A commercial variable recurring payment (cVRP) is a form of variable recurring payment used in the United Kingdom to pay a business or other third party, rather than to move money between a customer's own accounts. The customer gives a single, long-lasting consent through a payment initiation service provider (PISP), setting limits such as the maximum per payment and per month. The PISP can then initiate payments of varying amounts from the customer's bank account to the merchant, within those limits, without the customer authenticating each one.
cVRPs are designed as an open banking alternative to card-on-file payments and Direct Debit for uses such as utility bills, subscriptions and account top-ups. They differ from "sweeping" VRPs, which move money between accounts in the customer's own name and which the UK's largest banks were required to support. Commercial VRPs are not mandated in the same way, so their rollout has depended on industry agreements on pricing, liability and consumer protection, overseen by the Financial Conduct Authority and the Payment Systems Regulator.
How a cVRP works
- Setting up the consent. The customer chooses to pay by bank with a merchant and agrees to a VRP consent, sometimes called a mandate, specifying the payee, the maximum amount per payment, a maximum per period, and an expiry date.
- Authorising at the bank. The customer is passed to their bank, the account servicing payment service provider, and approves the consent once using strong customer authentication.
- Initiating payments. Whenever a payment is due, the PISP sends a payment request under the consent. The bank checks it against the limits and, if it fits, sends the money over Faster Payments.
- Managing the consent. The customer can see and cancel the consent through the PISP or, in many cases, their banking app, a function supported by consent management tools.
Background
UK open banking began with a competition remedy that required the nine largest current account providers to build standard APIs. Those banks were later required to support VRPs for sweeping, which lets customers move money automatically between their own accounts, for example to avoid overdrafts or to pay down credit. Extending VRPs to commercial payments raised harder questions, because banks would carry the cost of handling payments to merchants without the fees they earn from cards, and consumers would need protection if a merchant failed to deliver. The Joint Regulatory Oversight Committee set up by the FCA and the Payment Systems Regulator worked with industry on a phased approach, beginning with lower-risk uses such as payments to regulated utilities, government bodies and regulated financial services firms, and on a multilateral framework for commercial terms and dispute handling.
Comparison with other recurring payments
- Direct Debit. Run through Bacs, Direct Debit settles in about three working days and is backed by a strong refund guarantee. A cVRP settles in seconds and gives the customer real-time visibility of limits, but its consumer protection depends on the scheme rules adopted.
- Card on file. Card-on-file transactions work worldwide and carry chargeback rights but cost merchants more and fail when cards expire. cVRPs are tied to the bank account, so they do not expire with a card.
- Standing orders. These are set by the customer for fixed amounts, whereas cVRPs allow amounts to vary within limits.
Uses
Proposed and early uses include energy and water bills that vary month to month, subscriptions, insurance premiums, loan repayments, charitable giving, wallet and investment account top-ups, and pay-as-you-go services such as ride-hailing. Merchants are attracted by low cost, instant settlement and fewer failed payments, while customers benefit from tighter control over what a business can take.
Challenges
The main challenges are commercial and practical. Banks and PISPs must agree how much banks are paid for supporting commercial payments, and merchants want pricing below cards. A consumer protection model is needed so that customers can recover money when a merchant fails or misuses a consent. Bank interfaces must reliably handle high volumes of payments without customer involvement, and customers need to understand and trust a new type of mandate. How these issues are resolved will determine whether cVRPs become a mainstream part of pay by bank and of UK open banking more generally.