While PCI regulations do not prohibit collecting a customer’s CVV before authorization, it specifically forbids its storage after first use. For recurring charges, merchants only require the CVV for the first transaction and subsequently do not need it for use in later transactions. Recording CVV on stored authorization forms is a significant financial risk, as a data leak can lead to identity theft.