Continuous Payment Authority: How It Works and the Rules

A customer signs up for a gym membership, or a software subscription or a service billed every month. They enter their card details once, and the business takes future payments without asking them to approve each charge. This is Continuous Payment Authority (CPA).

The Continuous Payment Authority is also called as recurring card payment is a customer’s permission for a business to collect payments from their debit or credit card repeatedly, on agreed terms, without asking each time.

The difference between continuous payment authority and direct debit is CPA takes money from a debit or credit card rather than directly from a bank account. Customers can cancel the authority through their card issuer, even if they haven’t contacted the business.

In this blog, you’ll understand what is a continuous payment authority, how it works, how they compare with other recurring payment methods and what UK businesses need to know before charging a customer’s card.

What Is a Continuous Payment Authority?

A continuous payment authority is permission given by a cardholder for a business to take payments from their debit or credit card more than once.

The FCA refers to these as recurring card payments. They’re commonly used for subscriptions, memberships and certain loan repayments.

For example, a customer might authorise a £30 monthly membership fee. The business can then collect that amount on the agreed date without asking the customer to complete checkout each month.

Some arrangements allow the payment amount or collection date to change. That doesn’t give the business unlimited permission to charge the card. The customer must have agreed to how those payments will work.

Under regulation 67 of the Payment Services Regulations 2017, consent can cover a series of payment transactions, and the payer has the right to withdraw that consent.

How Is a CPA Different From Card on File?

When a business saves customer’s card details, it doesn’t automatically mean the business has permission to charge it whenever it wants.

Card on file refers to securely storing payment credentials for future use. A CPA is the customer’s authorisation for the business to initiate payments under agreed terms.

Consider the below scenarios:

• A customer selects a saved card and clicks Pay when placing another order. The customer initiates that transaction.
• A business charges a customer’s saved card for a subscription renewal while the customer isn’t present. The business initiates that transaction.

The second situation is treated as a merchant-initiated transaction. This is where card on file payments require more than securely stored card details. The business must also have the customer’s permission to collect future payments without their involvement.

Continuous Payment Authority vs Direct Debit and Other Options

A CPA may look similar to variable recurring payments, Direct Debit and Standing Orders. But they all work differently. Have a look at their differences below:

	CPA (recurring card payment)	Direct Debit	Variable recurring payment (VRP)	Standing order
Paid from	Debit or credit card	Bank account	Bank account	Bank account
Who initiates payment?	Business, under agreed terms	Business, under a Direct Debit Instruction	Business, within agreed limits	Customer’s bank, following the customer’s instruction
Can the amount change?	Yes, if authorised	Yes, with the required advance notice	Yes, within consent limits	Only when the customer changes the instruction
How is it cancelled?	Through the business or card issuer	Through the bank	By withdrawing consent	Through the bank
Customer protection	Payment Services Regulations and applicable card dispute rules	Direct Debit Guarantee	Bank-led consent controls and applicable payment protections	Applicable bank payment protections

How to Cancel a Continuous Payment Authority

Customers can cancel a CPA by contacting the business collecting the payments or the bank or card issuer that issued their card. According to the FCA, a card issuer must stop recurring card payments when the customer asks, even if the business hasn’t been contacted.

The customer should request cancellation by the end of the business day before the next payment is due. If a payment is taken after a valid cancellation, it is unauthorised and the issuer must refund it immediately.

Continuous Payment Authority Rules for UK Businesses

Unclear payment terms can lead to disputes. The Financial Ombudsman Service handles complaints from customers who weren’t aware they’d agreed to recurring payments or didn’t understand the amount or frequency. This can happen when a free trial ends and paid subscriptions begin.

Along with FCA requirements, businesses must follow the card scheme rules, which are usually communicated through their payment provider or acquirer.

