The verdict in three sentences
For a subscription you must tokenize the card once and then charge silently, handling 3DS2 step-up when the bank requires it. By delegating storage to the provider vault (Paystack, Flutterwave, Stripe), you stay on a light PCI SAQ-A scope and never host the card number. The real financial gain comes from smart dunning: it recovers 30 to 50 % of involuntary churn.
Tokenize without carrying the PCI burden
The token replaces the card number with a reference that is useless elsewhere. The provider keeps the sensitive data in its vault; your server stores only the token. The result: SAQ-A compliance, the lightest level.
| Storage model | PCI scope | Compliance cost (est. 2026) | Card-leak risk |
|---|---|---|---|
| Card stored in-house | SAQ-D | High (annual audit) | High |
| Token via provider vault | SAQ-A | Low | Near zero |
| Redirected (hosted) payment | SAQ-A | Low | Zero |
| Mandated mobile money wallet | Outside card PCI | Low | N/A |
Once the token is obtained at the first payment, later charges are silent, except when the issuing bank asks for 3DS2 — friction that hits 8 to 15 % of recurring transactions.
The dunning sequence that saves MRR
Involuntary churn (expired card, limit, insufficient balance) accounts for 5 to 9 % of subscribers a year. A scheduled retry sequence, not a single attempt, changes everything.
| Attempt | Delay after failure | Reminder channel | Cumulative recovery (est.) |
|---|---|---|---|
| Retry 1 | Day 1 | Email + push | 15 to 20 % |
| Retry 2 | Day 3 | WhatsApp / SMS | 25 to 35 % |
| Retry 3 | Day 7 | Email + card-update link | 30 to 45 % |
| Final retry | Day 14 | Call / retention offer | 35 to 50 % |
| No dunning | — | — | 0 % (churn taken) |
Smart retries (charging at the right time, e.g. after payday) outperform instant attempts, because many failures come from a temporarily insufficient balance.
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
Mini case study
Thabo, founder of a billing SaaS in Johannesburg, has 1,200 subscribers at ZAR 299/month, an MRR of ZAR 358,800. His involuntary churn is 7 %, or 84 lost subscribers/month with no retries. By deploying a day 1/3/7/14 dunning sequence he recovers 40 % of those failures, or 34 subscribers × 299 = ZAR 10,166/month saved, over ZAR 122,000/year kept without acquiring a single new customer.
FAQ
Does tokenization make me PCI compliant automatically? It reduces your scope to SAQ-A if the provider carries storage and card collection (iframe or redirect). You must never see the full number on your servers.
Will 3DS2 kill my subscription conversion? No, if used as targeted step-up. It hits 8 to 15 % of recurring transactions; the rest go silent thanks to the recurring-payment exemption.
When should you retry a declined card? Space the attempts: day 1, 3, 7 then 14. Smart retries timed after payday recover far more than three attempts in the same hour.
What MRR gain is realistic? A well-tuned dunning sequence recovers 30 to 50 % of involuntary churn, which itself is 5 to 9 % of the yearly base — often a SaaS's best ROI.
Can you mix a tokenized card with a mobile money mandate? Yes, and it is recommended in Africa: tokenized card for the diaspora and international, Wave/M-Pesa mandate for the local market.
Let's talk about your project. We set up tokenization, 3DS2 and a dunning sequence on your subscription. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
