Compliance and dispute defence are the same build. Every recurring-billing rule the networks enforce is a demand for a timestamped record, so a checkout wired to the spec produces the evidence that wins a 13.5 dispute.
Disclosure belongs on the payment page. Price, frequency, trial length and the post-trial charge must sit where the card details are entered, behind an explicit opt-in, not a terms link.
The reminder is the rule most trials break. Visa wants it at least 7 days before the first real charge; Mastercard wants 3 to 7 days before a digital trial ends. Miss it and the chargeback is effectively pre-lost.
One-click cancel is now mandatory. Cardholders must be able to cancel online however they signed up, and every email and receipt has to carry the cancel path.
Most merchants treat the card networks’ subscription rules as a compliance chore, a box to tick so the acquirer stops emailing. That framing costs them disputes. Read the Visa Core Rules and Mastercard’s negative-option standards closely and one pattern runs through all of it: every rule is really a demand for a record. A disclosure you can prove the customer saw. A consent you can prove they gave. A reminder you can prove you sent.
Build the checkout to produce those records and you are not just compliant. You are holding the exact evidence that resolves a dispute in your favour. So this is a build guide, not a legal summary. We walk the subscription lifecycle in the order your system touches it, checkout to cancellation, and treat each scheme rule as a line in the spec. It is the operational companion to our Subscription Chargeback Prevention guide: that one covers strategy, this one covers wiring.
One scope note before the spec. These rules cover subscriptions and trials across digital and physical goods, business and consumer alike. They do not cover utilities, phone service, insurance, or loan repayments.
The disclosure has to live on the payment page, not behind a link
Both networks require the material terms to appear on the screen where the customer enters card details, not on a linked page they have to open. That means the price, the billing frequency, any trial length, any upfront charge and, critically, what happens when the trial ends, all visible before the customer authorises. For trials that auto-convert, you have to state plainly that billing begins unless they cancel.
Consent has to be explicit and separate. A pre-ticked box does not count, and folding subscription consent into your general terms acceptance does not count. Visa expects a distinct opt-in to the ongoing plan, held apart from the rest of your checkout agreements.
In practice that is one unambiguous line beside the pay button, “14-day trial, then $29.99 per month, cancel anytime,” with a checkbox the customer actively ticks. The test is simple: if an issuer or a regulator can read your consent from a single screenshot of the checkout, so can a dispute reviewer. Build the page you would want to hand over as evidence, because one day you will.
Flag the first transaction as recurring, even at $0
This is the line merchants skip. Visa requires the initial authorisation to be marked as a recurring transaction in your system even when the trial charge is zero. Miss it and you lose the transaction-level proof that the ongoing plan existed from day one.
The confirmation email is mandatory the second they sign up
The moment a customer enrols, even into a $0 trial, you send an electronic confirmation. Email is the default; SMS or an in-app notification works only if the customer agreed to it. It has to confirm they are enrolled and will be charged unless they cancel, state the start date and what they are getting, give the billing amount and frequency, and include a working cancel link.
Here the two schemes diverge. Mastercard requires this confirmation for every subscription, trial or not, digital or physical, with no high-risk carve-out. Visa mandates it for trials and intro offers, and for regular recurring e-commerce it must at least be available on request. In the EU, Visa adds a hard window: confirm the agreement within two business days. If you sell into Europe that clock is part of your spec, and it dovetails with the consent trail SCA already forces you to keep (see our PSD2 and SCA overview and EU Payments 101).
Why it carries weight: Visa can pull this confirmation as evidence under Condition 13.5, Misrepresentation. No confirmation on file, no defence.
The 7-day reminder is where most trials lose the dispute
The reminder is the single most-missed rule and the one that most often decides a friendly-fraud dispute. The windows are specific and they differ by scheme, so a trial that converts to paid runs through a fixed pre-billing sequence.
- Signup, day 0
Confirmation sent immediately
Enrolment confirmation goes out the moment they sign up, even for a $0 trial.
- 7+ days outVisa
Visa reminder due
At least 7 days before the first real charge or any change in price or frequency.
- 3 to 7 days outMastercard
Mastercard reminder due (digital)
For digital goods, 3 to 7 days before the trial ends, with terms and a cancel link.
- Trial ends
First charge and receipt
Bill the card and issue a receipt that carries the word “trial” in the descriptor.
For no-trial plans the trigger is billing cadence, not the calendar. Visa wants a reminder if more than six months have passed since the last charge, or if terms change. Mastercard requires one when billing runs less often than every 180 days, sent 7 to 30 days ahead. A short trial of seven days or less is a special case: Visa lets you fold the reminder details into the signup confirmation, because there is no room for a separate 7-day notice.
This is where the records pay off. When a customer claims they never authorised the charge, the confirmation and the reminder are the core of your representment package. Under Visa’s Compelling Evidence 3.0 framework, a documented prior relationship and clear notice are what flip a dispute, so the same logs that keep you compliant are the ones you upload to fight friendly fraud. Weak reminder logging is the quiet reason so many friendly-fraud disputes are lost before they are even worked.
A reminder you cannot prove you sent is a reminder you did not send. In a dispute, the log is the rule.
