Recurring payments and subscriptions: what to have in place before you bill a customer automatically

Any business that bills customers on a repeating schedule, whether it's a membership, a maintenance package, or a block of sessions sold up front, needs two things in place before the first charge ever goes through: a proper authorization, and an easy way for the customer to cancel it. The rules differ depending on whether the money comes off a credit card or straight out of a bank account, and Quebec has just added new requirements for subscriptions sold online.

Card or bank account: two different sets of rules

A recurring charge on a Visa credit or debit card is not a pre-authorized debit in the sense used by Payments Canada, the organization that oversees how bank transactions clear in this country. Pre-authorized debit rules only apply when money is pulled directly from a bank account, never from a credit card.

That distinction decides who you deal with when something goes wrong. A dispute over a recurring bank withdrawal is handled with the customer's financial institution, under Payments Canada's Rule H1. A dispute over a card charge is handled with the card issuer, under the network's own rules and the usual protections against unauthorized transactions.

What a pre-authorized debit agreement has to include

If your business pulls money directly from a bank account, the agreement has to include specific elements set out in Appendix II of Rule H1: the date of the agreement, the customer's authorization to withdraw from a specific account, and, if the amount changes from one withdrawal to the next, such as a bill that varies with usage, a clear statement that the amount can vary.

When the amount varies, the customer has to get at least ten days' notice before each withdrawal, unless both sides have agreed to shorten or waive that notice. A business that charges a fixed amount every month doesn't carry that repeated notice obligation, only the requirement to have gotten the initial authorization.

Cancelling the payment doesn't cancel the bill

A customer can cancel a pre-authorized debit agreement at any time. The business then has thirty days from receiving that notice to stop drawing from the account.

Here's what a lot of business owners miss: cancelling the debit agreement doesn't cancel the underlying service contract or the money owed. It only stops that one payment method. If the customer still owes for sessions, a membership, or services already delivered, you need another way to collect it or a separate process to pursue what's owed. The customer also has ninety days after a withdrawal to dispute it with their financial institution if they believe it was wrong or unauthorized.

Automatic renewal was already regulated

Even before the new 2026 rules, Quebec's Consumer Protection Act already limited automatic renewal in several types of successive-performance contracts, the kind where obligations are delivered in instalments or on an ongoing basis. A membership at a gym or a weight-loss clinic, for instance, can't run longer than a year and can't renew itself automatically: the customer has to agree in writing before the term ends for the contract to continue. A fixed-term internet access contract longer than sixty days can't carry an automatic renewal clause for another fixed term either.

A business selling packages or session bundles, even one that isn't an internet provider or a gym in the strict sense, is better off checking whether its own contract resembles one of these already-regulated models, rather than waiting for a customer to point it out.

The new mandatory cancellation button

Bill 10, the Act to protect consumers against abusive practices in ticket resale and online subscription renewal, was passed by the National Assembly in June 2026. It targets successive-performance contracts specifically, the kind whose obligations are carried out in instalments or continuously, which covers most subscriptions.

One of the new obligations lands directly on businesses that sell subscriptions online: a customer who has the right to cancel without giving a reason has to be able to do so through a button that's easy to find and clearly identifiable on the site, not only by phone or email to customer service. Another requires that any non-recurring fee, such as an installation charge, be shown clearly right next to the advertised periodic price for a successive-performance service sold at a distance.

A card that expires doesn't always announce it

For card-based recurring billing, a common problem that has nothing to do with any of the rules above is purely operational: the stored card expires or gets replaced after a loss or theft, and the next charge fails without either the business or the customer seeing it coming. Visa offers merchants a service that automatically updates stored card details, meant to cut down on declines caused by expired, closed, or replaced cards. It's still worth checking whether your processor actually uses it, and building in a manual follow-up for the cases it misses.

Worth checking this week

• Does the authorization form used for a subscription spell out the amount, the frequency, and the date of each withdrawal.
• If the amount can vary, does the customer get notice before each withdrawal, or is a signed waiver of that notice on file.
• Can a customer cancel an online subscription with a step as simple as the one they used to sign up.
• What happens in your system when a customer cancels their bank withdrawal but still owes money for services already delivered.

Those four questions catch the most common gaps before a customer, or a financial institution, catches them for you.