Recurring card payments in South Africa: how they work

Recurring card payments in South Africa work by saving the customer's card as a token at your payment gateway during a first payment (which usually needs 3-D Secure approval from the cardholder), and then charging that token automatically on each renewal date without the customer having to be present. Your business never stores the card number itself; the gateway holds it and gives you a reference to charge.

This guide explains the flow, the local rules that shape it, what goes wrong and how to set it up well.

How recurring card payments in South Africa work, step by step

1. The first payment (customer-initiated)

The customer enters their card details on the gateway's payment page or secure fields during sign-up or checkout. For online (card-not-present) transactions, the South African card industry, through the Payments Association of South Africa (PASA), requires 3-D Secure. In practice, the customer approves the payment in their banking app, by one-time PIN or with another method their bank uses.

2. Tokenisation

When the first payment succeeds and the customer has agreed to future charges, the gateway stores the card and returns a token: a reference that only your merchant account at that gateway can use. You store the token against the customer in your billing system. The card number stays with the gateway.

3. Renewals (merchant-initiated)

On each renewal date, your billing system asks the gateway to charge the token for the amount due. These charges are made without the customer present, so they generally do not repeat the 3-D Secure step. How recurring and stored-card transactions are treated for 3-D Secure depends on your gateway and acquiring bank, so confirm the rules for your merchant account before you launch.

4. Result and follow-up

The gateway returns success or failure. Success means a receipt and a paid invoice. Failure starts your retry and notification process.

Two ways to run recurring card billing

Many businesses start with gateway-managed subscriptions and move to token-based billing when their pricing becomes more complex.

What customers must agree to

Recurring card billing depends on the customer's clear consent. At sign-up, make sure they see and agree to:

• The amount (or how it is calculated) and currency
• How often they will be charged, and the first charge date
• Any trial period and what happens when it ends
• How to cancel, and any notice period
• That their card will be stored securely by your payment provider

Keep a record of that agreement. It is your best defence if a charge is later disputed. Card schemes and acquirers have their own rules for stored-credential transactions, and your gateway will tell you what it requires.

Why recurring card payments fail

• Expired or replaced cards. Cards are reissued when they expire, are lost or are compromised. A token linked to the old card may stop working.
• Insufficient funds or limits. Especially for larger or annual charges, and on dates before payday.
• Issuer declines. The customer's bank may block a charge for fraud screening or other reasons.
• Cancelled authorisation. The customer has asked their bank to stop the payments.

The first three are often temporary. A structured retry schedule with clear emails recovers many of them; see dunning management for failed payments. Our guide to card declined reasons explains which declines are worth retrying.

Security and PCI DSS

Using a gateway's hosted payment page or secure fields and storing only tokens keeps card data out of your systems, which greatly reduces your PCI DSS scope. As of September 2026 the current standard is PCI DSS v4.0.1. Even with a hosted page you still have compliance responsibilities, usually a self-assessment questionnaire. Your gateway and acquiring bank will tell you which one applies. See the PCI Security Standards Council for the standard itself.

Practical rules:

• Never ask customers to email or phone in card numbers.
• Never log full card numbers, even temporarily.
• Protect your gateway credentials: encrypt them, restrict who can see them and rotate them if staff with access leave.
• Verify every payment notification (webhook) from the gateway before marking an invoice paid.

Card vs debit order for recurring payments

Cards are not the only recurring option in South Africa. Debit orders remain very common.

Offering both widens your market. Compare them in more depth in EFT vs debit order vs card payments.

A worked example

A customer signs up on 5 May for a R399.00 monthly plan (VAT inclusive) with a 14-day trial.

• 5 May: the gateway runs a card verification or small authorisation with 3-D Secure and returns a token. No charge for the plan yet.
• 19 May: your system charges R399.00 to the token. Success: tax invoice and receipt issued, with R52.04 VAT (R399.00 × 15/115).
• 19 June: renewal fails with insufficient funds. The customer gets an email with a link to update their card or pay now. Retry scheduled for 22 June.
• 22 June: retry succeeds; receipt sent and dunning stops.

Whether a trial sign-up uses a zero-value verification or a small authorisation depends on your gateway.

Choosing a gateway for recurring card billing

Ask each provider:

1. Do you support tokenisation for merchant-initiated recurring charges on my account type?
2. How are 3-D Secure and stored-card transactions handled for recurring payments?
3. What happens to tokens when a customer's card is reissued?
4. Are there extra fees for recurring or tokenised transactions? Check the current pricing page.
5. Can I export or migrate tokens if I change providers?
6. How are payment results delivered to my system (webhooks, return URLs)?

How CentraPoint helps

CentraPoint connects to the gateways you contract with, including PayFast, Paystack, Peach Payments, PayGate and Yoco, and runs subscription renewals by saved card or gateway token, with automatic dunning retries and past-due handling. It also supports gateway-managed subscriptions via PayFast if you prefer that model. Inbound gateway webhooks are signature-checked and then re-verified server-side before an invoice is marked paid, and gateway credentials are encrypted at rest with AES-256-GCM. Debit orders and invoice collection run alongside cards for customers who prefer them. See the gateways page for supported providers.

Frequently asked questions

Do recurring card payments need 3-D Secure every month in South Africa?

Generally no. 3-D Secure is applied when the customer sets up the card on the first online payment, and later merchant-initiated renewals against the stored token usually do not repeat it. The exact rules depend on your gateway and acquiring bank.

Is it safe to store customer card details for subscriptions?

Your business should not store card numbers at all. The gateway stores the card and gives you a token, which keeps card data out of your systems and reduces your PCI DSS scope.

What happens when a customer's card expires?

The saved token may stop working and renewals will fail. Send the customer a link to add a new card, and use retries for temporary failures.

Are debit orders better than recurring card payments?

Neither is better in every case. Cards give instant results and easy amount changes, while debit orders reach customers without cards and are familiar for monthly services. Many businesses offer both.