No-Show Policies, Deposits, and the Card You Are Holding

A med spa no-show fee is not a no-show transaction. In the card networks' own vocabulary, "No-Show Transaction" is a defined term, and it is reserved for a short list of merchant types that does not include med spas. What you are actually running when you charge a missed appointment is an Unscheduled Credential-on-File transaction, and the rules that govern it are a different set of rules entirely.

That distinction decides everything downstream. The rules for a Guaranteed Reservation, the thing a hotel takes, are about the reservation. The rules for a stored credential are about the consent you captured before you saved the card, how you disclosed the cancellation policy, and what you do when the charge declines. A no-show policy written as if the first set applied still gets judged against the second.

Two claims that circulate constantly in this niche also came apart under checking. Regulation E's signed-authorization rule does not, by its own terms, reach a one-off no-show fee. And no state statute capping what a med spa may charge for a missed appointment turned up on any legislature, agency or board site we searched on 19 August 2026.

This post reads the primary documents and says what each one reaches: the Visa Core Rules and Visa Product and Service Rules, 18 April 2026 edition, Regulation E and Regulation Z in the eCFR, the FTC's fee rule at 16 CFR Part 464, California, Massachusetts and Minnesota state law, the Medicare Claims Processing Manual, and PCI DSS v4.0.

Every source on this page was read on 19 August 2026. We make med spa software, so we have an obvious interest in how clinics store cards and collect fees. The rules below hold regardless of whose software you run them in.

Your no-show fee is an unscheduled credential-on-file charge

Visa's glossary, entry ID# 0024887, defines a No-Show Transaction as one resulting from a cardholder's failure to cancel or claim a Guaranteed Reservation. A Guaranteed Reservation, glossary ID# 0029265, is a reservation where the cardholder provides a payment credential but no payment, so that the accommodation, merchandise or services will be held.

Visa Rules section 5.8.8.2, Merchant Requirements for Guaranteed Reservations (ID# 0029266), then limits who may accept one. The rule lists nine merchant types: lodging, aircraft rental, bicycle rental, boat rental, equipment rental, motor home rental, motorcycle rental, trailer park or campground, and vehicle rental. A med spa is on none of them.

The transaction type that does fit is defined at glossary ID# 0029548: an Unscheduled Credential-on-File Transaction is one using a stored credential, for a fixed or variable amount, that does not occur on a scheduled or regularly occurring transaction date, where the cardholder has consented to the merchant initiating future transactions. That is a merchant-initiated transaction. Visa Table 5-22 treats it as such, and separately requires that a cardholder-initiated transaction validate the cardholder's identity, for example with a login and password, which a charge run against an absent client cannot do.

The operational consequence is that your policy has to be built as a stored-credential consent, not as a reservation guarantee. Table 5-20 requires the agreement to name the event that will prompt the transaction. In plain terms, the consent your client accepts has to say that a missed or late-cancelled appointment is the trigger. A no-show clause that lives only in your general terms of service does not do that job.

The consent the network requires before you store a card

Visa Rules section 5.8.11.1, Table 5-20 (ID# 0029267, last updated October 2025) is a literal checklist. Before a merchant stores a payment credential for a future transaction, it must obtain the cardholder's express informed consent to an agreement containing the items below, along with the expiration date of the agreement and the length of any trial or promotional period. The right-hand column is our reading of what each item means at a med spa front desk.

Table 5-20 adds a placement rule that is easy to miss. All requirements related to specific transaction types must be clearly displayed at the time the cardholder gives consent, and must be displayed separately from the general purchase terms and conditions. A link to a terms page at the bottom of a checkout screen is not separate display at the moment of consent.

The same table requires the merchant to retain this information for the duration of the agreement and to provide it to the cardholder or the issuer on written request. That is a records obligation, not just a screen design obligation. If your booking system cannot produce, months later, the exact text a specific client accepted and the timestamp on which they accepted it, you have the policy but not the evidence.

Table 5-22 closes the last gap. After the cardholder agreement is completed in writing, and before the first transaction, the merchant must either submit an authorization request for the transaction amount or, if no payment is due, submit an account verification. If that initial request is not approved, the merchant must not store the credential. Collecting a card at booking and never touching it until someone misses is not what the rule describes.

How the cancellation policy has to be shown, channel by channel

Visa Rules section 5.4.2.5, Disclosure to Cardholders of Return, Refund, and Cancellation Policies (ID# 0008771, last updated October 2025), sets a different disclosure standard for each way a client books. For a card-present transaction, the policy must be disclosed at the point of transaction before the cardholder completes it, or on the front of the transaction receipt. If it appears on the receipt or in a separate contract, the rule requires a space for the cardholder to indicate acceptance of the policy.

