Payment Mandate

What Is a Payment Mandate?

A payment mandate is a formal consent document or electronic record through which a payer (the debtor) authorizes a payee (the creditor) to initiate collections from the payer's bank account. Unlike push payments, where the payer triggers each transaction, mandates establish a standing permission for the payee to pull funds on agreed dates and terms. This pull-payment model underpins recurring billing for subscriptions, utility payments, loan repayments, insurance premiums, and most other periodic charges.

The mandate defines the relationship between payer and payee: which account to debit, the frequency and amount (fixed or variable), and the conditions under which collections are permitted. Once signed, it eliminates the need for the payer to approve each individual payment. The mandate remains in effect until the payer revokes it, the payee cancels it, or it expires due to inactivity.

Different jurisdictions use different terms for the same concept. In the UK, mandates are formally called Direct Debit Instructions (DDIs). In Europe, they are SEPA Direct Debit mandates. In the US, the equivalent is an ACH authorization. Despite the naming differences, the core function is identical: granting a payee permission to collect.

How It Works

A payment mandate follows a lifecycle from creation through active collection to eventual termination. While specifics vary by scheme, the general flow is consistent across jurisdictions.

Mandate Lifecycle

1. Creation: the payer completes a mandate form (paper, electronic, or in-app) providing their account details and consent. In some schemes, the payer's bank must also confirm the mandate before it becomes active.
2. Activation: once submitted and accepted by the payer's bank, the mandate enters an active state. The payee can now submit collection requests against it.
3. Collection: the payee initiates debits under the mandate's terms. Each collection references the mandate identifier so the payer's bank can match it to the authorization on file.
4. Amendment: if payment terms change (amount, frequency, or account details), the mandate is amended. Some schemes require new payer consent for amendments, while others allow payee-initiated changes with advance notice.
5. Cancellation or expiry: the payer can revoke the mandate at any time. Payees can also cancel mandates. In most schemes, mandates automatically expire after a period of inactivity, typically 36 months.

Mandate Content Requirements

Regardless of scheme, a valid mandate typically includes:

• Payer identification: name, bank account number, and routing details (sort code, IBAN, or routing number)
• Payee identification: company name, address, and scheme-specific identifiers (Creditor ID, Service User Number, or Company ID)
• Authorization statement: explicit consent language and the payer's signature (wet ink, electronic, or verbal recording)
• Payment terms: amount or formula for variable amounts, collection dates, and frequency
• Unique mandate reference: an identifier linking each collection back to its authorization

Major Mandate Schemes

SEPA Direct Debit (Europe)

The SEPA Direct Debit scheme covers the eurozone and participating countries. It operates in two variants:

• Core (B2C): available to all payers, including consumers. Payers have an eight-week unconditional refund right for authorized transactions and a 13-month window for unauthorized ones. The creditor stores the signed mandate and must send advance notice before each collection.
• B2B: designed for business-to-business payments. The debtor's bank verifies the mandate before processing each debit, and refund rights are heavily restricted. The debtor must provide a signed mandate copy directly to their bank.

SEPA mandates are open-ended but expire automatically after 36 months without a collection. The European Payments Council publishes standardized mandate layout guidelines (currently version 11.0) specifying required fields and formatting.

ACH Authorization (United States)

In the US, ACH debit entries require a valid authorization from the account holder. NACHA, the governing body for the ACH network, recognizes three authorization formats:

• Written: paper or electronic document with the payer's signature, compliant with the E-SIGN Act for digital formats
• Electronic: web-based or in-app consent flows that capture the payer's agreement along with identifying details
• Verbal: recorded phone conversations that include specific disclosures about the amount, timing, and right to revoke

Unlike SEPA mandates, ACH authorizations do not have a standardized form. The originator (payee) is responsible for obtaining and retaining valid authorization, and must produce it if a transaction is disputed. NACHA's 2026 rule updates strengthen fraud monitoring requirements and extend originator responsibilities to cover transactions authorized under false pretenses.

Bacs Direct Debit (United Kingdom)

Bacs Payment Schemes processes Direct Debits in the UK. The mandate form, called a Direct Debit Instruction (DDI), follows a Bacs-approved template that businesses can customize with their branding upon approval.

Key features of the Bacs scheme:

• The Direct Debit Guarantee gives payers an immediate, full refund for any incorrect or fraudulent collection
• Businesses must send advance notice (typically at least 10 working days) before each collection, specifying the amount and date
• Name verification rules require checking that the account name matches the mandate details
• Payers can cancel at any time through their bank, and the payee must stop collections immediately

Variable Recurring Payments (Open Banking)

Variable Recurring Payments (VRPs) represent the evolution of mandates within open banking frameworks. Pioneered in the UK, a VRP lets a third-party provider initiate multiple payments from a customer's bank account within preagreed parameters: maximum amount per payment, maximum cumulative amount, frequency, and expiry date.

Unlike traditional mandates where the payee has broad discretion, VRP parameters are set by the customer and enforced by the bank. The customer can revoke authorization at any time. Sweeping VRPs (moving funds between a customer's own accounts) are live in the UK, while commercial VRPs for merchant payments are still in development.

