Charge the stored payment method when you need to
Your system decides when and how much, and charges the stored payment method as a merchant-initiated transaction.
Your answers so far
Choose one
What to build
Create the transaction with the stored payment method's token, initiationType set to MerchantInitiated, a mitReason, and the owning customer's id. The platform finds the customer's active consent for that reason itself, so don't look up or send a consent id. Use UnscheduledCOF for a charge with no fixed schedule.
What this means for PCI
This is guidance rather than a compliance determination. Which questionnaire you are eligible for depends on your full environment, so confirm it with your QSA or your acquirer before you rely on it.
Worth knowing
- A charge the customer isn't present for needs a stored-credential consent that permits it, captured when the card is stored on a hosted payment page or in the Virtual Terminal. The direct API can't record consent, and a later charge can't add a usage the customer didn't agree to, so ask for every usage you expect to need when the card is stored.
- A merchant-initiated charge without the customer's id is refused before any consent is checked, and one with no matching consent is declined with stored_credential_consent_required.
- Your system owns the retry policy here. Follow the platform's decline classification: retry only funding and availability declines, spaced by days, and stop on anything else.