Migrating Subscriptions After a Processor Shutdown

When a payment processor terminates a merchant account, most of the discussion focuses on held funds, replacement processing, and the MATCH list. Those are real problems. But for merchants running subscription businesses, there is a fourth problem that often causes more long-term damage than any of them.

Your stored card tokens belong to your processor’s vault. They do not belong to you, and they do not travel with you when you leave.

Every subscriber whose card was stored with the terminated processor is now on a payment method that no longer works. The rebill will fail. Depending on how your processor handles the termination, you may have days, weeks, or no time at all to recover those subscriber relationships before customers churn to competitors or simply cancel.

This guide covers what actually happens to subscription tokens in a processor termination, when recovery is possible, and how to execute a re-authorization campaign that recovers as much subscriber revenue as possible.

What Happens to Card Tokens When a Processor Terminates

Every time a customer enters their card details at your checkout, the actual card number is replaced by a token: a unique alphanumeric string that represents the card in your processor’s vault. Your system stores the token, not the card number. The processor’s vault holds the encrypted card data that the token points to.

Those tokens are specific to the vault that issued them. A Stripe token does not work in a PayPal vault. A PayPal token does not work in a Braintree vault. When a processor terminates your account, the tokens in their system become inaccessible unless you can extract the underlying card data and migrate it to a new vault. That process is called a PCI-to-PCI token migration.

Whether that migration is possible depends entirely on why your account was terminated and how cooperative the processor is with the extraction request.

For cooperative terminations, where the processor is closing your account for business reasons rather than policy violations, a full token migration typically takes 30 to 90 days. The processor and the new provider coordinate a secure encrypted file transfer of card data between their PCI-compliant vaults. Customers never need to re-enter their card details, and billing continues uninterrupted on the new processor. This is the best-case scenario.

For policy violation terminations, the situation is materially different. When a processor closes an account for an acceptable use violation, fraud concerns, or chargeback-related issues, they frequently refuse to cooperate with token extraction requests entirely. In documented cases from 2025 and 2026, merchants terminated by major aggregators for prohibited business categories or elevated dispute ratios received no token export. The card data stays locked in the old processor’s vault. Every stored card becomes permanently inaccessible.

Even in cooperative terminations, some vault providers charge extraction fees. Industry sources have documented costs of several thousand dollars for large subscriber bases. Factor that into the recovery timeline and budget before assuming a token migration is free.

The Re-Authorization Campaign

When token migration is not possible, the only path to recovering subscriber revenue is a re-authorization campaign. This means contacting your subscriber base directly, explaining the payment system change, and asking them to re-enter their card details through your new checkout.

The FTC’s guidance on subscription billing and negative-option programs, published in its consumer guide on free trials, auto-renewals, and negative option subscriptions, is worth reading before you write a single word of your campaign messaging. ROSCA requires clear disclosure of subscription terms and a simple cancellation mechanism. A re-authorization email that creates confusion about what the subscriber is agreeing to or implies they will be charged without explicit confirmation can generate chargebacks on the new processor before you have even started. Keep the messaging clear, factual, and explicit about what you are asking the subscriber to do.

Well-executed re-authorization campaigns recover 60 to 72 percent of subscribers within 60 days of launch. The recovery rate depends heavily on how quickly the campaign launches after the termination, how clear and trustworthy the messaging is, and how much the subscriber values the product. The longer the gap between the termination and the first re-authorization email, the lower the recovery rate.

The campaign lives or dies on whether you have the subscriber email list, a working checkout, and a message sequence that gives people enough reason to act. If you exported subscriber data including every email address before the processor restricted dashboard access, you have what the campaign needs. If dashboard access was locked before you got the export, recovering that list becomes a separate and sometimes impossible task that delays everything downstream.

The checkout on the new processor must be fully operational and tested before the first email goes out. Sending subscribers to a broken or incomplete payment page is worse than not contacting them at all. Subscribers who click through to a dead link do not come back.

A single email produces a fraction of the recovery a proper sequence does. A campaign of three to four emails spread over 14 to 21 days, with clear subject lines, a direct explanation of the situation, and a specific link to the new payment page, recovers significantly more revenue than a single notification. Each message in the sequence needs to give subscribers enough information to trust the request and enough urgency to act before the next billing date passes.

