Priority Technology Closed 1,200 Merchant Accounts Over One Mastercard Rule. It Was Never a Law.

Every SaaS compliance conversation about cancellation flows starts in the same place: the FTC's Negative Option Rule, California's CARL, maybe a state click-to-cancel law if you've got subscribers there. Those are real, and they're enforced through lawsuits, settlements, and regulatory consent orders. What almost never comes up in that conversation is that Visa and Mastercard wrote their own, separate rules for exactly the same behavior more than a decade ago — and they don't need a court to act on them. They need your acquiring bank to flag your account.

No judge ordered those 1,200 closures. No class action forced them. An acquirer looked at its negative-option merchant portfolio, found accounts that didn't match what Mastercard's rules require, and shut them down to protect its own standing with the network. That's the entire enforcement mechanism in one sentence: your acquirer has more to lose from the network than you do, so it polices you before the network has to police it.

What "negative option billing" actually means to a card network

Both networks use the same core definition: any transaction where a customer's card keeps getting charged unless they take an affirmative step to stop it. That covers a free trial that rolls into a paid plan, a discounted intro period that steps up to full price, and plain month-to-month auto-renewal — which means it covers nearly every SaaS billing model that offers any kind of trial or promotional period. If you've ever set a Stripe subscription to convert automatically from a trial to a paid price, you're running a negative option model under both networks' definitions, whether or not anyone on your team has ever used that term.

The networks care because negative option transactions generate a specific kind of complaint: "I didn't know I'd be charged." That complaint shows up as a chargeback, and chargebacks are the one thing a card network's entire reputation is built on minimizing. Mastercard and Visa aren't protecting your customers out of goodwill — they're protecting their own dispute rates, and the rules read that way once you know what to look for.

What Mastercard specifically requires

Mastercard's current standards, which tightened substantially in a September 22, 2022 update, apply to subscription and recurring-payment merchants generally, with an extra layer for negative option specifically:

• Point-of-payment disclosure. The basic subscription terms have to be shown and acknowledged at checkout, not buried in a terms-of-service link.
• Enrollment confirmation. An email or electronic confirmation covering the plan terms, any trial terms, and how to cancel — sent at signup, not at first charge.
• A reminder before every charge on a long billing cycle. For plans billed less often than every 180 days, Mastercard requires notice 7 to 30 days before the charge, including the amount and how to cancel.
• A separate reminder before a trial converts. If a free or discounted trial is about to roll into a paid charge, the cardholder gets a reminder 3 to 7 days before that happens — a tighter window than the general billing reminder, because this is the moment Mastercard's own data says produces the most disputes.
• A cancellation-capable receipt on every charge. Each billing cycle's receipt has to include cancellation instructions, not just the amount charged.
• Registration for negative-option merchants specifically. Mastercard assigns these merchants to MCC 5968 and requires acquirers to register them through its Merchant Registration Program, which is exactly the list an acquirer audits when it's deciding which accounts to review for compliance.

What Visa specifically requires

Visa's rules, dating back to 2011 and substantially updated in 2020, cover similar ground with a different emphasis — Visa leans harder on disclosure language and statement descriptors than on a fixed notice-window number:

• Written disclosure and signed acknowledgment that the cardholder will be charged once a trial ends, including the exact trial length, the first charge date and amount, and the ongoing billing schedule.
• A reminder before the trial ends, by email or SMS, stating the date the charge will hit.
• A statement descriptor that changes meaning over time. Charges during the trial period must carry a descriptor referencing "free trial" or "trial period." Once the subscriber is actually paying, the descriptor has to switch to language like "subscription," "recurring," or "ongoing payment" — so a cardholder scanning their statement can tell which phase they're in without opening an email.
• Cancellation that behaves like unsubscribing from a mailing list. Visa's own language: easy to find, usable digitally even if the customer originally signed up in person, and reachable from every billing email or text.
• Two dispute reason codes built around this exact failure mode. Code 13.5 (misrepresentation) applies when a cardholder wasn't properly told that billing would continue past a trial. Code 13.2 applies if you failed to honor a cancellation request. Visa's own guidance on what counts as a valid defense against 13.5 names a specific number: notice sent at least 7 days before the trial's completion is treated as compelling evidence the customer was adequately warned.

