Can I store a customer's full card number?

Avoid storing full PAN unless your environment is fully PCI DSS compliant and you have a documented business need. Use gateway tokenization or truncated PANs to reduce scope and risk.

Is electronic consent valid for card-on-file authorization?

Yes. Electronic consent is enforceable under ESIGN and state UETA statutes when intent, consent, attribution, and retention are documented and the consumer receives required disclosures.

What should I do after a failed recurring charge?

Attempt reauthorization per your notification policy, inform the cardholder promptly, and update card data through a secure reauthentication workflow before retrying charges.

How do I handle cardholder revocation or cancellation?

Honor revocation requests in accordance with your authorization terms; stop future charges and securely delete or deactivate the token. Maintain audit evidence of the revocation event.

What are the minimum security controls required?

Use TLS 1.2+ in transit, AES-256 at rest, tokenization for stored card data, role-based access, and logging. PCI DSS requirements determine additional controls for merchants and service providers.

How long should I retain consent records?

Retain consent and audit records for at least the dispute and audit window—commonly three years—and longer where tax, HIPAA, or state rules apply.

Payment Card On File

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

Payment Card On File Authorization and Service Agreement

Parties

Client Name Service Provider Name

WHEREAS

WHEREAS, Client Name: (the "Client") seeks to engage Service Provider Name: (the "Provider") to perform services and to maintain a payment card on file to facilitate authorized charges; and

WHEREAS, the parties wish to set forth the terms and conditions governing payment collection, card storage, and authorization for charges to the card on file effective as of .

Scope of Work

Provider shall perform services for Client as described below. The parties acknowledge that this clause sets forth the primary duties and deliverables to which payment obligations attach.

Payment Terms

Client authorizes Provider to charge the payment card on file for fees and charges described in this Agreement. Fees due for services shall be as follows:

Contract Amount Payment Schedule / Billing Frequency

Late payments shall incur a late fee of calculated from the due date until payment is received in full. Client agrees that Provider may suspend services for overdue amounts upon providing the notice required under Term and Termination.

Payment Card Authorization

By completing and signing this Agreement, Client expressly authorizes Provider to retain the payment card information provided below and to charge that card for amounts due under this Agreement, including recurring charges, late fees, and any collection costs permitted by law, subject to the terms herein.

Cardholder Name Card Type (select one or more)

Visa Mastercard American Express Discover Other

Card Number (last 4 digits for reference)

Expiration (MM/YYYY):

CVV (optional):

Billing Address

Storage and Security: Provider will store card data in a secured manner consistent with payment industry standards. Provider is authorized to update stored card details and to replace the card on file with new card details provided by Client.

Authorization Scope: Client authorizes Provider to charge the card on file for: (a) pre-authorized recurring charges in accordance with the Payment Schedule; (b) one-time charges previously approved in writing by Client; and (c) any unpaid fees or damages permitted under this Agreement.

Term and Termination

This Agreement commences on Start Date: and continues until End Date: unless earlier terminated in accordance with this section.

Either party may terminate this Agreement for convenience upon providing written notice at least days prior to the intended termination date. Provider may suspend or terminate services immediately for nonpayment, material breach, or fraud involving the card on file.

Confidentiality

Each party agrees to keep confidential all non-public information disclosed in connection with this Agreement, including cardholder data, billing records, pricing and business information, and not to disclose such information except as required by law or to perform obligations hereunder. Confidential information does not include information that becomes publicly known without breach by the receiving party.

Governing Law

This Agreement shall be governed by and construed in accordance with the laws of the State of without regard to conflict of laws principles.

Entire Agreement

This Agreement, including any incorporated order forms or schedules, constitutes the entire agreement between the parties concerning the subject matter hereof and supersedes all prior and contemporaneous agreements, understandings and representations. Any amendment must be in writing and signed by both parties.

Acknowledgment and Consent

By signing below, Client confirms that the information provided is accurate and that Client authorizes Provider to charge the card on file in accordance with the terms of this Agreement. Client agrees to promptly notify Provider of any changes to card or billing information.

Client:

Service Provider:

By:

Date:

What a Payment Card On File Is and why it matters

A Payment Card On File is a written authorization or business record that documents a cardholder’s consent to have their payment card information retained by a merchant or service provider for future charges. It commonly captures cardholder name, card number (tokenized or truncated), expiration date, billing address, and scope of permitted uses. Properly documented cards-on-file support recurring billing, convenience payments, and dispute resolution while triggering obligations under PCI DSS, consumer privacy laws, and applicable electronic signature rules such as ESIGN and state UETA statutes.

When and why a Payment Card On File is useful

Keeping a card on file simplifies recurring billing, reduces failed payments, and provides a documented consent trail for disputes and audits.

Who typically completes and stores a Payment Card On File

Businesses and organizations that bill customers on a recurring or per-transaction basis collect and maintain card-on-file records.

Subscription providers and SaaS companies that bill monthly or annually and need automatic charge authorization.
Healthcare clinics and pharmacies that retain cards for copays, recurring services, or periodic billing.
Property managers and landlords who collect security deposits, recurring rent, or late fees using stored card data.

Internal billing teams, accounts receivable staff, and designated payment operations personnel should control storage, access, and deletion policies.

Core elements of a professional Payment Card On File record

A complete card-on-file record balances operational detail with compliance controls: capture exact authorizations, retention limits, and an auditable signature or consent event.

Card data

Tokenized card identifier or truncated PAN plus expiration month/year; avoid storing full PAN when tokenization is available.

Cardholder identity

Cardholder full legal name and billing address to support AVS checks and chargeback investigations.

