A variable recurring payment (VRP) is an open banking payment method that lets a customer give a regulated payment provider permission to make a series of payments from their bank account, without approving each one separately. The amounts and timing can vary, but every payment must stay within limits the customer sets in advance, such as a maximum per payment, a maximum per month and an end date. VRPs were developed in the United Kingdom and are the best-known example of a long-lived payment consent in open banking.
Under the hood, each VRP is an ordinary bank transfer, in the UK sent over Faster Payments, initiated by a payment initiation service provider (PISP) through the customer's bank's API. VRPs are often compared with Direct Debit and with card recurring payments, both of which they could partly replace.
How a VRP works
The customer first sets up a VRP mandate with the PISP, choosing the parameters. They are then redirected to their bank, the account servicing payment service provider (ASPSP), and authenticate once with strong customer authentication to approve the consent. From then on the PISP can submit payment instructions under that consent, and the bank checks each one against the agreed limits before sending it. No further authentication by the customer is needed for each payment.
The customer can see and cancel the mandate through the provider or, in many cases, directly in their banking app. Cancelling stops future payments immediately. The arrangement differs from a Direct Debit in an important way: the payer's bank enforces the limits in real time, whereas a Direct Debit lets the collecting business pull any amount, with protection coming afterwards through a refund guarantee. Managing these consents is covered under consent management and consent revocation.
A simple example shows the idea. A customer links a savings app to a current account with a limit of 300 pounds per payment and 1,000 pounds per month for one year. Each time the current account balance rises above a level the customer chose, the app sends a payment of the surplus to savings. If the app ever asked for 400 pounds in one go, the bank would refuse the payment because it breaks the mandate.
Sweeping and commercial VRPs
VRPs are divided by use case:
- Sweeping VRPs. Sweeping means moving money between accounts in the customer's own name, for example topping up a savings account when the current account has a surplus, or paying down a credit card balance. The Competition and Markets Authority (CMA) required the nine largest UK current account providers, known as the CMA9, to support sweeping VRPs free of charge to providers, and these went live in 2022.
- Commercial VRPs. Commercial variable recurring payments (cVRP) cover payments to third parties, such as utility bills, subscriptions and e-commerce. Because banks are not required to offer these under the CMA order, their rollout depends on commercial agreements, a common rulebook and pricing between banks and providers. UK regulators and industry bodies have been developing a framework for cVRPs, starting with lower-risk sectors.
Benefits and risks
For merchants and billers, VRPs promise lower costs than card payments, instant settlement and no card expiry problems. For consumers, they offer more control than a Direct Debit because limits are fixed in advance and cancellation is immediate. Personal finance apps use sweeping VRPs to automate saving and avoid overdraft charges.
The main open questions concern consumer protection and liability. Card payments carry chargeback rights and Direct Debits carry a refund guarantee, but a bank transfer under a VRP does not automatically have an equivalent, so the commercial VRP framework includes proposals for dispute handling and redress. Banks also face fraud risk if a criminal sets up a mandate after an account takeover, which is why consent creation requires strong authentication and is monitored.
Regulation and wider use
In the UK, VRPs are provided under the Payment Services Regulations by firms authorised by the Financial Conduct Authority, using API standards maintained by the UK open banking implementation body. The EU's PSD2 does not specifically require VRPs, but similar recurring consents have been proposed in other markets, and the concept appears in discussions of open finance and PSD2 reform. India's UPI AutoPay and Brazil's automatic Pix work on related principles, with a payer-approved mandate allowing repeat debits within limits.