For e-commerce, which is what your online booking page is, the policy must appear during the sequence of pages before final checkout and include a click-to-accept button, a checkbox, or another acknowledgement. For other card-absent transactions, phone bookings among them, disclosure goes through mail, email, or text message.

Section 5.4.2.5 ends with a sentence that removes a popular workaround. A merchant must not require a cardholder to waive the right to dispute a transaction with the issuer. A clause in your intake paperwork saying the client agrees not to dispute a no-show charge is not a defense you can build on.

The practical version is boring and effective. Show the fee, the deadline, and the cancellation method on the page where the client picks a time, capture the acknowledgement there, and send the same text in the confirmation. Every one of those touches is a timestamped record you will want later. If you are choosing or configuring med spa booking software, the question to ask is whether the consent text and its timestamp are stored per booking, not whether a policy field exists.

What the rules say when the charge declines or the client disputes it

There is a specific rule for the decline case, and it is worth writing into your policy explicitly. Visa Table 5-22, under Authorization Request Declines, provides that if an authorization request for a merchant-initiated transaction with a stored credential is declined, the merchant must notify the cardholder in writing and allow at least 7 calendar days to pay by other means. Seven calendar days, not business days. Silently retrying the card, or sending a declined no-show fee straight to a collections workflow, runs against that.

If the client instead disputes the charge, the condition it lands under is Visa Dispute Condition 13.7, Cancelled Merchandise/Services, at section 11.10.8.1, Table 11-128 (ID# 0030349). The issuer must establish all of the following: the cardholder cancelled the services, the merchant did not process a credit or voided receipt, and the merchant either did not properly disclose a limited return or cancellation policy at the time of the transaction, or disclosed one and did not apply it.

Read that third element again, because it is the whole ballgame. The dispute turns on disclosure. The timestamped, accepted policy record is the defense. Table 11-129 also limits the dispute amount to the value of the unused portion of the cancelled service and requires the cardholder to attempt to resolve the dispute with the merchant before the issuer may initiate. Table 11-131 sets the time limit at 120 calendar days from the transaction processing date or from the date services were expected, not to exceed 540 calendar days from the processing date.

One correction to widespread advice. Compelling evidence is not the tool for this. Visa section 11.5.1, Table 11-6, maps every allowable compelling-evidence item only to Dispute Conditions 10.1, 10.3 and 10.4, which are the fraud conditions. It is not listed for 13.7. Compelling evidence helps when a client claims they never made the transaction, not when they say they cancelled.

The CE3.0 remedy at section 11.7.5.3, Table 11-28, also carries hard thresholds: two prior transactions on the same payment credential that the issuer did not report as fraud, processed more than 120 calendar days before the dispute and not more than 365 calendar days prior, plus a device ID, device fingerprint or IP address and at least one further matching element, all in clear text and not hashed. Visa's multi-merchant expansion of CE3.0 is effective for disputes processed on or after 24 October 2026, with the current single-merchant version running through 23 October 2026.

Your merchant category code decides which rulebook you live under

Visa's glossary entry ID# 0024698 defines Health Care Merchant for the US region as a merchant, other than a pharmacy, whose primary business is providing health care services and that uses one of a listed set of MCCs: 4119, 5975, 5976, 7277, 8011, 8021, 8031, 8041, 8042, 8043, 8044, 8049, 8050, 8062, 8071 and 8099. MCC 7298, Health and Beauty Spas, and MCC 7230, Beauty and Barber Shops, are not on that list.

So the same clinic can be a health care provider to its state medical board and to CMS while being a beauty merchant to Visa. A physician-owned practice boarded under MCC 8011 lands on one side of the line. A spa boarded under 7298 lands on the other. Which code you carry is set by your acquirer, and it is not something that surfaces in day-to-day operations.

It is not a trivia question. Visa section 7.5.6, Clearing and Reversal Processing, requires the clearing amount and the authorization amount to match above the applicable floor limit, except as permitted by Table 7-10. In Table 7-10, merchants using MCC 7230 and MCC 7298 are permitted a variance of up to 20 percent between the authorized amount and the cleared amount. Lodging and cruise lines get 15 percent, vehicle rental gets the greater of 15 percent or USD 75, and other cardholder-initiated card-absent transactions get 15 percent. If your workflow authorizes a deposit and settles a different final amount, the band you are allowed depends on the code your acquirer assigned you.

