How a customer-initiated transaction is identified
An authorisation request says how the card details were obtained and who started the payment. A payment keyed in at a checkout, a tap at a terminal and a one-click purchase with a saved card are all customer-initiated.
Mastercard's Transaction Processing Rules of 9 June 2026 require the acquirer to send a cardholder-initiated value when an e-commerce payment is also the moment the cardholder authorises the merchant to store the credential. That first payment is what later merchant-initiated payments refer back to.
In the Visa Core Rules of 18 April 2026, a merchant validates the cardholder's identity, for example with a login and password, before processing a cardholder-initiated transaction with a stored credential.
Why the distinction matters
In the EU, Article 97 of PSD2 requires strong customer authentication where the payer initiates an electronic payment transaction. A payment with a saved card, made by the cardholder in session, is still customer-initiated and needs authentication or an exemption.
The flag also has to be true. A payment whose indicators do not fit the facts risks being declined, so a gateway sets them case by case and not once per merchant.
CIT or MIT?
- Merchant-initiated transaction
- A payment the merchant starts under an earlier agreement, with the cardholder taking no active part: a subscription renewal, a delayed charge, a no-show fee.
- Card on file
- The stored card, not who starts the payment. A card-on-file payment can be either customer-initiated or merchant-initiated.
Where a customer-initiated transaction shows up in a platform
Modules that do the work
- CheckoutA hosted checkout for cards, wallets, bank payments and crypto, routed to the best provider.
- AuthenticationSign-in, passkeys and second factors for customers and staff, on your identity provider or ours.
- Card acquiringCard acceptance on the phone, in store and online, through the acquirer you choose.
Platforms that need it
Where it is written
The laws and standards this page's facts come from.
- Mastercard Transaction Processing Rules, 9 June 2026: 5.7 and Appendix C (Mastercard)
- Visa Core Rules and Visa Product and Service Rules, 18 April 2026: Table 5-22 (Visa)
- Directive (EU) 2015/2366, PSD2, Article 97 (EUR-Lex)
General information, not legal advice: what applies to you depends on your services and your market.