Authorization scope

Describe permitted charges (recurring, specific amounts, or variable invoices) and any limits or notice requirements.

Consent record

Timestamped consent event with signer identity, method of consent (electronic, written), and any consumer disclosures provided.

Retention policy

Specify how long the card data will be retained and the process for secure deletion or tokenization at end of use.

Audit trail

Include an immutable log of collection, access, and charge events to support PCI and dispute resolution.

Required fields and security items to collect

Cardholder Name: Full legal name

Card Details: Token or truncated PAN

Expiry: MM/YY

Billing Address: Street, city, state ZIP

Authorization Type: Recurring or single-use

Consent Timestamp: ISO timestamp

Step-by-step: collecting and documenting a card-on-file authorization

Follow these steps to collect valid consent and minimize operational or compliance errors.

01

Prepare disclosure: Draft clear authorization language and retention policy for the cardholder to review.
02

Authenticate cardholder: Verify identity via email, SMS code, or account login before collecting card data.
03

Collect card data: Enter tokenized card details or last four digits; do not store full PAN unless PCI controls permit it.
04

Record consent: Capture a timestamped consent event with signer attribution and store an audit trail.

How to configure an online card-on-file workflow

Design your workflow to collect consent, secure card data, and trigger billing or notifications automatically.

Field	Configuration
Consent Language	Display required authorization text before collection
Authentication	Enable email or SMS OTP for signer verification
Tokenization	Integrate token vault to avoid storing PAN
Billing Trigger	Link stored card to scheduled invoice or webhook

Where the Payment Card On File record is sent and stored

Understand the typical destinations and custody of card-on-file data in a digital workflow.

Payment Gateway: Sends tokenized card data to the gateway vault
Merchant Vault: Stores only tokens and authorization metadata
Billing System: Pulls token for scheduled charges
Audit Logs: Records consent and charge events for compliance

Technical and platform considerations for eSubmission and storage

Choose technology that supports tokenization, audit trails, and strong access controls for stored card data.

Tokenization Support: Use platforms that vault card data via tokens
Encryption Standards: Require TLS 1.2+ and AES-256 at rest
Integrations: Ensure connectors to gateways, CRM, and ERP

Integrations with common systems (CRM, ERP, payment gateways) and audit logging reduce reconciliation work and support PCI and privacy audits.

Timelines, consent duration, and processing expectations

Set explicit timelines for authorization validity, renewal, and notification to align with billing cycles and consumer expectations.

Initial Authorization Effective Date:

Record date consent begins; use MM/DD/YYYY format

Renewal Notice Period:

Notify customers of renewal 15–30 days before renewal

Card Reauthorization:

Reauthorize when card is near expiry or after failed charge attempts

Breach Notification:

Follow state breach timelines (often 30–45 days)

Dispute Window:

Customers typically have 60–120 days to dispute charges

Common mistakes when preparing a Payment Card On File record

Failing to state the exact authorization scope, which leads to customer disputes when variable or unexpected charges appear.
Storing full PAN instead of a token or truncated PAN, increasing PCI scope and breach risk.
Neglecting to record the consent method and timestamp, making it difficult to demonstrate authorization during chargebacks.
Using vague renewal or cancellation language that does not meet consumer disclosure expectations under ESIGN and state privacy rules.

Key risks and regulatory consequences

PCI Noncompliance: Fines, remediation costs

State Privacy Violations: Civil penalties or statutory damages

Chargebacks: Financial loss and fees

Data Breach Costs: Notification and remediation

Reputational Harm: Loss of customer trust

Contractual Liability: Third-party indemnities

eSignature vendor pricing and capability snapshot for card-on-file workflows

Comparison of starting prices and feature availability across common eSignature vendors to inform platform selection for card-on-file processing.

	signNow	DocuSign	Adobe Sign	PandaDoc	HelloSign
Starting Price	$8/user/mo	$15/user/mo	$14/user/mo	$19/user/mo	$15/user/mo
Free Trial	7-day free trial (no CC)	Varies by vendor	Varies by vendor	Varies by vendor	Varies by vendor
Bulk Send	Yes	Yes	Yes	Yes	No
Audit Trail	Yes	Yes	Yes	Yes	Yes
HIPAA Compliant	Yes	Yes	Yes	No	No
Envelope Cap	No cap	100 envelopes/user/year	Varies	Varies	Varies

Frequently asked questions about Payment Card On File

Answers to common operational and legal questions when collecting, storing, and using payment cards on file.

Need help? Contact support

Can I store a customer's full card number?
Avoid storing full PAN unless your environment is fully PCI DSS compliant and you have a documented business need. Use gateway tokenization or truncated PANs to reduce scope and risk.
Is electronic consent valid for card-on-file authorization?
Yes. Electronic consent is enforceable under ESIGN and state UETA statutes when intent, consent, attribution, and retention are documented and the consumer receives required disclosures.
What should I do after a failed recurring charge?
Attempt reauthorization per your notification policy, inform the cardholder promptly, and update card data through a secure reauthentication workflow before retrying charges.
How do I handle cardholder revocation or cancellation?
Honor revocation requests in accordance with your authorization terms; stop future charges and securely delete or deactivate the token. Maintain audit evidence of the revocation event.
What are the minimum security controls required?
Use TLS 1.2+ in transit, AES-256 at rest, tokenization for stored card data, role-based access, and logging. PCI DSS requirements determine additional controls for merchants and service providers.
How long should I retain consent records?
Retain consent and audit records for at least the dispute and audit window—commonly three years—and longer where tax, HIPAA, or state rules apply.

be ready to get more

Join over 28 million airSlate SignNow users

Sign Now