That last detail is worth sitting with. Visa doesn't flatly mandate "7 days" as a rule the way Mastercard does — it defines 7 days as the threshold that wins you the dispute if a customer tries to claim they didn't know. Fall short of it, and you're not violating a numbered rule, you're just going into every resulting dispute with a weaker hand.

Notice the gap between 7 and 30. A lot of SaaS teams build one reminder cadence and apply it everywhere — say, a single email sent 3 days before any charge. That satisfies Mastercard's trial-conversion window on a technicality but misses its long-cycle billing reminder entirely if you bill annually, since 3 days is nowhere close to the required 7-to-30-day range for a cycle that long. The two Mastercard windows aren't interchangeable, and treating them as one setting is the most common way teams end up non-compliant without ever intending to be.

Why this is a different animal from FTC and state-law compliance

We've covered the government side of this before — the FTC's Negative Option Rule and its 2025 vacatur, and the private contractual notice windows that show up in B2B auto-renewal clauses. Those operate on legal timelines: rulemaking comment periods, court rulings, state attorneys general deciding whether to open an investigation. A government enforcement action against a SaaS company can take months or years to produce a consequence.

Card network enforcement runs on a completely different clock, because it doesn't route through a legal system at all. Visa's own description of how it monitors this is blunt: ongoing surveillance of recurring-transaction indicators and statement descriptors, mystery shopping of actual signup and cancellation flows, and dispute-rate monitoring that flags merchants automatically once their negative-option complaints cross a threshold. Mastercard's registration requirement means your acquirer already knows you're running a negative-option model before you ever get flagged — there's no discovery phase, because you're on a list from day one.

The practical difference: a government rule change gives you a runway. A network rule violation can produce a monitoring letter from your acquirer within a billing cycle or two of your dispute rate crossing a line, and acquirers that don't act on it fast enough risk their own standing with the network. Priority Technology didn't close 1,200 accounts because a law passed. It closed them because sitting on non-compliant negative-option merchants put its own relationship with Mastercard at risk, and an acquirer protecting itself moves a lot faster than a regulator building a case.

Where this overlaps with chargebacks you're already fighting

If your dunning and dispute-response process already tracks chargeback reason codes, 13.5 and 13.2 should already be on your radar — they're not exotic, they're two of the more common reasons a SaaS subscription gets disputed. What's easy to miss is that a cluster of 13.5 disputes isn't just lost revenue on each individual case. It's also the exact signal an acquirer uses to decide whether your trial-conversion flow needs a closer look. We've written separately about how a bad statement descriptor drives disputes on its own — Visa's requirement that the descriptor itself change language between the trial and paid phases is a second, related failure point worth checking alongside it, since a descriptor that never updates is an easy thing for a mystery-shopping review to catch.

None of this requires new infrastructure if you're already running Stripe Billing. Trial-end reminder emails, cancellation-capable receipts, and descriptor changes between trial and paid states are all configuration, not new engineering — the gap is almost always that nobody checked the specific day counts against what Mastercard and Visa actually require, because the compliance conversation stopped at the FTC and never got to the networks.

The upside of getting this right has nothing to do with avoiding a fine, because there usually isn't one in the traditional sense — there's a merchant account. Losing payment processing because an acquirer decided your negative-option flow was a liability is a far worse outcome than any individual chargeback, and it's the kind of catastrophic, overnight churn event that a standard retention offer can't fix because there's no subscriber left to offer it to. If you want to see what an account-level shock like that would actually do to your numbers, our churn calculator is a fast way to model it before you find out the hard way — and a cancellation flow that already gives subscribers an easy, in-product way to leave is most of what both networks are actually asking for in the first place.

Frequently asked questions

Stop losing subscribers today

One script tag. One function call. A live cancellation flow in under 10 minutes.