What are open banking VRPs? A complete guide for UK businesses

If you run a subscription business or accept recurring payments in the UK, Variable Recurring Payments (VRPs) are about to change how you get paid.

Variable Recurring Payments (VRPs) are a new type of payment instruction powered by open banking infrastructure that allows customers to authorise businesses to collect payments directly from their bank account, within limits and parameters that the customer controls.

Instead of storing card details or setting up a traditional Direct Debit, your customers connect their bank account through their banking app. They set the rules - how much, how often, when it expires - and payments happen automatically within those boundaries. No card details, no re-authentication every time, no expired cards impacting your recurring revenue.

• Built on UK open banking infrastructure.
• Customer sets maximum payment amounts and frequency.
• Strong Customer Authentication (SCA) required once at setup.
• Payments run on Faster Payments rails (instant settlement).
• Payments can vary in amount without requiring the customer to re-authenticate.

• 1. Sweeping VRPs: Moving money between your own accounts (already available across all major UK banks).
• 2. Commercial VRPs (cVRPs): Payments from customers to businesses (this is what matters for merchants accepting recurring payments, and it's rolling out in phases from mid-2025 ).

This guide focuses on commercial VRPs - the ones that will transform how you collect subscription and recurring payments.

Open banking launched in the UK in January 2018 , mandated by the Competition and Markets Authority (CMA) to break up banking monopolies and increase competition. VRPs represent the next evolution of that infrastructure - taking open banking from one-off payments to true recurring commerce.

Traditional recurring payment methods, such as Direct Debits and card payments, create friction for everyone:

For customers:

• Limited visibility into what they've authorised.
• Difficult cancellation processes.
• Unexpected amounts charged without warning.
• No real-time control.

For merchants::

• High fees (especially cards at 1.5-3%+ per transaction).
• Slow settlement (3-5 days for cards, 3 days for Direct Debit).
• Payment failures from card expiry (a major cause of subscription churn).
• Costly chargebacks and disputes.

The CMA mandated the UK's nine largest banks (CMA9) to implement VRP capabilities, starting with sweeping in July 2022 . In 2023-2024, the Financial Conduct Authority (FCA) and Payment Systems Regulator (PSR) developed the framework for commercial VRPs through an industry working group.

In January 2025, the FCA stated : "Variable recurring payments will help consumers to take greater control of their regular payments... by allowing customers to control how much can be paid at one time or over the course of a month."

HM Treasury's National Payments Vision emphasises VRPs are "likely to provide benefits for these use cases – for example, by giving consumers greater visibility, flexibility and control of the amounts and timings of their payments than alternatives such as Direct Debit."

• March 2025: 3.7 million VRP transactions in one month alone.
• Active users: 13.3 million UK consumers now use open banking .
• Current availability: Sweeping VRPs available from all CMA9 banks; commercial VRPs in limited rollout.
• Phase 1 (mid-2025): Commercial VRPs for regulated utilities, government payments, and financial services.
• Phase 2: Broader availability for general e-commerce and subscriptions (timeline to be confirmed by regulators).

VRPs combine three core technologies to create a secure, instant payment experience:

• 1. Open banking APIs: Secure, standardised connections between banks and payment providers, regulated under Payment Services Regulations 2017 and PSD2.
• 2. OAuth 2.0 authentication: Industry-standard security protocol ensuring customers never share credentials with merchants.
• 3. Faster Payments: The UK's real-time payment infrastructure, delivering same-day settlement.

From the customer's perspective:

• 1. At checkout, the customer selects ‘Pay by bank’ or a similar VRP payment option.
• 2. Customer is redirected to their banking app or online banking.
• 3. They authenticate with their bank using Strong Customer Authentication (e.g., fingerprint + password, or face ID + PIN).
• 4. Customer reviews and sets payment parameters:
  
  
  • Maximum amount per payment: £50.
  • Maximum per month: £200.
  • Frequency: Weekly.
  • Expires: 31 December 2027.
  • Payee: [Your business name].
• 5. Customer confirms consent.
• 6. They're returned to your site, with setup complete in under 60 seconds.