One more limit belongs here. Visa Table 5-21 restricts full advance payments, meaning the entire purchase amount collected before delivery, to T&E, custom goods or services, certain face-to-face transactions where items ship later, and recreational services related to tourism and travel. Whether a bespoke treatment plan counts as custom services is a judgement your acquirer makes, not something the rulebook resolves for med spas. A partial deposit is handled separately as a Partial Payment, where any late fee must be a flat fee applied only as a late payment penalty.

What Regulation E's written-authorization rule actually reaches

Regulation E's written-authorization requirement at 12 CFR 1005.10(b) applies to preauthorized electronic fund transfers. 12 CFR 1005.2(k) defines that term as an electronic fund transfer authorized in advance to recur at substantially regular intervals, and Official Interpretation 2(k)-1 adds that the transfer must take place on a recurring basis, at substantially regular intervals, and require no further action by the consumer to initiate it.

A fee that fires only when a client misses does not recur at substantially regular intervals. So 1005.10(b) does not by its own terms reach a one-off no-show fee. We found no CFPB rule, interpretation or guidance addressing a one-off merchant-initiated debit charge on a stored card, read on 19 August 2026, so treat that as a reading of the regulatory text rather than settled agency guidance.

What Regulation E clearly does reach is your membership program, and only on debit cards. 12 CFR 1005.2(b)(1) limits "account" to consumer asset accounts, so credit card lines sit outside Reg E and under Regulation Z instead. 12 CFR 1005.3(a) makes sections 1005.10(b), (d) and (e) apply to any person, meaning the clinic itself and not only the client's bank, and Official Interpretation 10(b)-2 confirms that where a third-party payee fails to obtain written authorization, it is the payee that is in violation.

Three details matter for anyone running med spa membership software on debit cards. First, the authorization may be electronic: Official Interpretation 10(b)-5 says the similarly authenticated standard permits signed written authorizations to be provided electronically, satisfied by complying with the E-Sign Act, and requires a copy of the terms to go to the consumer. Second, only the consumer may authorize the transfer. Comment 10(b)-3 says the requirement cannot be met by a payee signing on the consumer's behalf with only an oral authorization, and comment 10(b)-5 states that a third-party merchant may not authorize on the consumer's behalf. Third, when the amount varies, 12 CFR 1005.10(d)(1) requires written notice of the amount and date at least 10 days before the scheduled transfer, with 1005.10(d)(2) allowing a pre-agreed range instead.

There is also a defense worth designing around. Official Interpretation 10(b)-7 provides that a payee does not violate the written-authorization requirement where the failure was unintentional, resulted from a bona fide error, and the payee maintains procedures reasonably adapted to avoid the error. The comment names the procedure: asking the consumer to specify whether the card is a debit card or a credit card is a reasonable one. A single radio button in your booking form is that control.

On the other side of the transaction, 12 CFR 1005.10(c)(1) lets a client stop a preauthorized debit by notifying their bank orally or in writing at least three business days before the scheduled date. For credit cards, 12 CFR 1026.13(a)(3) makes services not accepted or not delivered as agreed a billing error, with 60 days from the first statement to notify and, under 1026.13(d)(1), no collection of the disputed amount while it is open. Our guide to med spa membership program pricing covers how to design the program around that.

What state law actually constrains

The folklore says several states cap no-show fees. We searched legislature, agency and board sites on 19 August 2026 and found no statute, regulation, board rule or attorney-general opinion setting a numeric cap or a mandatory notice period on missed-appointment fees for medical-aesthetic or general health care services. That is not proof none exists, because we did not sweep all fifty legislatures. What we did find is structural rather than numeric, and it is summarised below.

The California provision is the sharpest of these, and the reason is a burden flip that is easy to read past. Under section 1671(b), an ordinary liquidated damages clause is valid unless the party challenging it proves it unreasonable. Under subdivisions (c) and (d), for consumer services contracts, the default runs the other way and the clause is void unless the impracticability exception applies. Whether a specific no-show fee is a liquidated damages clause at all is a question a court decides, and no source we read resolves it. The practical read is that a fee documented as an estimate of the room, injector time and product that could not be resold on short notice sits in a better position than a round number attached to nothing.

Massachusetts is the sharpest rule for a post about the card you are holding. 940 CMR 38.04(4) prohibits taking billing information before the total price has been disclosed clearly and conspicuously. Card first, price later is a c. 93A problem in Massachusetts.

