What is a network mandate?

In one sentence

Network mandates are rules from Visa and Mastercard that govern how you store and reuse a cardholder's credentials.

The two mandate types you will see

• Customer-Initiated Transaction (CIT) — the buyer is actively paying at that moment (hosted checkout, Pay now, or one-click while they are in the session). The first save of a card must capture consent and, in SCA regions, authentication.
• Merchant-Initiated Transaction (MIT) — you charge a stored credential later without the buyer present (monthly bill, installment, top-up, no-show). The charge must reference the original CIT’s Network Transaction ID.

Network Transaction ID (NTID)

The card network creates this ID on the first CIT. APT stores it with the payment method and sends it on every later stored-credential charge. Without it, issuers treat the MIT as a new, suspicious checkout. Mastercard also requires a Transaction Link Identifier (TLID) on related MITs from 23 October 2026. Pilot stores ntid_sbx_* to model APT’s chain — that is not a live scheme ID. We follow the networks; we do not copy another gateway’s field names.

Common mix-ups

• A returning customer who clicks Pay is still a CIT, even if the card is saved.
• Capturing yesterday’s checkout authorization is still a CIT — capture timing does not make it an MIT.
• Do not label every merchant charge “recurring.” Networks have eight MIT types (recurring, installment, unscheduled, resubmission, delayed charge, no-show, reauthorization, incremental).
• Authorization (hold), Capture (take a hold), and Sale (auth+capture together) are what the processor does — not who started the payment. A Sale can be a CIT or an MIT.

Why it matters

Wrong flags raise declines, can force 3-D Secure when the buyer is not there, and weaken chargeback defense. APT records initiator, stored-credential, NTID, and MIT use case on sandbox money-path rows. Live acquirers must return a real NTID. Use documented test cards only.