Traditional Mandates vs. Crypto Alternatives

Blockchain networks are inherently push-based: only the holder of a private key can authorize a transaction from their account. There is no built-in mechanism for a payee to pull funds on a schedule. This design makes cryptocurrency self-custodial by default, but it also means that native recurring billing requires workarounds.

ERC-20 Token Approvals

The closest crypto equivalent to a mandate is the ERC-20 token approval mechanism. A token holder calls the approve function to grant a smart contract permission to spend up to a specified amount via transferFrom:

// Payer approves a subscription contract to pull up to 100 USDC
token.approve(subscriptionContract, 100 * 10**6);

// The subscription contract can then pull funds
token.transferFrom(payer, payee, monthlyAmount);

This pattern enables pull payments, but it differs from traditional mandates in important ways. Approvals lack time-based constraints, frequency limits, or per-transaction caps: they grant a single spending ceiling that the approved contract can drain in one call. Many users set "unlimited" approvals for convenience, creating a persistent risk if the approved contract is compromised.

Emerging Standards

The limitations of basic approvals have driven new proposals. ERC-8187 ("Token Puller"), drafted in February 2026, introduces an approvePull function with built-in rate limits, time windows, and allowance delegation. It targets recurring subscription payments and scheduled collections with more granular payer control. EIP-2612 introduced gasless permit signatures that allow approvals without on-chain transactions, reducing the friction of setting up recurring authorizations.

These approaches attempt to replicate the mandate model: payer-authorized, payee-initiated, bounded collections. However, they operate in a fundamentally different trust environment. On-chain mandates are enforced by code, not by banks or payment schemes, making them transparent and auditable but also irreversible once executed.

Stablecoin Recurring Payments

The intersection of mandates and crypto is most visible in stablecoin recurring payment infrastructure. Stablecoin-based subscription systems use smart contract approvals or account abstraction session keys to enable automatic periodic debits from a user's wallet. Platforms built on Spark can leverage programmable payment flows to create mandate-like authorization structures for Bitcoin and stablecoin payments.

Use Cases

• Subscription services: streaming platforms, SaaS tools, and membership programs use mandates to collect monthly or annual fees without requiring customers to approve each charge
• Utility and telecom billing: energy, water, internet, and phone providers rely on direct debit mandates to collect variable amounts each billing cycle
• Loan repayments: lenders use mandates to ensure scheduled repayments are collected automatically, reducing default rates and administrative costs
• Insurance premiums: insurers collect regular premiums via mandates, often offering discounts for customers who pay by direct debit
• B2B trade payments: SEPA B2B mandates allow businesses to automate supplier payments and receivables collection across the eurozone
• Government and tax collection: tax authorities in several jurisdictions use mandate-based collections for periodic tax installments

Risks and Considerations

Unauthorized Collections

A compromised or fraudulent mandate can result in unauthorized debits from a payer's account. While consumer protection schemes like the Direct Debit Guarantee and SEPA refund rights provide recourse, the burden of detecting unauthorized collections often falls on the payer. Dispute windows vary by scheme: 8 weeks for authorized SEPA Core debits, 13 months for unauthorized ones, and 60 days under NACHA rules for consumer ACH.

Mandate Fraud

Fraudsters may forge mandates using stolen bank details or social engineering. NACHA's 2026 rules specifically address "transactions authorized under false pretenses," requiring both originating and receiving institutions to monitor for fraud. In the UK, Bacs now requires account name verification to reduce mandate fraud.

Cancellation Friction

Revoking a mandate can be more difficult in practice than in theory. Consumers may need to contact both the payee and their bank to ensure collections stop. Failed cancellations can result in continued debits and subsequent dispute proceedings, creating friction that favors the collecting party.

Smart Contract Approval Risks

In the crypto context, token approvals carry risks that traditional mandates do not. An unlimited approval to a compromised contract can drain a wallet entirely. Unlike bank mandates, there is no chargeback mechanism or refund guarantee. Users must actively manage and revoke approvals, a responsibility many overlook. Tools like revoke.cash help users audit outstanding approvals, but the default-open nature of the ERC-20 pattern inverts the protections that traditional mandate schemes provide.

Cross-Border Complexity

Mandates do not travel easily across payment rails. A SEPA mandate cannot pull funds from a US bank account. A Bacs DDI does not work in the eurozone. This fragmentation is one reason account-to-account payment rails and stablecoins are converging: programmable money on global networks sidesteps jurisdictional boundaries, though it introduces its own regulatory and technical challenges.

Mandates and the Future of Payments

The mandate model is evolving in two directions. In traditional finance, open banking frameworks like VRPs are giving payers more granular control over authorizations, replacing coarse "pay anything" mandates with parameter-bounded permissions. In crypto, emerging token standards and account abstraction are recreating mandate-like functionality on-chain, bridging the gap between self-custodial wallets and recurring payment initiation.

Both trajectories point toward the same destination: payment mandates that are payer-controlled, programmatically enforced, and interoperable across networks. The challenge lies in building these systems without sacrificing the consumer protections that traditional mandate schemes have refined over decades.

This glossary entry is for informational purposes only and does not constitute financial or investment advice. Always do your own research before using any protocol or technology.