Recurring dues: the processor features and the cancellation law

What does a monthly membership fee require?

Three functions, and two of them are legal duties rather than product features. The system has to capture the member's agreement to a stated price and interval before any money moves, hold a credential it can charge again without asking, and stop charging on request without a conversation. Everything else in a billing stack is convenience.

The federal statute behind that is the Restore Online Shoppers' Confidence Act. For a charge sold through what the law calls a negative option feature, where a member's silence counts as agreement to the next charge, the seller has to disclose all material terms clearly and conspicuously before taking billing information, obtain the consumer's express informed consent, and provide a simple mechanism to stop the recurring charge 1Ref 1United States Congress (Restore Online Shoppers' Confidence Act) (2010).15 U.S. Code § 8403 — Negative option marketing on the Internet.The three federal baseline duties for a membership charge sold online: clear and conspicuous disclosure of material terms before billing information is taken, express informed consent, and a simple mechanism to stop the recurring charge, together with the statute's own limit to a transaction effected on the Internet.. Check the scope before assuming it reaches you: the statute's own text covers a transaction effected on the Internet, so a membership signed on paper in your waiting room sits outside it. Your state's automatic-renewal law may not.

A membership fee is a different instrument from the rest of what you charge. It attaches to a calendar, which is why it sits outside your fee schedule and behaves nothing like what you collect for late cancellations. The software that runs it is a subscription biller, and many practice management systems are not one.

Card on file or bank draft?

Both work, and they carry different paperwork. Regulation E's written-authorization rule governs preauthorized transfers from a consumer's account, so it reaches a bank draft and leaves a credit card alone. A recurring debit pulled from a member's checking account may be authorized only by a writing signed or similarly authenticated by the consumer, and a copy has to go back to them 2Ref 2Consumer Financial Protection Bureau (2011).§ 1005.10 Preauthorized transfers..The bank-side mechanics of a recurring ACH debit: a preauthorized transfer from a consumer's account may be authorized only by a writing signed or similarly authenticated by the consumer, with a copy given to them, and the member may order their own institution to stop a scheduled transfer at least three business days ahead, with written confirmation demandable within fourteen days of an oral order.. A debit card draws on that same account, and the rule's commentary tells a payee who discovers one behind a charge to get that written authorization or stop debiting.

Signed or similarly authenticated covers an electronic signature flow, so the work is delivery: the copy is something you owe the member, and the enrollment flow has to send it and keep what it sent. Card storage sits under the card networks' own industry standard rather than a statute, and the convention that follows is to let the processor hold the number and keep only a token.

But a member on bank draft can stop a payment without telling you. Regulation E lets the member order their own institution to stop a scheduled transfer at least three business days before it is due, and the institution may require written confirmation within fourteen days of an oral order or the order lapses 2Ref 2Consumer Financial Protection Bureau (2011).§ 1005.10 Preauthorized transfers..The bank-side mechanics of a recurring ACH debit: a preauthorized transfer from a consumer's account may be authorized only by a writing signed or similarly authenticated by the consumer, with a copy given to them, and the member may order their own institution to stop a scheduled transfer at least three business days ahead, with written confirmation demandable within fourteen days of an oral order.. The first you hear of it is a debit that does not arrive.

Cards fail on their own schedule instead: one expires or gets reissued, the charge declines, and neither of you finds out until the money is late.

Is the click-to-cancel rule in force?

No. The Federal Trade Commission's 2024 amendment to the negative-option rule, the one the trade press called click to cancel, was vacated in its entirety by the Eighth Circuit on July 8, 2025, on procedural grounds, six days before its own already-deferred compliance date of July 14 3Ref 3United States Court of Appeals for the Eighth Circuit (per curiam; Loken, Erickson, Kobes, JJ.) (2025).Custom Communications, Inc. v. Federal Trade Commission, Nos. 24-3137, 24-3388, 24-3415, 24-3442, 24-3469 (consolidated).The legal-status fact that the FTC's 2024 amended negative-option rule was vacated in its entirety by the Eighth Circuit on July 8, 2025 on procedural grounds, six days before its already-deferred compliance date, cited only as struck-down history.. It never became a live obligation, and a billing flow built to satisfy it was built to a rule that was struck down.

What remains in the Code of Federal Regulations is the original 1973 negative-option rule, written for the mail-based prenotification plans of the book-club era. It gives a subscriber a fixed window, at least ten days, to mail back a form declining the next shipment 4Ref 4Federal Trade Commission (1973).16 CFR § 425.1 — Use of prenotification negative option plans.That the negative-option text still on the books is the narrow 1973 prenotification rule for mail-based plans, giving a subscriber at least ten days to mail back a form and saying nothing about a digital sign-up or cancellation flow.. It says nothing about a sign-up screen, a stored card, or a cancel button.

But the statute underneath the rule was never touched.

ROSCA is an act of Congress, and vacating an agency's implementing rule does not repeal it. The disclosure, consent and simple-cancellation duties above are still federal law for anything sold online 1Ref 1United States Congress (Restore Online Shoppers' Confidence Act) (2010).15 U.S. Code § 8403 — Negative option marketing on the Internet.The three federal baseline duties for a membership charge sold online: clear and conspicuous disclosure of material terms before billing information is taken, express informed consent, and a simple mechanism to stop the recurring charge, together with the statute's own limit to a transaction effected on the Internet.. What the vacatur removed was a set of prescribed mechanics, which leaves you designing the flow and defending the design. Check the Commission's current rulemaking status before relying on this section, which describes the federal picture as of this update.

