COF

What is a Credential On File (COF) transaction?

A Credential On File (COF) transaction is a payment in which the merchant uses the cardholder’s stored card details. These details have been previously authorised by the cardholder so the merchant can use them for future transactions.

This information can be used in two types of transactions:

• Customer-initiated transactions (CIT): when the customer directly authorises the payment.

• Merchant-initiated transactions (MIT): when the merchant processes a payment based on a prior agreement with the cardholder, such as subscriptions or recurring payments.

Why COF matters under PSD2

With the introduction of the PSD2 regulation, correctly identifying COF transactions has become essential — especially in merchant-initiated payments where the cardholder is not actively involved at the time of the transaction.

For example, a customer subscribes to a monthly streaming service. The merchant securely stores the card details and processes automatic monthly charges.
Since the cardholder cannot authenticate the payment in real time, these transactions must follow specific security protocols. If they are not flagged correctly, there is a high risk of decline, which may impact both customer experience and business operations.