Switching Processors Without Losing Subscribers' Saved Cards

On this page 8 sections

1. Why Your Card Vault Is Your Most Valuable Asset
2. Who Actually Owns Stored Card Data
3. How to Migrate Card Data to a New Payment Processor Step by Step
4. Requesting a Stripe Card Data Export and Exports From Braintree and Others
5. Payment Token Migration: Mapping Tokens and Billing Dates
6. Running Parallel Billing During a Recurring Billing Processor Change
7. Contract Terms That Protect Data Portability
8. Next Steps Before You Switch

Key takeaways

• Card data typically moves directly from one PCI-compliant provider to another in an encrypted file. You usually never handle raw card numbers yourself.
• An export carries card details, not your subscription logic. You must rebuild plans, billing dates and customer mappings in the new system.
• Run both processors in parallel during cutover, and keep the old account open for refunds and late disputes.
• Write data portability terms into every processor or gateway contract before you sign.

For a subscription or membership business, the saved cards on file are what keep revenue coming in each month. When you switch processors, the biggest risk is losing those stored credentials and having to ask every subscriber to re-enter payment details. Some never will. This guide explains how to migrate card data to a new payment processor through a PCI-compliant vault transfer. It covers who controls the data, how to request exports, how to map tokens and billing dates, and the contract terms that protect you the next time you switch.

This article is general information, not legal or compliance advice. Processor policies and security standards change, so confirm current requirements with each provider and a qualified professional.

Why Your Card Vault Is Your Most Valuable Asset

A gym, a software company, a meal-kit brand and a paid newsletter all depend on the same thing: permission to charge a stored card on a schedule. That stored card usually sits in a card vault run by your processor or gateway. Your own systems hold only a token that points to it.

The token is what makes recurring billing easy. It is also what ties you to the processor. A token issued by one processor generally means nothing to another. If you leave without moving the underlying card data, you end up with:

• A subscriber list and no way to charge it
• A mass "please update your card" email campaign
• Involuntary churn from subscribers who ignore that email, often your quietest and most loyal members
• A spike in support tickets and failed renewals during the transition

Every subscriber who has to re-enter a card gets a fresh chance to reconsider the subscription. A proper vault migration takes that decision off the table.

Who Actually Owns Stored Card Data

Settle this question first. The answer is less simple than most merchants assume.

The customer relationship and the subscription agreement belong to you. Storage of full card numbers, however, sits with a PCI DSS-compliant provider. Because of the security obligations involved, processors generally won't hand raw card numbers to a merchant. Many will instead transfer the data directly to another PCI-compliant processor or vault when the merchant asks.

In practice:

• You can usually direct where the data goes. You generally can't download it into a spreadsheet.
• The receiving party usually has to show it is PCI compliant. Expect the sending provider to ask for compliance documentation from the recipient.
• Some data won't move. Card security codes generally aren't kept after authorization, so they aren't part of an export. Recurring charges on a stored card shouldn't depend on them.
• Platform terms vary. Some all-in-one platforms and marketplaces limit exports or don't offer them. Read your current agreement before you assume portability.

If your account was closed rather than voluntarily moved, a similar export process may still be available, but the timeline gets tighter. Our guide on what to do after Stripe closes your account covers that scenario.

How to Migrate Card Data to a New Payment Processor Step by Step

A PCI card vault migration usually follows a similar pattern no matter which providers are involved. Exact steps vary, so confirm each one with both providers.

1. Get approved by the new processor first. Underwriting comes before migration. Subscription models get extra scrutiny for chargeback exposure, trial terms and cancellation flows. Have your documents ready, and review how to get approved for a subscription merchant account before you start.
2. Confirm the receiving vault can accept an import. Not every processor or gateway takes inbound card data. Ask the new provider whether it does, what file format and fields it requires, how files must be encrypted and who on its side handles imports.
3. Collect the receiving party's compliance documents and encryption details. The sending provider will typically want proof of the recipient's PCI compliance and an encryption key so that only the recipient can open the file.
4. Submit the export request to your current processor. Include your account details, the recipient's information and the documents from step 3.
5. The file moves from provider to provider. It should travel by a secure transfer method. You should not receive or forward card data yourself.
6. The new vault imports the data and returns a mapping file. The mapping links your old customer or payment method IDs to the new tokens. It is the most important deliverable in the whole process.
7. You rebuild billing in the new system, test with a small group, then cut over in stages.

Requesting a Stripe Card Data Export and Exports From Braintree and Others

Each provider runs its own process and can change it at any time. Don't treat anything below as a description of a specific provider's current policy. Use it as a list of what to ask, and confirm the answers in writing before you set a timeline.

Stripe

If you bill through Stripe, contact Stripe directly and ask whether it will transfer your stored card data to your new PCI-compliant processor. Ask how to submit the request, what it needs from the receiving party and how long it typically takes. Expect a Stripe card data export to cover payment method data only. Subscriptions, coupons, invoices and plan structures in Stripe Billing are separate records, so plan to export them through reports or the API.