940 CMR 38.04(2)(b) means a no-show fee, which is the textbook avoidable fee, has to be labelled as avoidable with instructions for avoiding it. The compliant pattern writes itself: state the fee, state that attending or cancelling by the deadline avoids it, and state exactly how to cancel. One caveat to carry: 940 CMR 38.06(2) provides that compliance with G.L. c. 111, section 228 by a health care provider as defined in G.L. c. 111, section 1 constitutes compliance with 940 CMR 38.00, and whether a given med spa is such a provider is not something we resolved.

Minnesota gives you the cleanest test in US law for the line you are working near. A mandatory fee has to be in the advertised price. A contingent no-show fee is avoidable by attending, so prong (2) of the definition likely does not catch it, but prong (3) is open-textured and, searching on 19 August 2026, we located no Minnesota court decision, attorney-general opinion or agency guidance applying subd. 1a to contingent cancellation fees.

Two federal rules people cite here reach neither med spas nor missed appointments. The FTC fee rule covers only live-event tickets and short-term lodging. And the FTC's 2024 negative option rule, the click-to-cancel rule, was vacated in full by the Eighth Circuit in Custom Communications, Inc. v. Federal Trade Commission, No. 24-3137, opinion filed 8 July 2025, with the FTC recodifying the pre-2024 text effective 12 February 2026 at 91 FR 6507. State negative-option rules such as 940 CMR 38.05(3), which requires cancellation at least as easy as sign-up, and California's affirmative-consent rule at Bus. and Prof. Code section 17602(a), survived that vacatur because they are state law.

Medicare allows it on a condition, CMS reads Medicaid the other way

If any part of your book is insured, the missed-appointment question splits along program lines. The table shows what each program's source says.

Two details in the Medicare column are easy to get wrong. The equality condition covers both the policy and the amount, so a clinic that charges cash clients nothing and Medicare beneficiaries something has failed it. And the fee is never billed to Medicare, because CMS makes no payment for it.

On the Medicaid side, keep the attribution precise. 42 CFR 447.15 itself says nothing about missed appointments. The prohibition is CMS's interpretation of the statute and that regulation, as restated by state Medicaid agencies. Colorado's statement adds a detail worth checking your intake paperwork against: providers cannot bill Medicaid members for scheduling appointments, and cannot ask members to sign forms accepting financial liability for missed appointments. If your intake packet has a single universal no-show acknowledgement that every patient signs, that is the sentence to reread.

One last technical rule about the card itself

Keeping a card on file can only mean holding a gateway token. PCI DSS v4.0 Requirement 3.3 states that sensitive authentication data is not stored after authorization. Requirement 3.3.1 says such data is not retained after authorization even if encrypted, and Requirement 3.3.1.2 says the card verification code is not retained upon completion of the authorization process. The PCI Security Standards Council's own FAQ on whether card verification codes may be stored for card-on-file or recurring transactions answers no, and notes the values are not needed for those transactions. That FAQ is dated 2 November 2017 and still uses the older v3.x requirement numbering, so cite 3.3.1 and 3.3.1.2 rather than the number in the FAQ.

The consequence for policy design is that the security code your front desk collected at booking cannot be sitting anywhere when the fee runs weeks later.

How to audit your own no-show policy this month

Start with your merchant category code. Call your acquirer or pull it from a statement and write it down, because Table 7-10's permitted variance and Visa's Health Care Merchant definition both turn on it.

Next, open your own online booking flow as a client and screenshot every screen from service selection to confirmation. Then check that flow against Visa Table 5-20's content list and against the placement rule that transaction-type requirements be displayed separately from your general terms. Placement is the easier of the two to fail, because it is a layout decision rather than a content one.

Third, pull a client who was charged a no-show fee in the last quarter and try to reconstruct the evidence pack you would send an issuer under Dispute Condition 13.7: the policy text they accepted, the timestamp of acceptance, the appointment record, the cancellation deadline, and proof no credit was issued. If you cannot assemble it in ten minutes, your exposure is a records problem rather than a policy problem.

Fourth, add a decline path. Write the written notice you will send when a stored-credential charge is declined, and set the window at 7 calendar days or more before any other collection step. Fifth, if you take debit cards for memberships, add a debit-or-credit question at authorization, keep the answer on the record, and check that varying amounts trigger written notice at least 10 days ahead.

