Receiving and managing recurring online payments

Recurring payments are an integral part of managing subscriptions of services and, in some cases, also of the merchants' supply process of goods shipped periodically to customers. Theoretically, the merchant could handle the same collection needs with a single charge for each payment occasion, but from a practical point of view, the risk of not finalising the collection would be very high and the process very burdensome for the buyer as well.

A recurring payment means a payment repeated periodically, usually monthly, after an agreement between merchant and buyer, like for example, in the case of subscription-based services (e.g. pay TV, streaming platforms, telephone operators, publishing, etc.). The process of this collection formula involves a number of steps:

• Agreement between the parties
  In this pre-collection phase, the buyer or user authorises the merchant to make recurring debits by means of a mandate, agreeing on the amount of the individual payments, the frequency, the end date (if applicable) and the payment method (card, direct debit or other method).
• Setting up debits
  Via the platform of the PSP (Payment Service Provider), the debit series is set up according to the chosen payment method.
• Recurring debits
  Charges, which may cover a predefined period of time or an indefinite period, are sent automatically according to what was agreed between the parties.

As mentioned above, there are several recurring debit methods, the most common being credit card or SDD (SEPA Direct Debit), also called direct debit.

In both cases, there are more than one advantage for merchant and buyer. In fact, they:

• allow you to schedule payments with a predetermined recurrence;
• do not require the presence of the payer and consent for each debit;
• execution is automatic and there is no risk of incorrect entry of buyer data (e.g. card number or beneficiary's bank details).

However, there are also some weaknesses to this form of collection:

• the payment is deferred, i.e. without the presence of the payer at the time of the debit, therefore not guaranteeing sufficient funds on the payment method (card or current account) at that time;
• the buyer may not remember having given the merchant a mandate, resulting in the debit being cancelled;
• in the event that the payment method is no longer valid (e.g. in the case of a blocked card or a closed current account), the payer needs to remember to communicate in due time the details of an alternative payment method on which to debit.

Also we need to take into account the different procedures for revoking payments and rejecting charges depending on the method used. In the case of SDDs, for example, the regulations grant re-credit requests of buyer’s debits even after very long periods of time, whereas in the case of cards, the procedures are similar to those for single payment disputes.

Type of recurring payments: by card or SDD

Recurring payments by card and SDD are very similar, however there are some substantial differences that may make one or the other solution more appropriate to someone's needs. Let’s look together at the main features of the two recurring debit systems, with a focus on information of interest to merchants.

Recurring card payments

Recurring card payments are to all intents and purposes card payments made without the presence of the cardholder at the time of the debit. Therefore the merchant must request the card data in the authorization phase to proceed with automatic debits and set up recurring payments.

The merchant may save the card data on their own servers, complying with the requirements of particularly onerous PCI DSS certifications for the protection of card security data, or they have the opportunity to request the activation of tokenization services from their PSP.

The tokenization service involves saving the card data on the PSP's servers, if certified as required by security standards, and matching the data with a numeric or alphanumeric token that can alternatively be used by the merchant. Once the payment request has been received, the PSP will translate the token into the corresponding card data and send the authorization request to the issuer.

The integration of a tokenization service, whether developed by the PSP or by the major circuits such as Visa and MasterCard, is essential in order to easily and cost-effectively manage recurring payments of an Ecommerce. Moreover, recurring payments fall under the Strong Customer Authentication (SCA) exemptions, so they do not require the two-factor authentication introduced by PSD2 for online payments.

MasterCard has recently provided a number of specific guidelines for recurring payments on its cards, which we have summarised in a dedicated section of the technical documentation.

SDD Direct Debit payments

On 1 February 2014, SDD payments replaced a similar service called RID (Direct Interbank Direct Debit), extending the possibility of requesting direct debits to the entire SEPA area thanks to a set of standard rules for this type of payment.

There are two SDD collection schemes:

• SDD CORE
  type of SEPA Direct Debit that can be used for both consumers and businesses.
• SDD B2B
  this is the form of SDD for companies and small businesses

SDD payments can be associated with bank accounts or cards with IBAN, however it is good to know that not all cards accept this type of debit; therefore, it is important for the buyer to check with their bank. SDD payments also differ from credit card payments in terms of when and how debits or individual mandates can be cancelled.

Typically, internet banking services offer bank customers the possibility to view the list of mandates on their current account and to remove them if they deem it necessary. It should be noted that, for CORE SDDs only, this option is supplemented by the possibility for the debtor to request a refund within 8 weeks of the debit and up to 13 months in the case of an invalid or unauthorised mandate. Thus, the SDD B2B scheme offers more guarantees for the merchant but, as mentioned, can only be applied in the case of debtors that are not consumers, such as businesses.