Variable Recurring Payment (VRP)

What Is a Variable Recurring Payment?

A variable recurring payment (VRP) is a type of account-to-account payment where a customer authorizes a third-party provider to initiate payments of varying amounts on a flexible schedule, directly from their bank account. Unlike a direct debit or card-on-file subscription where the merchant controls timing and amount, a VRP operates within strict, customer-defined boundaries enforced by the customer's bank in real time.

The customer authenticates once using strong customer authentication (SCA) to set up the consent. From that point forward, payments can be initiated without re-authentication, as long as each transaction falls within the agreed parameters: maximum amount per payment, cumulative limits over a period, frequency, and validity dates. The customer can revoke consent at any time through their banking app.

VRPs were introduced as part of the UK's open banking framework, mandated by the Competition and Markets Authority (CMA) in 2022. They represent a fundamental rethinking of how recurring billing works: instead of storing card credentials or relying on batch processing cycles, payments flow over real-time payment rails with bank-level security and customer-controlled limits.

How It Works

VRPs involve three parties: the customer, their bank (the Account Servicing Payment Service Provider, or ASPSP), and a regulated Payment Initiation Service Provider (PISP) acting on behalf of the merchant. The process has two phases.

Consent Setup

During setup, the PISP creates a consent request with the customer's bank, specifying the parameters the customer will authorize:

1. The PISP submits a consent request to the bank's VRP API
2. The customer is redirected to their bank's authentication flow
3. The customer reviews and approves the consent parameters using SCA
4. The bank stores the consent and returns an authorization to the PISP

The consent parameters define the boundaries for all future payments under this authorization:

// VRP consent parameters (Open Banking API v4.0)
{
  "ControlParameters": {
    "ValidFromDateTime": "2026-06-15T00:00:00Z",
    "ValidToDateTime": "2027-06-15T00:00:00Z",
    "MaximumIndividualAmount": {
      "Amount": "250.00",
      "Currency": "GBP"
    },
    "PeriodicLimits": [
      {
        "PeriodType": "Month",
        "PeriodAlignment": "Calendar",
        "Amount": "500.00",
        "Currency": "GBP"
      }
    ]
  }
}

Payment Execution

Once consent is established, the PISP can initiate individual payments without the customer needing to re-authenticate:

1. The merchant triggers a payment request to the PISP
2. The PISP submits the payment to the bank via the VRP API
3. The bank validates the payment against the consent parameters in real time
4. If within bounds, the bank executes the payment over Faster Payments (settling in seconds)
5. If the payment exceeds any limit, the bank rejects it immediately

This model means the bank acts as a real-time enforcement layer. Every payment is validated against the maximum individual amount, cumulative periodic limits, and consent validity dates before funds move. The customer does not need to approve each transaction, but the bank guarantees no transaction exceeds their pre-agreed boundaries.

Sweeping vs Commercial VRPs

The UK distinguishes between two types of VRP. Sweeping VRPs handle "me-to-me" transfers: moving money between a customer's own accounts, such as shifting surplus funds from a current account to savings. These were mandated for the nine largest UK banks (the CMA9) in July 2022.

Commercial VRPs (cVRPs) allow payments to third-party merchants and billers. On 2 June 2026, the UK Payments Initiative (UKPI) launched Wave 1 of the commercial VRP scheme, covering payments to regulated utilities, telecoms, financial services, and government entities. Wave 2, expected in H2 2026, will extend to general e-commerce. This launch marked the first new UK payment scheme since Faster Payments debuted in 2008.

VRPs Compared to Other Payment Methods

Understanding VRPs requires comparing them to the payment methods they aim to replace or complement:

The most significant differences are cost and speed. Card-on-file payments incur interchange fees and scheme fees that typically total 1.5% to 3.5% of the transaction value. VRPs use flat per-transaction pricing (expected in the tens of pence regardless of amount), making them dramatically cheaper for higher-value recurring payments. For a deeper analysis of how account-to-account payments are reshaping billing, see the account-to-account payments revolution research.

Use Cases

Subscription Billing

Usage-based subscriptions (cloud services, utilities, mobile plans) are a natural fit for VRPs. The customer sets a monthly cap, and the provider bills the actual usage amount each cycle. No card expiry issues cause involuntary churn, and instant settlement improves cash flow for the merchant.

Utility and Telecoms Payments

Energy bills, water bills, and phone plans vary month to month. VRPs let providers collect the exact amount owed without requiring customers to manually approve each payment. Wave 1 of the UK's commercial VRP scheme specifically targets these sectors.

Savings Automation

Sweeping VRPs enable "round-up" savings, surplus sweeping, and automated debt repayment. Fintech apps can move varying amounts between a customer's accounts based on spending patterns, balance thresholds, or savings goals.

Investment Top-Ups

Regulated financial services can use VRPs for variable investment contributions. Customers set a maximum monthly limit and their investment platform contributes amounts based on market conditions or preset rules.

Why It Matters

VRPs represent a structural shift in how recurring payments work. By moving billing from card networks and batch-processing systems to real-time, bank-native payment rails, they reduce costs, eliminate card data storage liability (removing PCI-DSS compliance burden), and give customers granular control over what leaves their account.

For the broader payments ecosystem, VRPs accelerate the shift toward open banking infrastructure. The EU is following the UK's lead: the SEPA Payment Account Access (SPAA) scheme introduces "Dynamic Recurring Payments" as a premium API service, and PSD3 (published April 2026) creates the regulatory framework for VRP-like capabilities across EU member states, with compliance expected by late 2027.

The parallels to crypto payment innovation are notable. VRP consent parameters function similarly to smart contract token approvals: both encode payment rules at the infrastructure level rather than relying on intermediaries. Stablecoin recurring billing platforms offer similar variable-amount, pre-authorized payment flows on blockchain rails, with near-instant settlement and no card network dependency. As stablecoin payment rails mature, they could serve the same use cases as VRPs for cross-border and multi-currency scenarios where traditional open banking frameworks have limited reach. For more on how programmable payment rails are evolving, see the research on programmable money and stablecoin payment rails vs traditional infrastructure.

Risks and Considerations

No Direct Debit Guarantee Equivalent

The UK's Direct Debit Guarantee provides an immediate, no-questions-asked refund if a direct debit is taken in error. VRPs do not have an equivalent blanket guarantee. Consumer protection falls under the Payment Services Regulations 2017 (Part 7), which covers unauthorized payments but does not provide the same automatic recourse for disputes about authorized payments.

Limited Bank Coverage

Only the CMA9 banks are mandated to support VRPs. While this covers approximately 75% of UK current accounts, customers at smaller banks and building societies may not have access. Voluntary adoption beyond the CMA9 is growing but uneven.

Consent Lifecycle Management

VRP consents have expiry dates and parameter boundaries that may need updating as subscription prices change or customer circumstances shift. Businesses must build robust re-consent flows to handle expirations, parameter updates, and edge cases where a payment legitimately exceeds the originally agreed limits.

Consumer Awareness

Most consumers are unfamiliar with VRPs as a payment method. The redirect to the bank's authentication flow during setup is a different experience from entering card details, and conversion rates during the consent flow remain a concern for merchants. Clear UX design and consumer education are critical for adoption.

Geographic Limitations

VRPs are currently a UK-specific payment type. The EU's Dynamic Recurring Payments under SPAA and PSD3 will bring similar capabilities to the eurozone, but implementation timelines extend to late 2027. Markets without open banking mandates, including the United States, lack the regulatory foundation for VRPs entirely.

This glossary entry is for informational purposes only and does not constitute financial or investment advice. Always do your own research before using any protocol or technology.