Card on file
A card the merchant keeps for later purchases, which makes one-click checkout and subscriptions possible – and makes the card networks nervous.
The networks distinguish two kinds of charge. In a customer-initiated transaction (CIT) the cardholder is present and can authenticate. In a merchant-initiated one (MIT) the merchant charges on its own, as when a streaming service takes next month's fee. Around 2017 Visa and Mastercard tightened their stored-credential rules: the first charge must be flagged as the first, and later MITs must reference it.
The flagging isn't paperwork for its own sake. It is what lets an MIT skip strong customer authentication, and what persuades the issuer to approve a charge at three in the morning. Merchants that store the actual card number also land in PCI DSS scope, which is why almost everyone stores a token instead.