Authorization Rates on a New MID

Authorization rates on a brand new merchant ID run lower in the first few weeks than on an established account. Card issuers have no processing history to reference for a new MID, so their fraud scoring systems apply more conservative approval logic until a track record builds up.

Some subscribers who re-enter their cards correctly will still see their payments declined in the first few weeks on the new processor. The decline is not a problem with the card or the subscriber. It is a function of the new MID not having established a track record with the issuer.

Starting the re-authorization campaign with your best subscriber cohorts helps during this period: long-tenure subscribers with consistent payment histories, domestic cards from major issuers, and accounts with no prior dispute history. Better-quality cards from established subscribers tend to authorize more reliably on new MIDs than newer accounts or international cards. Running a small volume of transactions in the days before the full campaign launches also helps warm up the MID.

Subscription Migration and the Recurring Billing Industry Page

The mechanics of subscription processing, the compliance requirements under ROSCA and card network negative-option rules, and the operational setup for recurring billing on non-custodial rails are covered in detail in the recurring billing industry guide. That page covers the four billing patterns that most commonly lead to account termination in subscription businesses, which is useful context for merchants who want to avoid a second termination after successfully migrating to a new processor.

The integration-level technical setup for recurring billing on a new processor, including webhook configuration, dunning logic, and failed payment retry sequencing, will be covered in the recurring billing integration guide coming in the integration section of this site.

The First 72 Hours After Termination

The first 72 hours after a processor termination set the ceiling on how much subscriber revenue is recoverable. Dashboard access can be restricted at any point after a termination notice, and once it closes, the subscriber records behind it become difficult or impossible to retrieve without a formal legal process.

Log into the terminated processor’s dashboard immediately and download every subscriber record available: email address, subscription status, billing frequency, last successful charge date, and next scheduled charge date. That data is the foundation of the re-authorization campaign. Without it, the campaign cannot launch.

At the same time, contact the processor in writing and ask explicitly whether they will cooperate with a PCI-compliant card data export to a new processor’s vault. Ask for the answer in writing with a specific response deadline. If the answer is yes, begin coordinating with your new processor immediately. If the answer is no, or if 48 hours pass without a response, treat the re-authorization campaign as the primary recovery path and shift all effort there.

A re-authorization campaign that has nowhere to send subscribers accomplishes nothing, which means the new processor must be live and tested before the campaign launches. The full picture of replacement processing options, including what a shutdown means for your ability to get a new account depending on your industry and whether you are on the MATCH list, is covered in the guide to declined, shut down, and terminated merchant accounts. That guide covers first-hour triage, fund recovery, and the path back to processing for merchants at every stage of a shutdown.

For subscription merchants who need card acceptance running the same day without an underwriting queue, RiskPay accepts recurring billing setups through its WooCommerce plugin and API integration. Settlement flows directly to a USDC wallet on Polygon with no rolling reserve, which means the cash flow drag that traditional high-risk merchant accounts impose on subscription businesses during reserve buildout periods does not apply. For merchants running digital subscriptions that can absorb the gateway fee, it removes the 5 to 15 day underwriting delay entirely.

Frequently Asked Questions

Do card tokens transfer when a payment processor terminates an account?

Card tokens do not transfer automatically. They are specific to the vault that issued them. Transferring them requires a PCI-to-PCI token migration coordinated between the old and new processors, which takes 30 to 90 days when the processor cooperates and is often refused entirely in policy violation terminations.

What percentage of subscribers can be recovered through a re-authorization campaign?

Well-executed re-authorization campaigns recover 60 to 72 percent of subscribers within 60 days. The recovery rate depends on how quickly the campaign launches after the termination, how clear the messaging is, and whether the new checkout is fully operational before the first email goes out.

Why are authorization rates lower on a new merchant ID?

Card issuers use processing history to calibrate their fraud scoring for a merchant. A brand new MID has no history, so issuers apply more conservative approval logic in the early weeks. Starting the re-authorization campaign with long-tenure subscribers and domestic cards, and running low-volume test transactions before the full campaign, helps establish the new MID’s track record faster.

Does ROSCA apply to re-authorization emails sent after a processor shutdown?

Yes. ROSCA requirements apply to any recurring billing relationship with US consumers regardless of which processor you use. Re-authorization emails must clearly disclose what the subscriber is agreeing to, what they will be charged, and how to cancel. Ambiguous messaging that implies billing will restart without explicit confirmation can generate chargebacks on the new processor.