Card account updaters: how Visa Account Updater keeps stored cards current

What a card account updater does

Cards on file go out of date. A card expires, is lost and replaced, is upgraded to another product, or the account is closed. A merchant that bills a stored card on a schedule does not see any of that until a payment is declined. Visa’s FAQ puts a number on it: on average, 30 percent of the card accounts in an issuer’s Visa Account Updater portfolio have a change to the account number or expiry date, or are closed, every year.

An account updater is the card network’s answer. The issuer tells the network when a card changes; a participating merchant, through its acquirer, asks the network about the cards it holds and receives the changes. Visa calls its service Visa Account Updater (VAU) and describes it as enabling issuers, acquirers and qualified merchants to exchange updated account information for recurring payments, credential-on-file transactions, Visa Direct transactions and purchase returns.

Everything quoted here comes from Visa’s published rules, edition of 24 October 2026, and Visa’s public developer documentation for the service, all opened on 12 November 2026. The service’s full terms of use and implementation guide are not public: Visa’s pages point enrolled clients to them, and this guide has not read them.

What an update contains

Visa’s FAQ is specific about the limits: the service supports account number and expiry date changes and closed-account and contact-cardholder advices only. It does not provide a cardholder’s name or address.

Visa’s acquirer page adds that when a card has changed more than once, the records are linked, so an inquiry on any earlier number returns the newest details, and that acquirers receive updates for accounts changed during the past 730 calendar days.

What Visa’s rules require of issuers

The service is only as complete as the issuers behind it, and Visa’s rules make participation an obligation in most regions. In the US, section 8.6.1.1 requires an issuer to enrol all its BINs except Visa commercial card BINs, prepaid card BINs, BINs for ATM-only cards, BINs used for single-use virtual accounts and BINs licensed for use in US territories. Cards on those BINs sit outside the US enrolment requirement, so a stored commercial or prepaid card may produce no update.

An enrolled issuer must submit updates whenever a card is reissued or its status changes, and a change of account number or expiry date must be submitted within 2 business days of the new number being activated. If an issuer supplies inaccurate information it must remove it within 2 business days of being notified and provide corrected information within 5 business days.

Table 8-3 also sets the conditions for the closed-account, contact-cardholder and opt-out advices described above. In the 24 October 2026 edition those three rows carry a footnote giving an effective date of 25 July 2026 for thirteen countries in Visa’s Latin America and Caribbean region; this guide quotes the conditions as the table states them.

Which merchants can use it, and who decides

Visa’s FAQ says only merchants with credential-on-file business models may participate, giving recurring bill payment, subscription services and one-click checkouts as examples, subject to any restrictions in the service’s terms of use. A merchant enrols through its acquirer. For the inquiry-based service the acquirer submits an enrolment form for each merchant, is responsible for the merchant being eligible, and Visa reviews the form and gives the acquirer a decision. For Real Time VAU, Visa’s FAQ says individual merchant enrolment is not required; the acquirer activates the service itself.

Visa’s acquirer page states that certain categories of merchants are excluded from participation and refers to the terms of use for the list. That list is not in the public pages read for this guide, so this guide does not say which categories it names. One exclusion is public: for Real Time VAU, Visa’s FAQ lists merchant category codes 5962, 5966 and 5967 as prohibited. In Visa’s rules those codes are Direct Marketing – Travel-Related Arrangement Services, Direct Marketing – Outbound Telemarketing Merchant, and Adult Content and Services.

For a business in a high-risk category the practical point is that access is not automatic. Whether an account includes an updater, in which form, and for which card brands is decided by the provider and the networks, and it is worth asking before signing rather than after the first wave of expired cards.

Scroll the table to see all columns.

What a participating merchant has to do, and by when

• Ask only about cards where there is an ongoing customer relationship and the customer has authorized credential-on-file payments (Visa’s acquirer page).
• Ask often enough: merchants that bill monthly, quarterly or twice a year submit inquiries for all accounts at least once every 180 calendar days, and merchants that bill annually at least once every 365 calendar days (Visa’s acquirer page).
• Expect the answer through the acquirer: in the batch process the acquirer forwards responses to the merchant within two business days (Visa’s FAQ).
• Apply it: within five business days of receiving it from the acquirer, or within two business days of receipt from the service where an acquirer, processor or third-party agent provides the token vault (Visa’s FAQ).
• Use the new details from then on: Visa’s FAQ says all later authorizations should be submitted on the updated account information.

How it fits with Visa’s rules on declines and retries

An updater works before a payment is attempted. Visa’s rules on what a merchant may do after a decline still apply. Table 7-2 sorts decline codes into categories. After a category 1 code, which includes 46 (closed account), 14 (invalid account number) and the lost and stolen card codes 41 and 43, a merchant must never resubmit an authorization for the same payment credential. After code 54 (expired card), which is in category 3, a reattempt is permitted up to 20 attempts in 30 days.

Visa’s FAQ lists codes 14, 46, 54, 04, 07, 41, 43, 01 and 02 as the declines the service can help reduce. The reattempt rule is written for the same payment credential; how the two apply to a merchant’s own retry logic is a question to settle with its acquirer, not to guess at.

Where an update does not arrive and a merchant-initiated payment on a stored card is declined, table 5-21 requires the merchant to notify the cardholder in writing and allow at least 7 calendar days to pay by other means.

What an update does not change: consent and cancellation

Visa’s rules build the updater into the customer’s agreement rather than around it. Before a merchant stores a card for future payments it must obtain the cardholder’s express informed consent to an agreement that includes the account number to be used, last four digits only, as it may be updated from time to time, along with how the stored card will be used and the timing and amount of payments (table 5-19).

The same rules require a merchant to use a stored credential only as agreed with the cardholder (section 5.4.3.1) and, for recurring transactions, to provide a simple cancellation procedure, online if the order was first accepted online (table 5-20). Nothing in the pages read for this guide lets an updated card number revive a subscription the customer has cancelled.

US federal law sets its own conditions for online subscriptions. Under 15 U.S.C. 8403 it is unlawful to charge a consumer through a negative option feature in an internet transaction unless the seller clearly and conspicuously discloses all material terms before obtaining billing information, obtains the consumer’s express informed consent before charging, and provides simple mechanisms to stop recurring charges. This guide states what that section says; it does not say how it applies to any business.

Other card networks run their own services

Visa Account Updater is Visa’s own service: its pages describe updates for Visa accounts and for accounts converted to Visa from another card brand. Mastercard’s documentation describes its own account updater service, Automatic Billing Updater, as providing updated account numbers and expiry dates for stored cards, either on request or by subscription, to merchants and acquirers that are enrolled and registered with it. This guide does not cover its rules. A provider that offers an updater may cover one network, several, or pass the service through from its own acquirer.

What to ask a provider about account updating

• Is an account updater included with the account, for which card networks, and is my business category eligible for it?
• Which form is it: periodic inquiries, real-time updating at authorization, or a subscription that sends changes as they happen?
• Who holds the stored cards, my own system or the provider’s vault, and who applies the updates within Visa’s deadlines?
• What does it cost, and is it charged per inquiry, per update or per stored card? Visa’s acquirer page mentions monthly fees for subscribed cards; what a provider charges a merchant is set by the provider.
• What happens with closed-account and contact-cardholder responses: will my billing system stop charging those cards and prompt the customer?

Questions, answered