses a processor loses the ability to take new orders. A subscription brand that loses a processor loses the ability to bill customers it already has, which is a different and much worse category of failure.

Two structural pieces address that directly. Run at least two dedicated MIDs and split the subscriber base across them using the approach in the MID load balancing guide, so a shutdown costs you part of a base rather than all of it, and so a single MID's dispute ratio is not carrying every cohort you have ever acquired. Then keep the credentials themselves in a vault outside your processors. Card data locked inside one processor's vault means a termination forces you to ask thousands of subscribers to re-enter a card, and in practice a large share of them simply do not. An external vault turns that same event into a routing change nobody notices.

Split by billing model too, not just by volume. Trial-based acquisition and steady-state renewals have different dispute profiles, and putting them on separate MIDs stops your riskiest funnel from threatening the account that carries your mature subscribers.

Practical takeaway

Continuity billing is not hard to bank because subscriptions are suspect. It is hard to bank because the liability window is long, the consent is contestable, the disputes arrive in cohort-shaped clusters months after acquisition, and the category's history put underwriters on guard before you ever applied. The business that keeps collecting discloses terms plainly, makes cancellation genuinely easy, flags stored credentials correctly, retries off the decline reason rather than a fixed schedule, runs multiple dedicated MIDs underwritten for recurring volume, and holds its tokens where no single processor controls them. The business that fails builds a subscriber base inside one aggregator, meets its real dispute curve in month four, and discovers that the receivables and the held balance disappear together. If your recurring revenue depends on one processor that has never seen your renewal cohorts, fix the structure while the ratio is still clean. For a walkthrough of what a subscription and continuity billing stack should look like at your volume, apply for an architecture review.