.png)
TL;DR
- A cVRP lets a customer give you permission, once, to collect varying amounts from their bank account within agreed limits.
- The customer approves the mandate in their banking app, and can see and cancel it there.
- Each payment is checked against the limits and the customer’s balance, then moves over Faster Payments.
- Wave 1 is live today, which covers lower-risk uses such as utilities, charities, government, regulated finances, and others. E-commerce and subscriptions are planned in Wave 2, expected to roll out in 2027.
- Direct Debit is still the better choice for fixed, predictable billing
A commercial variable recurring payment (cVRP) lets a customer give a business permission, once, to collect payments of varying amounts from their bank account. The customer agrees the limits with the business and consents to the mandate in their own banking app, where they can also cancel it at any time. Within those limits, the business collects without asking again. Each payment is checked against the limits and the customer’s balance before it is taken, then moves over Faster Payments, the UK rail that moves money between bank accounts in seconds, 24 hours a day.
Until now, collecting recurring payments in the UK has meant one of two realistic options: Bacs Direct Debit or a card on file. Direct Debit is dependable and cheap for fixed amounts, but mandates take days to be verified and you find out a payment failed days after you attempted to collect it. A card on file is instant to set up and familiar to customers, but it is expensive, and every stored card has an end date.
Now, cVRPs are a third option, and a more modern one. It is in the same family as Pay by Bank, powered by Open Banking. They are the commercial form of variable recurring payments, the UK Open Banking standard that lets an account holder pre-authorise payments of changing amounts. The first VRPs in the UK were sweeping, which moves money between a person’s own accounts. A commercial VRP lets a customer pay a business.
How does a cVRP work?
What does the customer agree to
A cVRP starts with a mandate: the customer’s permission for a business to collect payments from their bank account within agreed limits. Depending on the use case, you can let the customer configure their own limits during signup, for example a maximum of £100 or £1,000 a month. The customer then sees the terms in full in their banking app before consenting:
- who can collect
- the maximum per payment
- the maximum per period, for example per month or week
- how long the mandate lasts
Nothing outside those terms can typically be collected. If a payment would go over a limit, it’s rejected before it reaches the customer’s account, and you're told why. To collect more, you ask the customer to approve a new mandate with a higher limit.
How is a cVRP set up?
- The customer signs up with the business and agrees to the payment terms, such as a weekly or monthly limit.
- The customer chooses to Pay by Bank and selects their bank.
- They sign in with their bank’s own authentication and approve the mandate terms.
- The bank usually confirms the mandate straight away.
How are payments taken?
Once the mandate is in place, the business can collect varying amounts without asking the customer each time, for example a monthly bill that changes with usage or a top-up when a balance runs low.
Before each payment, Trustly checks it with the customer’s bank against the mandate limits and the available balance.
If the balance is too low on the account or the payment would breach a limit, the payment attempt is instantly rejected, and you receive the reason why. Payments run over Faster Payments, so the business knows straight away whether a payment succeeded – rather than days later.
Can the customer cancel or change a cVRP?
The mandate sits in the customer’s banking app, where they can see it and cancel it at any time. They can also cancel on the business’s own site. Either way, the business is typically notified straight away.
You can’t edit a limit on an existing mandate. To change it, the customer cancels and approves a new one.
How do cVRPs compare with card on file and Direct Debit?
Most recurring payments in the UK run a stored card, a Bacs Direct Debit, or now, a cVRP. They do the same job, but differ in five ways:
What cVRP’s mean for UK businesses
The customer controls the mandate from their bank
With a card on file, you hold the payment instruction, and the customer usually has to come to you or their card issuer to stop it. With a cVRP, the customer approves the limits inside their own bank and can see or cancel the mandate there at any time.
No fixed expiry date
A cVRP is linked to the bank account, so there is no card to expire and no collections failing because a card lapsed. A cVRP mandate can be indefinite or have a specific end date if you and the customer agree to one. It lapses after 13 months with no payments, as a Direct Debit does. Card updater services reduce that problem but do not remove the end date, and they do not cover every issuer or every card.
Verified by the bank at setup
A card is checked with a security code and an address match, which confirms the details rather than the account. A Direct Debit mandate is usually set up from details the customer types in, with no check that the account is theirs, which is what our Open Banking onboarding adds. A cVRP builds it in: the customer approves inside their own bank, using the bank’s own authentication, so the account and the person behind it are verified before the mandate exists.
Money in seconds, not days
A card authorises in seconds, but the funds reach you later, through the scheme and your acquirer. A Direct Debit takes days, and a failed collection reaches you after the fact. A cVRP runs on Faster Payments: the customer’s bank checks the mandate limits and the balance first, and makes the payment within seconds. Businesses can receive funds straight away or in one daily settlement, depending on their set-up.