Which state's automatic-renewal law reaches your membership

The state where the patient lives, and its terms are not the federal ones. Automatic-renewal statutes set their own notice windows, their own cancellation channels and their own thresholds for which contracts they cover, and two states show how far apart those can sit, while a third regulates the fee itself. Read your own state's version before writing the sign-up screen, because the screen is where most of these requirements land.

Washington's row is a different kind of statute. Its direct practice law is written for primary care practices that charge a direct fee, and it reaches the product: the fee has to be charged on a monthly basis and cover all the primary care services named in the direct agreement, and an increase for an existing patient is capped at one a year with 60 days of advance notice 7Ref 7Washington State Legislature (2007).Chapter 48.150 RCW: Direct Patient-Provider Primary Health Care -- RCW 48.150.030, Direct fee..Washington's direct practice statute as one state's example of a monthly membership fee regulated directly: the direct fee is charged monthly and covers the primary care services in the direct agreement, and an increase for an existing patient is capped at once a year with 60 days of advance notice, with no dollar cap set by the state.. The state sets no dollar cap on the fee and fixes what the fee has to buy.

One state's automatic-renewal terms are never the national rule. For a state not in that table the lookup is short: your state's code, the phrase automatic renewal or continuous service offer, and the consumer-protection title. Read the coverage and exemption sections first, because that is where a healthcare membership either lands inside the statute or falls outside it. That reading is a question for counsel in the state where you practice.

The cancellation flow to build

Build it so a member can end the membership in the channel they used to start it, in one step, without reaching a person. New York states it directly: the cancellation mechanism has to be as easy to use as the one the consumer used to give consent 6Ref 6New York State Legislature (2024).§ 527-a. Unlawful practices.New York's threshold and notice window for an automatic-renewal contract with an initial paid term of a year or longer renewing for six months or longer, and its requirement that the cancellation mechanism be as easy to use as the one the consumer used to give consent.. California requires that a membership signed up for online be cancellable online, at will 5Ref 5California State Legislature (2026).Business and Professions Code § 17602.California's disclosure, consent and cancellation mechanics for an automatic-renewal or continuous-service membership sold to a California consumer, including the 15 to 45 day reminder before a term of a year or longer renews, the reminder before a free or reduced-price trial converts, and the requirement that an online sign-up be cancellable online at will.. A cancel path that routes an online member through a phone call fails both.

Three artifacts come out of a cancellation handled properly, and the confirmation email is only one of them:

• the date and time the member asked, stored somewhere you can find it a year later
• a stop instruction that reaches the processor before the next scheduled charge
• a written confirmation to the member naming the last date of coverage

A member who stops the draft at their own bank has not used your cancellation flow, and Regulation E keeps the two separate 2Ref 2Consumer Financial Protection Bureau (2011).§ 1005.10 Preauthorized transfers..The bank-side mechanics of a recurring ACH debit: a preauthorized transfer from a consumer's account may be authorized only by a writing signed or similarly authenticated by the consumer, with a copy given to them, and the member may order their own institution to stop a scheduled transfer at least three business days ahead, with written confirmation demandable within fourteen days of an oral order.. The returned debit is usually the first notice you get. Treat it as the cancellation request and reconcile from there, whatever the agreement says about notice.

An unpaid month is a small balance. Whether it is worth small claims is a business question, best answered once, in writing, before the first member enrolls.

What to have in place before the first charge

A record of consent, a copy of the authorization, a disclosure the member saw before billing information was collected, and a calendar for whatever notices your state requires. Assemble those before the first dollar moves, because every one of them is easier to produce at enrollment than to reconstruct from a processor's dashboard eighteen months later.

The consent record is the piece to check first. ROSCA asks for the material terms to be disclosed before billing information is taken and for express informed consent before the charge, so the screen order carries legal weight: material terms first, then the card field 1Ref 1United States Congress (Restore Online Shoppers' Confidence Act) (2010).15 U.S. Code § 8403 — Negative option marketing on the Internet.The three federal baseline duties for a membership charge sold online: clear and conspicuous disclosure of material terms before billing information is taken, express informed consent, and a simple mechanism to stop the recurring charge, together with the statute's own limit to a transaction effected on the Internet.. A checkout page that collects the card and then shows the terms has the sequence backwards, and the record worth keeping shows which terms were on screen that day.

For bank drafts, the copy of the authorization is a separate deliverable from the payment receipt 2Ref 2Consumer Financial Protection Bureau (2011).§ 1005.10 Preauthorized transfers..The bank-side mechanics of a recurring ACH debit: a preauthorized transfer from a consumer's account may be authorized only by a writing signed or similarly authenticated by the consumer, with a copy given to them, and the member may order their own institution to stop a scheduled transfer at least three business days ahead, with written confirmation demandable within fourteen days of an oral order.. Send it at enrollment, keep the sent copy, and hold the authorization for as long as the membership runs plus whatever your retention policy sets.

None of this sets the fee. How many members a monthly price has to carry, and what that number does as the panel fills, is the DPC equation, and it is a separate calculation from the billing stack. Settle the fee first, because an increase after enrollment carries its own notice duty wherever a statute or the agreement sets one.