To collect recurring payments legally in the United States, you need a clear written or electronically authenticated authorization from the customer before the first charge, and you need to follow the federal, network, and card-industry rules that govern every charge after that. The authorization is the foundation. Everything else, from how you store card data to when you notify a customer about a price change, sits on top of it.
Get the Authorization Right Before You Charge Anything
The Electronic Fund Transfer Act and its implementing Regulation E require that every preauthorized electronic fund transfer from a consumer’s account be authorized by a writing the consumer has signed or similarly authenticated.1eCFR. 12 CFR 1005.10 – Preauthorized Transfers “Similarly authenticated” covers electronic signatures, online checkboxes paired with disclosures, and recorded phone authorizations. You must also give the customer a copy of the authorization at the time they agree.
The authorization has to be clear and conspicuous. If a customer could reasonably misunderstand what they agreed to, you have a compliance problem regardless of what the fine print says. Regulation E specifically requires the consumer to understand the timing, amount, and nature of the charges. Vague language about “applicable fees” or “amounts subject to change” does not meet that standard.
A valid authorization form captures, at a minimum:
- The customer’s full legal name and contact information sufficient to verify the account holder.
- Payment credentials: bank account and routing number for ACH, or card number and expiration date for card billing.
- The exact dollar amount per cycle. If the amount varies, the form must describe the range or the calculation method.
- Frequency and timing: whether the charge is weekly, monthly, quarterly, or another interval, and the specific day the payment will be initiated.
- Start and end dates, or the conditions that trigger termination.
- How the customer can revoke the authorization.
For ACH debits, the authorization language should explicitly state that you are authorized to initiate electronic debits from the consumer’s account. Generic references to “payment” without specifying the ACH mechanism can create ambiguity during a dispute. For card-based billing, the authorization should reference recurring charges so the card network’s chargeback rules recognize it as an ongoing agreement rather than a one-time transaction.
Electronic signatures work for both, but the signing flow must present the authorization terms before the consumer clicks “agree.” Burying the language inside lengthy terms of service that the consumer scrolls past does not satisfy Regulation E’s clear-and-conspicuous requirement.1eCFR. 12 CFR 1005.10 – Preauthorized Transfers
Extra Rules When You Debit Bank Accounts Through ACH
If you pull payments through the ACH network, Nacha’s operating rules apply on top of federal law.2Nacha. How the ACH Rules Are Made Two obligations catch businesses out most often.
First, retention. Nacha requires you to keep the signed authorization for at least two years after it is terminated or revoked. That matters most when a customer disputes a charge months after canceling. If your processor or the customer’s bank asks you to prove the debit was authorized and you cannot produce the document, you lose the dispute automatically. Keep digital copies in a system with reliable backups, not buried in an email thread.
Second, the Standard Entry Class code. Recurring consumer debits initiated online typically use the WEB code; those authorized by phone use TEL. Submitting entries under the wrong code is a rules violation that can trigger fines from your bank or ACH operator even when the underlying authorization is perfectly valid.
Extra Rules When You Store Card Numbers
When you store credit or debit card numbers for recurring billing, the Payment Card Industry Data Security Standard applies. PCI DSS is not a federal law. It is a set of technical requirements enforced by the card networks through your merchant agreement, and any entity that stores, processes, or transmits cardholder data must comply.3PCI Security Standards Council. PCI Data Security Standard (PCI DSS)
The standard runs to twelve high-level requirements covering network security, access controls, encryption, and vulnerability testing. For most small businesses running recurring billing, the practical takeaway is simple: do not store raw card numbers on your own servers. Use your payment processor’s tokenization service, which replaces actual card data with a non-sensitive token. Tokenization shrinks your compliance scope dramatically and eliminates the most dangerous category of breach risk.
Non-compliance can lead to monthly fines from the card networks, and repeated or severe violations can cost you the ability to accept card payments at all. The fines are imposed through your acquiring bank under your merchant agreement, so the specific amounts vary by network and situation.
Send Notice Before You Change the Amount
One of the most commonly overlooked requirements kicks in when a recurring charge varies from the previously authorized amount or from the prior payment. Under Regulation E, you must send the consumer written notice of the new amount and the scheduled transfer date at least ten days before the charge hits their account.4Consumer Financial Protection Bureau. Regulation 1005.10 – Preauthorized Transfers
There is practical flexibility built into the rule. You can offer the consumer the option of receiving notice only when a charge falls outside a specified range, or differs from the most recent payment by more than an agreed-upon dollar amount. If a customer agrees in writing to a range of $45 to $55 per month, you only have to send the ten-day notice when a charge would fall outside that range. That avoids flooding subscribers with notices for minor fluctuations while still protecting them from surprises.
