How a merchant-initiated transaction works
The series starts with a cardholder-initiated transaction: the buyer is in the checkout, agrees to future charges and is authenticated. The merchant stores the card details, or a token, with the scheme's reference to that first transaction.
Each later charge is flagged as merchant-initiated and carries that reference, so the issuer can link it to the agreement. Mastercard's Transaction Processing Rules of 9 June 2026 define an MIT as a card-not-present transaction that a merchant initiates based on a prior agreement with the cardholder, and in which the cardholder does not actively participate (5.7).
Kinds of merchant-initiated transaction
- Recurring payments: a subscription charged at regular intervals
- Instalments: one purchase paid in several parts
- Unscheduled card-on-file payments: a top-up when a balance runs low
- Delayed or related charges added after the original purchase
- No-show fees under a reservation policy
- Resubmissions after a decline that allows a retry
Merchant-initiated transactions and strong customer authentication
In the EU, PSD2 requires strong customer authentication where the payer initiates an electronic payment (Article 97). A European Commission answer published by the EBA on 1 March 2019 states that payments initiated by the payee only are not subject to the requirement, while giving the mandate through a remote channel is (Q&A 2018_4031).
Mastercard's Europe Region rules require SCA to set up each MIT mandate. Under the Visa Core Rules of 18 April 2026, a merchant whose MIT with a stored credential is declined notifies the cardholder in writing and allows at least 7 calendar days to pay by other means (5.8.11.1).
MIT, CIT or direct debit?
- Cardholder-initiated transaction
- The cardholder is in the checkout and can be authenticated, even where a stored card is used, as in a one-click payment.
- Direct debit
- Also started by the payee, but pulled from a bank account under a mandate, with refund rights of its own.
Where a merchant-initiated transaction shows up in a platform
Modules that do the work
- CheckoutA hosted checkout for cards, wallets, bank payments and crypto, routed to the best provider.
- Card acquiringCard acceptance on the phone, in store and online, through the acquirer you choose.
- AuthenticationSign-in, passkeys and second factors for customers and staff, on your identity provider or ours.
- NotificationsEmail, SMS, push and in-app messages in your brand, through the providers you choose.
Platforms that need it
Where it is written
The laws and standards this page's facts come from.
- Directive (EU) 2015/2366, PSD2, Article 97 (EUR-Lex)
- EBA Single Rulebook Q&A 2018_4031, final answer published on 1 March 2019
- Mastercard Transaction Processing Rules, 9 June 2026: 5.7, with the Europe Region section (Mastercard)
- Visa Core Rules and Visa Product and Service Rules, 18 April 2026: 5.8.11.1 and the glossary (Visa)
General information, not legal advice: what applies to you depends on your services and your market.