From the merchant's perspective:

• 1. Customer initiates VRP through your payment service provider (PSP).
• 2. Your PSP (acting as a Payment Initiation Service Provider) handles the secure bank connection via open banking APIs.
• 3. Customer authenticates and sets parameters via their bank.
• 4. Your PSP receives consent confirmation and stores the mandate securely.
• 5. Subsequent payments are processed automatically when due - no further customer action required.

This is where VRPs shine compared to traditional methods:

• 1. Your payment provider initiates the payment via open banking API when a payment is due.
• 2. The customer's bank checks the payment is within their predefined parameters.
• 3. If approved, the payment processes immediately with no additional authentication.
• 4. Funds are transferred via Faster Payments.
• 5. You receive settlement near-instantly (same day).
• 6. Customer sees the transaction in their banking app with full transparency.

No further authentication is required as long as payments stay within the agreed parameters. This is fundamentally different from card payments, where SCA can be triggered unpredictably, causing friction and payment failures.

Unlike Direct Debits, where control is limited, customers can access their VRP mandates at any time in their banking app to:

• View all active payment agreements across all merchants.
• See complete payment history.
• Adjust maximum amounts or frequency in real-time.
• Pause payments temporarily.
• Cancel instantly (up to the point of settlement).

This level of control is why VRPs align with modern consumer expectations. Research shows consumers increasingly value transparency and control over automated payments. VRPs deliver both.

VRPs address several major security concerns inherent in traditional payment methods:

• No stored credentials: Merchants never see or store bank account details, drastically reducing data breach risk and PCI DSS (Payment Card Industry Data Security Standard) compliance burden.
• Strong Customer Authentication at setup: SCA reduces fraud from the outset.
• 29x lower fraud rates: Account-to-account payments have fraud rates 29 times lower than card payments .
• Encryption & tokenization: All data is protected throughout the payment journey using bank-grade security.
• Customer-defined limits: Built-in protection against unexpected charges, as customers set the boundaries.

VRPs bypass card networks entirely. That means no interchange fees, no scheme fees, no acquirer markup. This means that VRPs could help reduce processing fees for businesses.

While final pricing structures are still being established by the industry , the cost structure is fundamentally different from cards (1.5-3%+).

For subscription businesses processing thousands or millions of transactions annually, even a 1% saving per transaction translates to a substantial cost reduction.

As with most open banking payments, it’s expected that funds will arrive same-day via Faster Payments, compared to 3-5 days for card payments and 3 days for Direct Debits.

For growing businesses, this isn't just convenient - it's transformative:

• Improved cash flow management: Money arrives when you need it, not days later.
• Reduced working capital requirements: Less cash tied up waiting for settlement.
• Better financial planning: Predictable, same-day settlement simplifies forecasting.
• Accelerated growth: Reinvest revenue faster into marketing, inventory, or product development.

VRPs don't have a chargeback mechanism like cards. This means:

• No chargeback fees (typically £15-25 each, plus operational costs).
• No lost revenue from disputed transactions where the customer receives both a refund and keeps the product/service.
• Reduced operational burden from chargeback management and representation.
• No risk of entering card scheme penalty programmes like Visa's Acquirer Monitoring Programme (VAMP).

Important note: Alternative dispute resolution processes are being developed by the VRP Working Group. These are designed to be faster, more transparent, and less costly than traditional chargebacks—with clearer outcomes for both merchants and consumers.

Two of the biggest causes of recurring payment failures are eliminated with VRPs:

• 1. Card expiry: Bank accounts don't expire. Cards do, every 3 years. For subscription businesses, card expiry is consistently one of the top causes of involuntary churn.
• 2. Authentication friction: With VRPs, SCA happens once at setup, not for every payment. This removes a major source of technical failures and customer frustration.

The result? Lower subscription churn, more predictable recurring revenue, and elimination of costly retry logic and dunning management for expired card scenarios.

