Recurring & Subscription Payments

How do recurring payments work?

Recurring payments work by securely storing a customer’s payment card details and obtaining their permission to charge the card on an ongoing basis. This process begins with an initial payment, commonly referred to as a Cardholder‑Initiated Transaction (CIT).

CIT (Cardholder Initiated Transaction)

A CIT is the first payment in a recurring relationship. It is actively initiated by the cardholder, for example:

• Signing up for a subscription online
• Saving a card during checkout
• Providing card details over the phone when enrolling in a service (such as insurance)

Recurring Payment Flow

During the initial CIT:

• The cardholder provides their card details and completes authentication where required (for example, 3D Secure for online payments).
• The first transaction captures the cardholder’s consent (mandate) to store their payment details and charge them in the future.
• This initial transaction is also known as credential‑on‑file (COF) initialisation.

After the CIT is authorised:

• You (the merchant) or Tyl by NatWest acting as the Payment Service provider tokenises and securely stores the card in line with PCI-DSS regulations.
• The card issuer is informed that the merchant now has credentials on file for future use.
• Subsequent recurring payments do not require customer interaction.
• These future charges are classified as Merchant initiated Transactions (MITs)
• MITs do not require strong customer authentication (SCA) because:
  • they are initiated by the merchant or a by the system at the given intervals/frequency set, and
  • SCA was already performed on the initial CIT (where required).

Once the CIT establishes the mandate:

• Subsequent recurring payments do not require customer interaction.
• These future charges are classified as Merchant initiated Transactions (MITs)
• MITs do not require strong customer authentication (SCA) because:
  • they are initiated by the merchant or a by the system at the given intervals/frequency set, and
  • SCA was already performed on the initial CIT (where required).

Get started with recurring payments

If you’re looking to start processing recurring payments, you’ll find guidance on the most common setup options below.

Setting up recurring payments over the phone

If you’re speaking to a customer and signing them up for an ongoing service, you can use the Virtual Terminal to take the first payment and set up the recurring schedule at the same time.

Once the initial payment is completed and the billing frequency is defined, future payments will be processed automatically.

To set this up:

1. Log into the Virtual Terminal
2. Click “New Sale”
3. Enter the amount and complete the rest of the form
4. Click “Next”
5. Review the Summary page to ensure all details are correct
6. Click “Go to Payments”
7. Complete the payment form and tick the “Make this Payment Recurring” checkbox
8. Set the Frequency, Number of Payments, and End Date
9. Click “Pay”

Setting up recurring payments using payment links

If you take remote payments where the customer is not physically present, you can use payment links to securely collect the initial payment.

Payment links reduce fraud risk by ensuring customers complete Strong Customer Authentication (SCA) during the initial Cardholder‑Initiated Transaction (CIT), instead of sharing card details over the phone.

You can share payment links securely by email, SMS, or by attaching them to an invoice or bill.

To set up recurring payments using payment links you need to:

1. Log into the Virtual Terminal
2. Click “New Sale”
3. Enter the amount and complete the rest of the form
4. Click “Next”
5. Review the Summary page to ensure all details are correct
6. Click “Go to Payments”
7. Click “Payments Link” tab
8. Select a “Link Expiry Date” (optional)
9. Complete the payment form and tick the “Make this Payment Recurring” checkbox
10. Set the Frequency, Number of Payments, and End Date
11. Click “Generate”

Setting up recurring payments on your website

You can also set up recurring payments directly through your website using our APIs.

These allow you or your developer to build integrations that support automated billing. For detailed technical guidance, visit our Developer Documentation. 

How do I obtain consent from a cardholder?

Customers must provide their payment details and give explicit permission for your business to charge them on a recurring basis, according to the agreed billing schedule.

Obtaining this consent is your responsibility and is essential both for regulatory compliance and for maintaining customer trust.

Who stores the consumer’s payment information?

Customer payment details are stored securely by a payment provider such as Tyl by NatWest, using encryption and tokenisation in line with PCI DSS standards.

While it is technically possible for businesses to store payment details themselves, doing so significantly increases PCI DSS compliance requirements and risk. For this reason, most businesses choose to have payment information securely stored and managed by their payment provider.

Can customer get notifications and payment confirmations?

Yes.

If configured, customers can receive payment confirmations or e‑receipts after each successful charge. Many businesses also choose to send reminders for upcoming payments, failed payments, or expiring cards to maintain transparency and reduce payment issues.

How do I update the payment schedule?

Customers may contact you to request changes, such as updating a payment date.

You can amend certain aspects of a recurring payment schedule by accessing the Virtual Terminal, locating the relevant order, and updating the schedule. For step‑by‑step guidance, please refer to the Order Details section of the Virtual Terminal User Guide.