Receipts and statements carry the cancel path
After each charge the picture splits again. Visa does not mandate a receipt after every bill; it puts the weight on the signup confirmation and the reminder. Mastercard treats the per-charge electronic receipt as best practice for most merchants, but mandatory once your chargeback rate runs high, and each receipt must carry the terms, the amount, and the cancel instructions.
On the receipt and the statement themselves, list the trial length, the first and ongoing amounts and dates, and a cancel link. Visa adds a specific wording rule: put a word like “trial” or “free trial” on the first post-trial charge so the descriptor matches what the customer remembers agreeing to. Descriptor mismatch is one of the top drivers of “I never signed up for this” disputes.
Treat the billing descriptor as part of the product. The merchant name that lands on the customer’s statement should echo the brand on your checkout, not a parent company or a processor’s name they have never seen. A cardholder who cannot place a charge does not email you first. They call their bank, and that call becomes a chargeback the descriptor could have prevented.
One-click cancel is the rule now, not a courtesy
Both networks require online cancellation regardless of how the customer signed up, in person, by phone, or on the web. The bar is unsubscribe-from-an-email simple: a link or button, not a retention maze, not phone-only, not a form that takes a week to process. Put the cancel path in every confirmation, every reminder, every receipt, and on the account page.
This is also where consumer-protection law is converging with the card rules, from the US “click to cancel” direction to EU distance-selling rights, so building the easy path once satisfies several regimes at the same time. Test it yourself, end to end. A broken cancel flow manufactures the exact disputes the rest of the spec is designed to prevent.
Visa vs Mastercard, reconciled
You comply with both at once by building to the stricter of each requirement. This is the whole spec on one page.
| Requirement | Visa | Mastercard |
|---|---|---|
| On-page disclosure | Required, on the payment page | Required, on the payment page |
| Express opt-in consent | Separate and explicit | Separate and explicit |
| First auth flagged recurring | Required, even at $0 | Best practice |
| Signup confirmation | Trials and intro offers; on request otherwise; EU within 2 business days | All subscriptions, no exceptions |
| Pre-billing reminder | 7+ days before charge; if dormant over 6 months | 3 to 7 days (digital trial); 7 to 30 days if billed over 180 days |
| Per-charge receipt | Not mandated | Best practice; mandatory if chargebacks high |
| Online cancellation | Required | Required |
Source: Visa, Updated Policy for Subscription Merchants Offering Free Trials and Mastercard, Revised Standards for Subscription/Recurring Payments and Negative Option Billing.
At a glance
- Keep proof of every send
- At least 1 year
- Visa evidence basis
- Condition 13.5, Misrepresentation
- EU confirmation window (Visa)
- 2 business days
- Breach exposure
- Fines, monitoring, loss of card acceptance
- Negative-option billing
- A model where a customer’s silence or inaction counts as acceptance of an ongoing charge, most often a free or low-cost trial that auto-converts to paid. It is legal, but it is exactly the model both networks wrote these rules to police.
The Bottom Line
The merchants who lose recurring disputes rarely lose on fraud. They lose because they cannot produce the disclosure, the consent, the reminder, or the cancel record when the issuer asks. The scheme rules read like a compliance checklist, but they are really a specification for an evidence trail.
Build the checkout once to the stricter of Visa and Mastercard on every point and the compliance question answers itself, and so does most of your chargeback defence. The reminder is the highest-leverage line in the spec, so automate it and log it, because that is where most trials quietly leak revenue to disputes.
The penalty ladder is real and it compounds. A first miss draws a fine; a pattern draws mandatory monitoring; and once your chargeback ratio trips a program threshold you are running the account under a Visa or Mastercard monitoring regime, not just fixing an email template. The cheapest place to solve any of this is the checkout, before a single dispute is ever filed.
Start with your reminder logic and your cancel flow this week. They are the two rules most often broken, and the two most often decisive when a dispute actually lands.
Do these rules apply if my trial is free or $0?
Yes. Both networks apply the disclosure and confirmation rules even when the initial charge is $0, and Visa requires the first authorisation to be flagged as recurring regardless of the amount.
What if I only sell physical goods?
Mastercard’s initial confirmation has no physical-goods or high-risk exception. The tighter reminder windows are written for digital trials, but the disclosure, confirmation and cancellation rules still apply to physical goods.
How long do I keep the records?
Keep logs of every disclosure, confirmation and reminder for at least a year. Issuers can dispute on the basis that the customer was never told about ongoing charges, and the log is your defence.
Are Visa and Mastercard’s rules the same?
No. They overlap but differ on reminder windows, per-charge receipts and the EU two-business-day confirmation. Build to the stricter of the two on each point and you satisfy both.
- Visa, “Updated Policy for Subscription Merchants Offering Free Trials or Introductory Offers,” recurring-vbn-public.pdf.
- Visa, “Visa Core Rules and Visa Product and Service Rules,” visa-rules-public.pdf, 18 April 2026.
- Visa, “Subscription Policy,” subscription-policy-vbn-visa-public.pdf.
- Mastercard, “Revised Standards for Subscription/Recurring Payments and Negative Option Billing Merchants,” subscription bulletin (PDF), effective September 2022.
