Variable recurring payments: one consent, changing amounts

The consent is the whole product. It names the payee, the account to be debited, the maximum amount of a single payment, a cumulative ceiling over a stated period, how often a payment may be taken, and when the consent ends. The customer approves that once with strong customer authentication at their own bank, and the bank then enforces the limits on every payment that follows.

Two consequences follow for a business. A payment inside the limits goes through without the customer doing anything, which is the direct debit experience over a push rail. A payment outside them is refused by the bank, not by the customer, so a price increase that breaks the ceiling needs a new consent. The customer can also revoke the consent in their own banking app at any moment, which is a stronger and much more visible control than canceling a direct debit mandate.

Sweeping moves money between two accounts belonging to the same person, which is why it is also called me-to-me. The UK Competition and Markets Authority required the nine largest banks to support sweeping, and the live products are savings round-ups, overdraft avoidance, automated loan repayment and offset mortgage sweeps. Nobody argued much about sweeping, because no new money leaves the customer.

Commercial VRP, me-to-business, is where the economics sit and where the argument is. It lets a business collect changing amounts, which makes it a direct substitute for the direct debit and for a card on file. The first commercial phase was deliberately narrow: Modulr sets out the eligible categories as utilities and telecoms, regulated financial services, e-money institutions, government and registered charities, with wider sectors expected later.

Sweeping came first and under compulsion, through the CMA order on the nine largest banks. Commercial VRP has moved more slowly, because it needs something the sweeping mandate did not: a commercial model. A bank asked to let a third party pull money from its customer's account repeatedly wants to be paid for the API call, and the price has not been set industry-wide, as Tink notes. That single open question explains most of the delay.

The regulatory direction has been a multilateral framework, so that each bank does not have to sign a bilateral contract with each provider, with the Financial Conduct Authority taking over the long-term oversight of UK open banking from the CMA regime. For a German or euro-area business the practical reading is simple: the UK is proving the product and discovering the price, and the SEPA version will arrive with that homework already done.

The euro-area work runs under the name Dynamic Recurring Payments, the near-identical SEPA initiative, and commercially under the EPC's SPAA scheme, which is the mechanism for putting a price on a premium API. SPAA exists precisely to answer the question the UK left open: what an asset holder may charge an asset broker for a service beyond the free PSD2 baseline.

PSD3 and the Payment Services Regulation set the legal floor underneath. The package keeps free access to the basic payment initiation and account information services and leaves premium services to commercial agreement, which is what makes SPAA necessary at all. The provisional political agreement on PSD3 and the PSR was reached in November 2025, with application expected around 2028, as the timeline overview records. A subscription business planning a European rollout should assume the direct debit remains its workhorse until then.

Direction first: the direct debit pulls on a mandate the creditor holds, the VRP pushes on a consent the bank holds. That moves the control to the bank and the visibility to the customer, and it removes the creditor's duty to store and prove a mandate document.

Then the operational numbers. A direct debit settles over the clearing in days and can be returned for insufficient funds, with UK industry failure rates of around 2.6 to 3 percent and a per-failure fee that Yapily puts as high as 50 pounds. A VRP settles instantly, and the bank checks the balance before it goes, so the payment either happens or does not without a return cycle. Against that, the SEPA direct debit carries the eight-week refund right under Core, while a VRP payment the customer authorized by consent has no equivalent unconditional refund.

Four things change in the billing system. The mandate store becomes a consent store, holding limits and an expiry instead of a signature. The dunning logic changes, because there is no return file: a refused payment is refused in the moment, and the retry has to be scheduled by the business. The price-change process grows a step, since an increase above the consent ceiling requires a new customer approval. And the reconciliation improves, because each payment arrives as an identified instant transfer.

The coverage question decides whether any of it is worth doing. A consent only works if the customer's bank supports it, so a business needs a fallback for everyone else, which in practice means running the direct debit and the card beside it, as account-to-account payments describes. That is the real cost of early adoption: two collection systems instead of one.

Variable recurring payments are payments taken from a customer's bank account at varying amounts under a single standing consent, initiated over an open banking API. The customer sets a maximum per payment, a cumulative limit and an expiry when approving the consent once, and their bank enforces those limits on every payment after that.

A direct debit is a pull payment on a mandate the creditor holds, settled through the clearing and returnable afterwards. A VRP is a push payment on a consent the customer's bank holds, settled instantly and checked against the balance before it leaves. The VRP gives the customer visible limits and one-click revocation; the direct debit gives the payer an unconditional eight-week refund right under SEPA Core.

Not as a UK-style VRP. German banks provide PSD2 payment initiation, which authenticates each payment, so a standing consent for changing amounts is not generally available yet. The SEPA equivalent is being built as Dynamic Recurring Payments and priced through the EPC SPAA scheme. German subscription businesses collect by SEPA direct debit in the meantime.