Braintree

Ask Braintree the same questions: whether it supports outbound transfers of vaulted payment data, what it requires from the recipient and what the turnaround is. Get the answers in writing.

Gateways and Other Processors

Gateways, recurring billing platforms and smaller processors vary widely. Before you request anything, ask each one:

• Do you support outbound card data exports to a third-party PCI-compliant vault?
• Is there a fee, and what is the typical turnaround?
• Which fields are included (card number, expiration, cardholder name, billing address, customer ID)?
• Can you include stored bank account details for ACH subscribers, and under what conditions?
• Can you provide a follow-up "delta" export for cards added or updated after the first file?

ACH subscribers raise a separate issue: their recurring authorizations. Make sure you keep the authorization records you need, as covered in our article on Nacha authorization rules for ACH memberships.

Payment Token Migration: Mapping Tokens and Billing Dates

The import gives you new tokens. Your job is to reconnect each one to the right subscriber, plan and renewal date. Most migration errors happen at this step.

Build a Master Mapping Sheet

Before cutover, assemble a single record for every active subscriber. The table below shows the kinds of fields to include (illustrative):

Watch for These Mismatches

• Unmatched records. Some cards won't import, for example closed accounts or records with incomplete data. Flag them early and send those subscribers a targeted card-update request.
• Expired cards. An export carries the expiration date as stored. Ask whether the new processor offers an account updater service, and see our guide to keeping subscribers billing with Card Account Updater.
• Network tokens. Network tokens provisioned through your old provider generally don't carry over as-is. The new processor may be able to provision new ones from the imported card data. Ask how it handles this, because network tokenization can lift renewal approvals.
• Stored-credential references. Card networks have rules on how card-on-file and merchant-initiated recurring charges are flagged. Ask your new processor whether it can carry over any references from your prior transactions. Our walkthrough on stored credentials and MIT flags explains why this affects approvals.

Running Parallel Billing During a Recurring Billing Processor Change

Don't move every subscriber at once. A staged cutover lets you catch problems while they are small.

A Sample Cutover Sequence (Illustrative)

1. Move new signups first. Once the new account is live, route new subscribers to it. Existing subscribers stay on the old processor for now.
2. Take the export snapshot. Request the export and record the exact date and time it reflects.
3. Pilot a small cohort. Move a small slice of renewals to the new system. Compare approval rates and decline codes against your old processor's history.
4. Catch the delta. Some subscribers will add or update cards between the snapshot and cutover. Request a delta export, or send those specific customers a card-update link.
5. Migrate in batches grouped by billing date, so no renewal cycle runs on both systems.
6. Turn off renewals on the old system only after you confirm each batch billed correctly on the new one.

Avoid These Cutover Mistakes

• Double-billing. Every subscriber should have exactly one active renewal schedule at any moment. Disable the old schedule before the new one fires.
• Breaking dunning mid-cycle. Decide whether subscribers already in a retry sequence finish on the old system or restart on the new one. Don't run both. Review your dunning process for failed subscription payments as part of the plan.
• Surprise billing descriptors. Your statement descriptor may change with the new processor. Tell subscribers ahead of time and keep your brand name recognizable. An unfamiliar descriptor invites "I don't recognize this" disputes.
• Closing the old account too soon. Refunds and chargebacks on old transactions can arrive well after cutover, and the old processor may still hold a reserve. Keep the account open until that activity winds down.

Contract Terms That Protect Data Portability

The easiest migration is the one you planned for when you signed up. Before you sign with any processor, gateway or billing platform, including your new one, look for or negotiate:

• An explicit data portability clause confirming that the provider will transfer stored card data to a PCI-compliant recipient at your request
• Defined turnaround expectations for export requests
• Fee transparency, so you know whether exports cost anything before you need one
• Export on termination, including termination the provider initiates, not just termination you initiate
• Scope of the export: card data, bank account data where permitted and customer identifiers
• A delta export provision for records changed after the initial file
• Ownership of customer and subscription records, so you can export plan, billing date and customer data in a usable format

When you compare tools, our guide to choosing recurring billing software covers portability alongside features and cost.

Next Steps Before You Switch

A clean vault migration takes coordination among three parties: your old processor, your new processor and your billing system. Start with approval on the new account. Then confirm in writing that the new provider can accept an import, build your mapping sheet and plan a staged cutover. Keep the old account open long enough to handle refunds and disputes.

If you're evaluating a new home for your recurring billing, MannyPay provides merchant accounts for low- and high-risk businesses, online payment processing and payment gateways including Authorize.net and NMI. Talk to our team about your recurring billing setup. You can request a free quote, and a MannyPay specialist will respond within one business day.

ME

About the author

MannyPay Editorial Team

Beyond the Swipe's editorial desk researches the publication's guides and news and cites its sources in every article. Articles reviewed by a named MannyPay editor carry that editor's byline.

This article is for general educational purposes and is not legal, tax or financial advice. Card network rules and state laws change; confirm current requirements for your business.