VRPs handle variable amounts within predefined limits without requiring re-authentication. This makes new business models practical that would be friction-heavy with cards:

• Usage-based billing: Charge customers based on what they actually use (like utilities, cloud services, mobility apps).
• Tiered subscriptions with variable add-ons: Base subscription plus variable usage fees, all in one flexible payment.
• Dynamic pricing based on consumption: Adjust pricing month-to-month based on customer behaviour or market conditions.
• Flexible instalment plans: Create customer-friendly payment schedules with varying amounts.

Traditional cards struggle with variable recurring amounts because each variation may trigger authentication requirements. Direct Debits handle variable amounts but lack transparency as customers can't easily see what they've authorised. VRPs solve both problems.

Friction kills conversions and increases churn. VRPs reduce friction at multiple points:

• Faster checkout: No need to type in 16-digit card numbers, expiry dates, CVV, or billing addresses.
• Greater transparency: Full visibility of payment agreements in their familiar banking app.
• More control: Adjust or cancel anytime without calling customer service or navigating your website.
• No surprise charges: Because customers set the limits, they know exactly what to expect.

This aligns perfectly with the modern consumer expectation for control over recurring payments.

Better experience = lower churn = higher customer lifetime value.

Because you're not storing card data, your PCI DSS compliance requirements are significantly reduced. This lowers both risk and operational costs:

• Smaller compliance scope: No card data means fewer systems in scope for PCI DSS.
• Lower audit costs: Simpler compliance requirements mean less expensive annual assessments.
• Reduced data breach liability: No stored card data means dramatically lower risk if systems are compromised.
• Simpler GDPR compliance: Less sensitive personal data to manage and protect.

Direct Debit is deeply embedded in UK payments infrastructure. Here's how VRPs differ:

When to use each:

• Direct Debit: Fixed regular bills (utilities, insurance, council tax) where customers expect the traditional method and amounts are predictable.
• VRP: Variable recurring payments, subscriptions, any scenario where customer control, transparency, and faster settlement add competitive value.

Cards dominate online payments but have inherent limitations for recurring charges:

When to use each:

• Cards: One-off purchases, international payments, scenarios requiring broad global acceptance.
• VRP: Recurring domestic payments, subscriptions, any scenario where transaction cost and settlement speed provide a competitive advantage.

Digital wallets are popular in the UK. 63% of consumers use Apple Pay, 37% use Google Pay, and 36% use PayPal, but they typically still use cards as the underlying payment method:

Digital wallets are an interface layer on top of existing payment methods (usually cards). VRPs are a fundamentally different payment rail optimised specifically for recurring transactions. In the future, VRPs could potentially integrate with digital wallet interfaces, combining the convenience of wallets with the economics and functionality of open banking.

VRPs aren't just another payment method — they enable business models that would be friction-heavy with traditional rails.

Perfect fit for:

• SaaS products and software licences.
• Streaming services (video, music, podcasts).
• Meal kits and physical subscriptions.
• Gym and fitness memberships.
• Professional memberships and associations.

Why VRPs excel here: No card expiry means lower involuntary churn. Customers feel more in control, which reduces voluntary churn. You save on transaction fees and eliminate chargeback risk.

Ideal for:

• Utilities (energy, water), where charges vary by consumption.
• Cloud computing and hosting services.
• Mobile phone contracts with variable data charges.
• Co-working spaces with flexible usage models.

Why VRPs excel here: Variable amounts within predefined limits don't require re-authentication. Customers see exactly what they're being charged in real-time via their banking app, building trust.

Works well for:

• Instalments for the purchase of high-value items.
• Flexible repayment schedules that adjust based on customer circumstances.
• Variable payment plans for education, healthcare, and professional services.

Why VRPs excel here: More flexible than rigid BNPL products, with transparency built in. Customers set their own limits, which improves completion rates.

Suitable for:

• SaaS and enterprise software licences.
• Regular supplier payments and invoices.
• Service retainers (legal, accounting, consulting).
• Managed services with variable fees.

Why VRPs excel here: Instant settlement improves cash flow for suppliers. Lower fees than cards make it attractive for high-value B2B transactions. Transparency and control appeal to procurement teams.

Suitable for:

• SaaS and enterprise software licences.
• Regular supplier payments and invoices.
• Service retainers (legal, accounting, consulting).
• Managed services with variable fees.

