Consent Revocation

Consent revocation is the act of a customer withdrawing a permission they previously gave, so that a firm can no longer use it to read their account data or to take or send payments. In open banking it means ending a third party's access to an account. In payments more broadly, it covers cancelling a direct debit mandate, stopping a recurring card payment or withdrawing a standing authority for a business to pull funds. Once consent is revoked, the firm must stop acting on it and, where the law requires, delete or stop processing the data it obtained.

The right to withdraw consent is a basic principle of both payments law and data protection law: permission must be as easy to take back as it was to give. Revocation is one stage of consent management, alongside granting and consent renewal.

A customer who has connected an account to an app can usually revoke access in two places. The first is the third party itself, such as a budgeting app run by an account information service provider, which normally offers a list of connected accounts with an option to disconnect. The second is the bank holding the account, the account servicing payment service provider, which may offer an access dashboard showing every provider with live permissions.

Whichever route is used, the two firms must keep their records in step. If the customer revokes at the bank, the bank stops accepting the provider's access token and the provider's next data request fails. If the customer revokes at the provider, the provider should tell the bank, often by deleting the consent through the bank's API, so that the token cannot be reused. Data already collected must then be handled according to the provider's terms and data protection rules, which usually means deleting it unless there is another legal basis for keeping it.

Payment permissions are treated with particular care because withdrawal affects money movements:

• Direct debits and pull payments. A payer can cancel a mandate with their bank or the collecting business. In the UK, cancelling a direct debit with the bank stops future collections, and the scheme's direct debit indemnity protects payers against collections taken in error. In the United States, consumers can revoke authorisation for preauthorised electronic transfers under Regulation E, and an ACH stop payment can block a specific debit.
• Recurring card payments. A cardholder can ask the merchant to cancel a subscription or ask the card issuer to stop future payments to that merchant. Card scheme rules give cardholders dispute rights if a merchant keeps charging after cancellation.
• Variable recurring payments. A customer can end a variable recurring payment mandate at the provider or the bank, after which the bank must reject further payments under it.

Under the EU's PSD2, a payer may withdraw consent to a payment or a series of payments at any time before the point at which the payment order becomes irreversible. After that point, recovery depends on refund or dispute rules rather than revocation.

Firms must make revocation simple, visible and quick. Common expectations include offering a clear cancel option without obstructive steps, acting on revocation without undue delay, confirming it to the customer and keeping an audit trail. Firms must not continue to use stale credentials, treat a lapsed permission as still valid or ask customers to give reasons for withdrawing. Where a business relies on stored payment details, such as a stored credential, it must stop using them for any payment the customer has cancelled.

Supervisors also expect firms to handle revocation that arrives indirectly. A customer may close an account, report a device as lost or tell the bank that an app connection was set up by a fraudster. In such cases the bank may suspend or end third-party access on its own initiative and inform the provider, even without a formal request.

Revocation can be complicated when several parties are involved. A customer may cancel with the merchant but not the bank, or the reverse, leading to payments that continue or fail unexpectedly. Business customers may have several users with different rights, and joint accounts raise questions about who can revoke. Providers also need to explain consequences, such as losing transaction history in an app or a service ending. Clear communication and reliable messaging between firms reduce disputes and complaints, which regulators frequently cite in their supervision of consent practices.