Finally, separate the two documents. The stored-credential consent and the membership agreement do different jobs under different rules, and stacking them is what California Bus. and Prof. Code section 17602(a)(5) speaks to when it makes it unlawful to include information that interferes with, detracts from, contradicts or otherwise undermines a consumer's ability to give affirmative consent. While you are in there, it is worth asking whether the fee is doing the work you think it is. A filled slot and a collected penalty are different outcomes, and if the first one is what you are after, waitlist automation and the retention mechanics in our piece on med spa client retention are the levers that address it directly.

Frequently asked questions

Can a med spa legally charge a no-show fee?

Nothing we read on 19 August 2026 prohibits it outright for cash-pay clients. The constraints are conditional. The card networks require a specific stored-credential consent and a specific cancellation-policy disclosure before you may run the charge. California Civil Code section 1671(d) makes a liquidated damages provision in a consumer services contract void unless actual damages would be impracticable or extremely difficult to fix. Massachusetts and Minnesota impose fee-disclosure duties. And CMS's interpretation of 42 U.S.C. 1396a(a)(14) and 42 CFR 447.15 prohibits charging Medicaid members.

Do I need a signed form to keep a card on file?

You need a completed cardholder agreement, and Visa Rules section 5.8.11.1, Table 5-20 lists what it must contain, including the total price, the cancellation policy and its expiry date, the last four digits of the card, how the amount will be determined, and the event that triggers an unscheduled charge. Table 5-22 then requires an approved authorization or account verification before the credential is stored, and forbids storing it if that request is declined. An electronic acknowledgement can carry the consent, provided it is displayed at the moment of consent and separately from your general terms.

Does Regulation E apply to no-show fees?

12 CFR 1005.10(b)'s written-authorization requirement applies to preauthorized electronic fund transfers, which 12 CFR 1005.2(k) defines as transfers authorized in advance to recur at substantially regular intervals. A fee charged only when someone misses does not recur at regular intervals, so the rule does not reach it by its own terms. We found no CFPB interpretation addressing a one-off merchant-initiated debit charge on a stored card, read 19 August 2026. Regulation E does clearly govern recurring membership debits on debit cards, and 12 CFR 1005.2(b)(1) puts credit cards outside it.

Can I store the security code so I can charge the fee later?

No. PCI DSS v4.0 Requirement 3.3 states that sensitive authentication data is not stored after authorization, Requirement 3.3.1 says it is not retained even if encrypted, and Requirement 3.3.1.2 says the card verification code is not retained on completion of the authorization process. The PCI Security Standards Council's FAQ on card-on-file storage answers the same question no and notes the values are not needed for those transactions. Keeping a card on file means holding a gateway token, never the code.

What happens if the no-show fee is declined?

Visa Rules section 5.8.11.1, Table 5-22 provides that when an authorization request for a merchant-initiated transaction with a stored credential is declined, the merchant must notify the cardholder in writing and allow at least 7 calendar days to pay by other means. That is calendar days, not business days. Build the written notice and the seven-day window into your workflow before any retry cadence or collection step, because the rule sets a floor rather than a suggestion.

Can I make clients agree not to dispute the fee?

Visa Rules section 5.4.2.5, last updated October 2025, states that a merchant must not require a cardholder to waive the right to dispute a transaction with the issuer. The same rule prescribes how the cancellation policy must be disclosed instead: at the point of transaction or on the front of the receipt for card-present, during the page sequence before final checkout with a click-to-accept or checkbox for e-commerce, and by mail, email or text for other card-absent transactions. The disclosure record, not a waiver, is what stands up under Dispute Condition 13.7.

Can I charge a Medicare or Medicaid patient for a missed appointment?

Medicare Claims Processing Manual Pub. 100-04, Chapter 1, section 30.3.13 allows physicians and suppliers to charge Medicare beneficiaries for missed appointments provided they also charge non-Medicare patients, with the policy and the amount applying equally to all patients, and the charge is never billed to Medicare. For Medicaid, CMS's interpretation of 42 U.S.C. 1396a(a)(14) and 42 CFR 447.15, as restated by state agencies including Colorado's, prohibits charging members for missed or cancelled appointments and prohibits asking them to sign forms accepting that liability.

Is there a legal cap on how much I can charge for a no-show?

We found no state statute, regulation, board rule or attorney-general opinion setting a numeric cap on missed-appointment fees for medical-aesthetic or general health care services, searched on 19 August 2026 across legislature and agency sites. That is not proof none exists. The constraints we did find are structural: California Civil Code section 1671(d), the Medicaid prohibition, and the Massachusetts and Minnesota disclosure rules. California AB 483's 30 percent cap applies to early termination fees on fixed term installment contracts, and section 17800(d) excludes a general failure to perform a contract obligation.