Why VRPs excel here: Instant settlement improves cash flow for suppliers. Lower fees than cards make it attractive for high-value B2B transactions. Transparency and control appeal to procurement teams.

Currently rolling out for:

• HMRC tax payments (already processed £4.7 billion via open banking in January 2024 ).
• Council tax and fees.
• Regulated financial services (FCA-regulated entities).
• Regulated utilities (energy, water companies).

Why VRPs excel here: Consumer protection is paramount in regulated sectors. VRPs provide enhanced transparency and control while reducing costs for both providers and consumers.

Currently rolling out for:

• Charity and donations: Flexible recurring donations that donors can adjust based on their circumstances.
• Mobility and transport: Fare collection for ride-hailing, bike shares, scooters, creating seamless payment experiences.
• Digital services: Gaming, in-app purchases, content platforms with variable consumption.

Commercial VRPs are initially being rolled out to "lower-risk" sectors where strong consumer protections already exist:

• Regulated utilities: Energy and water companies.
• UK government payments: Tax, council fees, government services.
• Regulated financial services firms: FCA-authorised and regulated entities.

The rationale for this phased approach: Allow the industry to develop sustainable commercial models, test operational processes, and build consumer confidence before broader rollout.

Following Phase 1, regulators (FCA and PSR) will assess learnings and determine Phase 2 scope and timing for:

• General e-commerce.
• Subscription businesses (media, SaaS, consumer subscriptions).
• Unregulated recurring payments.

Timeline: To be confirmed by regulators. Industry observers expect late 2025 or 2026, depending on Phase 1 outcomes.

If you operate in Phase 1 sectors

Commercial VRPs are becoming available now. Speak with your payment service provider about integration timelines and capabilities.

If you're in e-commerce or subscriptions

VRP infrastructure is being built and tested. While you can't accept commercial VRPs yet, understanding the technology and preparing your payment stack will position you to move quickly when Phase 2 opens.

All merchants

The direction is clear. Regulators, banks, and payment providers are all investing in VRP infrastructure. The question isn't if VRPs will become mainstream, but when - and whether your business will be ready.

You won't integrate directly with banks. Instead, you'll work with a Payment Initiation Service Provider (PISP) or a payment service provider that offers VRP capabilities. Ecommpay's open banking solution provides a single integration to access multiple banks across the UK and Europe.

Accepting VRPs requires:

• API integration with your payment provider's VRP endpoint.
• Checkout flow updates to offer VRP as a payment option alongside cards, Direct Debit, etc.
• Backend system adjustments to handle instant settlement (faster than you're used to with cards).
• Customer communication about the new payment option—education drives adoption.

Your PSP handles the complex parts: bank connections, security, authentication flows, compliance, and mandate management.

VRPs are new to most UK consumers. Clear communication about benefits helps drive adoption:

• Control: "Set your own spending limits".
• Transparency: "See every payment in your banking app".
• Security: "No card details stored".
• Convenience: "Authenticate once, then automatic".

Early adopters who invest in customer education see higher VRP adoption rates and lower support queries.

VRPs are regulated under the Payment Services Regulations 2017 and PSD2. Your payment provider handles most compliance requirements, but you should understand:

• Data protection obligations: GDPR applies. Ensure your PSP is compliant.
• Customer consent requirements: Clear, unambiguous consent is mandatory.
• Notification requirements: If you need to adjust payment parameters beyond the original mandate, you'll need customer approval.
• Record keeping: Maintain records of customer consents and transactions.

While VRPs don't have traditional card chargebacks, dispute resolution processes are being established by the VRP Working Group. These are designed to be:

• Faster than card chargebacks (which can take 30-90 days).
• More transparent for both merchants and consumers.
• Lower cost than traditional dispute mechanisms.

Work with your payment provider to understand the framework and how disputes will be managed.

An independent central operator is being established by Open Banking Limited to coordinate VRP standards, dispute resolution mechanisms, and operational guidelines across the industry. This infrastructure will support broader adoption and ensure consistency as commercial VRPs scale.