What Customers Must Be Told

When	What the business should do
Before sign-up	Explain that future card payments will be taken without separate approval, including the amount or calculation method and payment frequency.
In the agreement	Explain cancellation and refund terms, contact details, payment timing, any trial period and how changes will be communicated.
After sign-up	Provide confirmation of the recurring payment agreement within the applicable card scheme deadline.
Before changes	Give the required notice when a trial ends or the payment amount or date changes.
After a declined payment	Explain the missed payment and provide an opportunity to pay another way, subject to the applicable rules.
On cancellation	Stop future charges under the withdrawn authority and make cancellation reasonably accessible.

What Happens When a CPA Payment Fails?

A recurring payment can fail for several reasons. The customer’s card may have expired, their account may lack sufficient funds, or they may have cancelled the payment authority.

The reason matters because it determines a business’s next step.

1. Check Why the Payment Failed

Start with the response from the payment provider. An expired card, insufficient funds and a withdrawn payment authority shouldn’t all be handled in the same way. Where the customer has cancelled the CPA, the business must stop charging under that authority.

2. Contact the Customer

Let customer support or RM contact the customer, convey that the payment hasn’t gone through, identify the outstanding amount and provide a way to resolve it.

3. Offer Another Way to Pay

A failed CPA doesn’t necessarily mean the customer refuses to pay. They may be willing to settle the amount through a one-off payment link or a different payment method.

For businesses already billing customers, a payment link included in invoice payments can provide a straightforward way to collect the outstanding amount without setting up another recurring card charge.

4. Avoid Repeated Payment Attempts

Card schemes place restrictions on retrying declined transactions. The permitted approach depends on the reason for the decline and the rules applying to the transaction. Businesses should follow their acquirer’s guidance rather than automatically retrying every unsuccessful payment.

5. Keep a Record

Keep the original consent, payment terms, notices sent to the customer, declined transaction details and cancellation requests. These records help resolve disputes about whether a payment was authorised.

Managing Repeat Payments With Atoa

Atoa supports card on file payments for businesses that charge returning customers or collect payments at a later date.

Customers can save their card details during checkout, with verification using a one-time passcode and 3D Secure. The card credentials are stored as a token rather than exposing the full card details to the business.

For returning customers, this can reduce the need to enter card information again. When the appropriate authority has been obtained, businesses can also use saved payment credentials for repeat or on-demand charges. The consent, notification and cancellation requirements still apply when the business initiates recurring payments.

Businesses accepting payments online, over the phone and in person can also manage supported transactions through omnichannel payments.

Frequently Asked Questions

What Is a Continuous Payment Authority?

A continuous payment authority is permission for a business to take recurring payments from a customer’s debit or credit card without asking for approval each time.

Is a Continuous Payment Authority the Same as a Direct Debit?

No. A CPA charges a debit or credit card, while Direct Debit collects money from a bank account.

Can a Business Refuse to Cancel a CPA?

A business cannot override a customer’s withdrawal of payment consent. Customers can ask their card issuer to stop future CPA payments without contacting the business first. Any outstanding contractual debt is a separate matter.

Can a Business Keep Charging a Customer’s Card After a Decline?

A declined payment doesn’t always mean the authority has been cancelled, but retrying is subject to card scheme rules and the reason for the decline. If the customer has withdrawn consent, further charges under that authority must stop.

Do Businesses Need a CPA for Card on File Payments?

A CPA or another appropriate authorisation is needed when the business initiates future card payments without the customer taking part in each transaction. If the customer selects a saved card and approves each payment at checkout, that’s a different type of transaction.

Sources

• Financial Conduct Authority — Recurring card payments
• Payment Services Regulations 2017, including regulations 67 and 83
• FCA Handbook — CONC 7.6
• Visa Core Rules and Visa Product and Service Rules, 18 April 2026, Tables 5-20 to 5-22
• Financial Ombudsman Service — Continuous payment authorities
• Citizens Advice — Stopping a future payment on your debit or credit card
• Pay.UK — Direct Debit Guarantee
• Open Banking Limited — Variable recurring payments