Building third party app for subscription management

[alex97po]

We want to build an app where customer can manage all their subscriptions and recurring payments from all their cards. There is an existing functionality provided by Visa for this, however it is only available for Issuer. Is there any way to get this information for the customer (with customer's consent and authorization, of course) without Issuer?

[SyedSa]

Hi @alex97po, Thank you for reaching out. An agent will get back to you as soon as possible. Until then, if any community member has information that may be helpful, feel free to reply in this thread.

[DianaVisaPM]

Hey @alex97po,

Visa provides various APIs that allow developers to build applications for managing payments and card activities. However, access to certain data and functionalities, especially those involving sensitive financial information, can often be restricted to issuers and financial institutions due to regulatory and security reasons.

Visa's Subscription Management Solutions
Visa does offer subscription management solutions, but as you mentioned, they are primarily available to issuers. For third-party applications, the options are more limited due to the need to protect sensitive financial data and comply with various regulations.

Alternative Approaches
While Visa's subscription management solutions may not be directly accessible to third-party applications without issuer involvement, you can consider the following alternatives:

1. Collaborate with Issuers:
Partner with issuers to access the necessary APIs and data. By collaborating with issuers, you can leverage their access to Visa's subscription management functionalities while ensuring compliance with regulatory requirements.

2. Use Visa Transaction Controls:
Visa provides the Visa Transaction Controls API (https://developer.visa.com/capabilities/vctc/docs) which allows cardholders to manage and control their card usage. This API can be used to build features that allow customers to manage recurring payments and subscriptions by setting spending limits, blocking specific merchants, and receiving transaction alerts.

3. Leverage Open Banking APIs:
In some regions, open banking regulations require banks to provide open APIs that allow third-party developers to access account information and payment services with the customer's consent. Check if such APIs are available in the regions you are targeting and integrate them into your application.

4. Custom Solutions with Customer Consent:
Develop custom solutions that rely on direct customer authorization. For example, your application can allow customers to manually enter their subscription details and set up recurring payment tracking. This approach ensures that you have customer consent and authorization without relying heavily on issuer-specific APIs.

Conclusion
Currently, accessing detailed subscription and recurring payment information directly from Visa without issuer involvement may not be feasible due to regulatory and security constraints. However, by collaborating with issuers, leveraging available Visa APIs like Visa Transaction Controls, and exploring open banking opportunities, you can still build a robust subscription management application that serves your customers' needs.

[alex97po]

Hello, @DianaVisaPM!

Thank you for detailed response. I checked Transaction Control API and it does look like what I looking for. However, before accepting the solution, I would like to double-check few things:

- on Visa Subscription Manager Overview page, I can see "Available for use by Issuer Banks | Independent Developers", and on Visa Transaction Controls page I can see "Available for use by Issuer Banks | Issuer Banks for Small Business". Since I am planning to build an independent (from Issuer) app, I would consider myself an independent developer. However, from your response I understood that it is actually vice versa - Subscription Manager is available for Issuer only while 3rd party apps (assuming they passed all necessary certifications) can integrate with Transaction Controls. Is this understanding, correct? 

- if previous point is correct and I can integrate with Transaction Controls, I am not sure I understand how authorization and customer consent is managed. I see that API accepts card number only. What I expected to see was something similar to Mastercard Transaction Notification API (Mastercard Developers) that requires integration with Consent API first to "enroll" the customer securely. Could you, please, elaborate on enrollment part? 

Thank you in advance!
Alex 

[DianaVisaPM · Accepted solution]

Hey @alex97po,

You are correct in your understanding. The Visa Subscription Manager is primarily available for Issuer Banks and Independent Developers, while the Visa Transaction Controls API is designed for use by Issuer Banks and Issuer Banks for Small Businesses. However, third-party applications (such as those developed by independent developers) can also integrate with the Transaction Controls API provided they meet all necessary certifications and compliance requirements. So, as an independent developer, you can indeed build an app that integrates with the Visa Transaction Controls API.

The Visa Transaction Controls API does focus on managing transaction controls via the card number. However, for independent developers, the responsibility of securing customer consent and managing authorization lies with the developer. This often involves creating a secure enrollment process where customers provide their consent to use their card information for transaction controls.

Unlike Mastercard's Consent API, Visa does not have a standalone consent mechanism within the Transaction Controls API. Instead, developers are expected to implement their own secure enrollment process, ensuring compliance with relevant data protection and privacy regulations. Typically, this enrollment process includes:

- Securely collecting cardholder information.
- Verifying the cardholder’s identity through multi-factor authentication.
- Obtaining explicit consent from the cardholder to use their card details for transaction control purposes.

Once the cardholder is enrolled and consent is obtained, the Transaction Controls API can then be used to manage transaction settings based on the card number.

[alex97po]

Hello, @DianaVisaPM!

Thank you for your quick response and confirmation! 

I want to confirm a few more critical aspects of the technical feasibility of the solution I am developing.

1. I am not sure if I understood this correctly, but on the webpage https://developer.visa.com/capabilities/vctc/docs-getting-started, it is mentioned as "Available for all cards regardless of brand or network routing." Does it mean I can use VTC APIs to create, for example, a rule blocking a particular merchant (to avoid further recurring transfers) for a Mastercard card?

2. I can see https://developer.visa.com/capabilities/vctc/reference#tag/Notification-Delivery-Callback-API/operat... as part of VTC. Do I understand correctly that this API allows my app to "know" when the cardholder completes any transaction (like Mastercard Transactions Notification API https://developer.mastercard.com/transaction-notifications/documentation/how-it-works/)?

I appreciate any help you can provide.

Thanks,

Alex

[alex97po]

Since this thread is already marked as solved - moved follow up questions to a separate topic:

https://community.developer.visa.com/t5/Use-Cases/Use-VTC-for-other-schemas-and-transaction-notifica...