Skipping this notice is one of the most reliable ways to lose a chargeback or draw a regulatory complaint. The ten-day window is what lets the consumer review the charge and stop the payment before it processes if they disagree.
Respect the Customer’s Right to Stop a Payment
Customers have the legal right to stop any preauthorized recurring payment by notifying their financial institution at least three business days before the scheduled transfer date. They can do this orally or in writing, and you cannot override it.5Office of the Law Revision Counsel. 15 USC 1693e – Preauthorized Transfers The bank may ask the consumer to follow up with written confirmation within fourteen days of an oral request, but the initial oral notice is binding in the meantime.
That means a customer who has not canceled their agreement with you directly can still shut off the payment at the bank level. Your ACH debit comes back as a return, and you need a process for handling it. Continuing to submit debits after a consumer has revoked authorization through their bank is not just poor practice. It exposes you to unauthorized transfer claims under the EFTA and potential enforcement action.
Consumers also have sixty days from the date their financial institution sends a periodic statement to report an error or unauthorized transfer on that statement. Within that window the bank must investigate and, in most cases, provisionally credit the consumer’s account. A charge you thought was settled can be reversed weeks later, and clean authorization records are your primary defense.
Handle Failed Payments Within the Rules
Failed recurring payments are inevitable. Bank accounts close, cards expire, and balances run low. How you respond matters for both revenue recovery and compliance.
ACH returns come back with reason codes explaining why the debit failed. The most common are R01 (insufficient funds), R03 (account not found), R04 (invalid account number), and R08 (payment stopped). Your response should differ by code. An R01 is worth retrying. An R03 or R04 means the account information is wrong, and retrying accomplishes nothing except generating more return fees.
Nacha limits how many retries you get. For returns due to insufficient or uncollected funds, you may attempt the debit a maximum of two additional times. Each retry must be identified with “RETRY PYMT” in the entry description field so the consumer’s bank can distinguish it from a new charge. Exceeding the retry limit is a rules violation that can bring fines from your ACH operator and increased scrutiny of your transactions.
For card-based failures, most processors offer automatic retry logic and card updater services that pull new numbers when a customer’s card is reissued. These recover a meaningful share of failed charges without customer action. Emails or texts asking a customer to update their payment method recover more, and tone matters: a friendly reminder gets a response, while a message that reads like a collections notice gets ignored or prompts a cancellation.
What Non-Compliance Actually Costs
The EFTA’s civil liability provision lets an individual consumer recover between $100 and $1,000 in statutory damages without proving actual harm. In a class action, a court can award up to the lesser of $500,000 or one percent of your company’s net worth, plus attorney fees and actual damages.6Office of the Law Revision Counsel. 15 USC 1693m – Civil Liability A single defective authorization applied across thousands of subscribers is the kind of exposure that generates class complaints. Nacha rules violations produce fines through your bank; PCI failures produce fines through your acquirer and, in serious cases, loss of card acceptance.
A Note on the FTC “Click to Cancel” Rule
Separate from Regulation E, the FTC enforces a Negative Option Rule aimed at subscription-style models where a consumer receives goods unless they affirmatively decline. The FTC attempted to expand this rule in 2024 to require simple “click to cancel” mechanisms for all recurring charges, but the Eighth Circuit vacated that expansion. As of February 2026, the rule has been restored to its pre-2024 form.7Federal Register. Revision of the Negative Option Rule, Withdrawal of the CARS Rule, Removal of the Non-Compete Rule To Conform These Rules to Federal Court Decisions
The restored rule at 16 CFR Part 425 primarily targets “prenotification negative option plans,” the classic model where a seller sends a product on a schedule unless the buyer declines each shipment. Promotional materials must clearly disclose the subscriber’s right to cancel, any minimum purchase obligations, and the frequency of shipments, and the seller must give the subscriber at least ten days to decline each selection before it ships.8eCFR. 16 CFR Part 425 – Use of Prenotification Negative Option Plans If your business is standard recurring billing for a service rather than shipping physical goods on a negative-option basis, the current federal rule has limited direct application. Many states, however, have their own automatic renewal laws that impose disclosure and cancellation requirements on subscription services more broadly. Specifics vary by jurisdiction, and the common thread is disclosing renewal terms before the initial transaction and providing a reasonable way to cancel.
Keep Compliance a Habit, Not a Setup Project
The rules move. Nacha updates its operating rules annually, PCI DSS evolves as threats change, and state legislatures continue expanding automatic renewal protections. Audit your authorization forms and billing practices once a year at minimum. Confirm the authorization language still meets Regulation E, that your ACH entries carry the correct SEC codes, and that your retry logic stays inside Nacha’s limits. Verify that variable-amount notices actually go out at least ten days before the charge, not just in policy but in the real timing of your billing queue. Store authorization records where you can retrieve them quickly, and keep them for the full two-year post-termination window Nacha requires.