Pricing structures are being developed through industry collaboration.

Industry stakeholders emphasised the need for pricing that:

• Incentivises bank participation and investment.
• Remains attractive to merchants compared to cards.
• Supports Payment Initiation Service Provider (PISP) sustainability.
• Encourages innovation and competition.

However, in January 2026, the FCA and PSR issued a joint update clarifying that they will ‘not prioritise a Competition Act 1998 (CA98) investigation into the centralised ‘access fee’ pricing model being developed by the UK Payments Initiative (UKPI) for commercial Variable Recurring Payments (cVRPs)’.

Following Phase 1, regulators will assess:

• Adoption rates in Phase 1 sectors.
• Consumer protection outcomes.
• Operational effectiveness of dispute resolution.
• Commercial model sustainability.
• Industry readiness for broader rollout.

Based on those assessments, Phase 2 scope and timing will be announced—likely covering general e-commerce, subscriptions, and unregulated recurring payments.

The UK is ahead of other jurisdictions on VRP implementation. The European Union, the United States, and other markets are watching the UK's progress as a potential model.

This puts UK merchants in a unique position: early access to cutting-edge payment technology that could become a global standard in the coming years.

Yes. VRPs require Strong Customer Authentication at setup (two-factor authentication using something you know, something you have, or something you are). All connections use encrypted bank-grade security. Merchants never see or store sensitive financial data. Account-to-account payments have fraud rates 29 times lower than card payments.

Yes, and that's a feature, not a bug. Customers can cancel VRP mandates instantly through their banking app, right up until the point of settlement. This gives customers more control than traditional Direct Debits (which require at least one day's notice) and is far easier than cancelling card-on-file arrangements (which typically require contacting the merchant).

This increased control actually benefits merchants: research shows that transparency and control reduce voluntary subscription churn.

If a payment exceeds the customer's predefined parameters (e.g., £55 when the limit is £50) or insufficient funds exist in the account, the payment fails. Your payment provider notifies you immediately, and you can contact the customer to resolve the issue—just as you would with any failed recurring payment.

The difference: VRP failure rates should be lower than cards because there's no card expiry, no authentication friction, and customers have set clear expectations about amounts.

Customers need an account with a bank that supports VRPs. All major UK banks are implementing VRP capabilities, starting with the CMA9 (Lloyds, RBS/NatWest, Barclays, HSBC, Santander, Nationwide, Bank of Ireland, AIB, Danske). Smaller banks and challengers are expected to follow as VRP adoption grows.

Your payment provider handles bank compatibility, so you don't need to worry about which banks your customers use.

VRPs are designed specifically for recurring payments. For one-off open banking payments, standard Payment Initiation Services (PIS) are more appropriate. Ecommpay's open banking solution supports both one-off and recurring open banking payments.

Refunds are processed as standard bank transfers back to the customer's account using open banking infrastructure or traditional payment rails. The process is typically faster than card refunds (which can take 5-10 days to appear in customer accounts), with funds arriving in 1-2 business days.

Currently, VRPs are UK-specific. The European Union is watching the UK's implementation closely, but no equivalent functionality exists under PSD2 yet. The upcoming PSD3 framework may include similar capabilities, but that's still in development.

For now, UK merchants can use VRPs for domestic recurring payments. For international payments, cards and digital wallets remain the dominant options.

VRPs don't replace cards, Direct Debit, or digital wallets. Instead, they give you another option to offer customers, particularly for recurring and subscription payments, where VRPs' benefits are most pronounced.

Many merchants will offer VRPs alongside existing methods, letting customers choose what works best for them. Over time, as consumer awareness grows, VRP adoption may increase at the expense of cards and Direct Debit for recurring payments.

Want to explore how VRPs fit into the broader transformation of payments? Check out our related resources on open banking and recurring payments.

Related resources:

• Open banking payment solutions from Ecommpay.
• Subscription and recurring payment management.
• How does open banking benefit businesses?
• What is a recurring payment?
• Fix failed subscription payments with network tokenization.
• Reducing subscription churn with intelligent recovery.
• Drive more conversions with open banking solutions.