Lower cost than cards
Direct Debit costs least per payment and cards cost most. Card pricing is largely a percentage of the amount, so it scales with your average transaction value, while Direct Debit is typically a flat fee per collection. We expect cVRP to sit between the two.
Where are cVRPs available in the UK today?
The UK rollout is phased. Wave 1 launched in June 2026 and covers lower-risk collection use cases: utilities, telecoms, rail services, regulated financial services, e-money institutions, government and charities. The main UK banks support cVRPs today. Smaller banks and neo-banks are still being added, so coverage is not universal and any provider should be able to tell you what share of your own customer base it reaches.
E-commerce and online subscriptions aren’t covered yet. They will be included in Wave 2 along with other use cases. Wave 2 is expected to go live in 2027. The commercial terms and protection model framework for Wave 2 are still being defined, and we are working with UKPI and the industry to shape them.
If you run a recurring-revenue business, cVRPs are something to understand and plan for rather than something to switch on tomorrow. The scheme’s rules and rollout timetable are published by the UK payments initiative (UKPI).
When is Direct Debit still the better choice?
A cVRP and a Direct Debit both collect from a bank account, and they suit different jobs.
If your billing is predictable, the amount is the same each month, and you do not need confirmation that the funds are there on the day, Direct Debit does the job and costs less per payment. For most businesses that will still be where the majority of the volume sits. We run Open Banking Direct Debit for merchants today and we will keep doing so.
A cVRP earns its place where the amount varies, where you need the authorisation and the funds confirmed immediately, or where the alternative is a stored card.
What is Trustly building?
We’re adding cVRP support to the Trustly platform as part of the recurring payments products we already run.
For a UK merchant that means three ways to collect the same recurring revenue:
- Direct Debit over Bacs, with Open Banking onboarding to verify the account at signup
- A first payment taken instantly, with Direct Debit behind it for the collections that follow
- cVRPs, running end to end on Faster Payments
The right answer depends on the use case, and often a business will want more than one. The first merchants will go live as bank coverage and Wave 1 terms allow, and we will share more as the rollout progresses.
Tell us how you collect recurring payments today, and we’ll talk through where a cVRP fits. Contact us
Frequently asked questions about cVRPs
Can the customer cancel a cVRP?
Yes. They can cancel in their banking app. They will also have the possibility to cancel the mandate on the business’s own site. Regardless of which way, the business is notified as soon as they do.
Does the customer approve every payment?
No. They approve the mandate once. Payments within its limits do not need further approval, though each one is still checked against the mandate terms before it is taken.
Which banks support cVRPs?
The main UK banks support cVRPs today and smaller and newer banks are gradually being added. For more up to date information, reach out to us.
What does VRP stand for in payments?
Variable recurring payments. A VRP is permission, given once by an account holder, for payments of varying amounts to be collected from their bank account within limits they agree.
What is the difference between a VRP and a cVRP?
VRP is the umbrella term. The first VRPs in the UK were sweeping payments between a person’s own accounts. A commercial VRP, or cVRP, lets a customer pay a business, and is governed by an industry-led scheme, the UKPI.
What's the difference between a commercial VRP and a sweeping VRP?
Variable recurring payments (VRPs) let an account holder pre-authorise payments of changing amounts under UK Open Banking. The ‘c’ matters because there are two kinds.
The first VRPs in the UK were sweeping VRPs. They move money between two accounts that belong to the same person. They work well, but the use cases are narrower such as creating automatic transfers to a savings account or topping up accounts to avoid overdrafts.
Is sweeping VRP part of Open Banking?
Yes. Sweeping was the first VRP use case delivered under UK Open Banking. cVRPs apply the same mechanic to paying a business rather than moving money between your own accounts.
What happens if the customer doesn’t have enough money for a cVRP payment?
The business would be notified instantly that the payment would not go through because of insufficient funds.
Who sets the limits on a cVRP mandate, the customer or the business?
The business proposes limits based on expected usage, and depending on the use case the customer can set or adjust them before approving. They see the maximum per payment, the maximum per period and the duration in their banking app, and nothing can be collected outside the limits they agree to.
When will cVRPs be available for subscriptions and e-commerce?
Not yet. Those sectors are expected in Wave 2, to be gradually rolled out in 2027. There is no confirmed date, and UKPI publishes the timetable.
Is a cVRP the same as a Direct Debit?
No. Both collect from a customer’s bank account, but they work differently. A Direct Debit is set up from bank details the customer gives the business, and it collects over Bacs, which takes three working days. A cVRP is approved inside the customer’s own banking app, where they see and agree the limits up front. Each payment runs over Faster Payments, so the funds arrive in seconds and you know straight away whether a payment went through.
.jpg)
