For roughly forty years, the way Britons paid the gas bill, the gym and the mortgage barely changed. You signed a direct debit mandate, the biller pulled the money, and if anything went wrong the Direct Debit Guarantee gave you an instant, no-questions refund from your own bank. That bargain is now being challenged by something most people have never heard of: the variable recurring payment, or VRP, built on the open banking rules that came out of the 2017 Competition and Markets Authority order.
VRP is not a tweak to the direct debit. It is a different kind of plumbing entirely. Instead of a biller reaching into your account on a schedule, you grant a tightly scoped permission that lets a named party take payments within limits you set yourself — a maximum per transaction, a maximum per month, and an end date. The payment then travels over Faster Payments in seconds rather than the three working days a direct debit needs to clear. The interesting part is what this hands back to you: the controls live in your own banking app, not in a mandate sitting on the biller's side. And because those limits are enforced by your bank in real time, a request that breaks them never reaches your balance in the first place. That single shift — from refund-after to refusal-before — is the whole story of why anyone is bothering to build this.
What VRP actually is, and how it differs from a direct debit
Think of VRP as a standing instruction with guardrails. When you authorise one, your bank records exactly who can collect, how much, and how often — and it will reject anything that breaches those parameters automatically. A direct debit, by contrast, lets an approved biller request almost any amount; your protection comes after the fact, through the Guarantee, rather than before it through hard limits.
There are two flavours, and the distinction matters enormously for what you can do today versus what is still arriving.
Sweeping VRP — already live and free
Sweeping is the version that regulators mandated the UK's nine largest banks to offer, and it has been switched on across the CMA9 since 2022. It only moves money between accounts in your own name — for example, shifting spare cash from your current account into a higher-paying savings account, or topping up an account to dodge an overdraft charge. Because the money never leaves your control, the banks are not allowed to charge for it. Apps such as Chip and Plum lean on sweeping to move your money around without the old card-based faff.
Commercial VRP — the one that replaces card-on-file and direct debits
Commercial VRP lets a third party — a subscription service, an energy supplier, a brokerage — take recurring payments from you. This is the version with genuine disruptive weight, because it competes directly with both the direct debit and the card stored on file at every streaming service and online shop. The catch is that it is not free and not yet universal: it runs on commercial agreements between banks and providers rather than a regulatory mandate, and the rollout through 2025 and into 2026 has been deliberate, starting with lower-risk areas before it reaches the messier corners of recurring billing.
Why anyone would bother switching
The pitch is control, and for once the pitch is largely honest. With a card on file, you are trusting a merchant to behave: free trials that quietly convert, prices that creep up at renewal, and the grim ritual of hunting through account settings to cancel something. VRP inverts that. Revocation is instant and lives with you — you cancel the permission in your banking app and the collecting party simply cannot pull again, with no need to phone anyone or wait for a billing cycle to end.
It also kills the card-expiry shuffle. Every time your debit card is reissued after the three-year expiry or a fraud reissue, every card-on-file subscription breaks until you update it, and you end up re-entering the same 16 digits across a dozen accounts. VRP is tied to your account, not a card number that changes, so none of that breakage happens. Payments arrive in real time, so a supplier sees cleared funds in seconds, which in turn opens the door to fairer pricing for paying instantly rather than on a delayed direct debit. For anyone who has watched a Netflix payment fail because their bank reissued a card after a skimming scare, the appeal is immediate and concrete. There is a quieter benefit too: because each permission is named and scoped, your banking app becomes a single honest list of everything that can take money from you, which is more than most people can say about the cards scattered across their online accounts. That visibility alone is worth something to anyone who has discovered a forgotten subscription only when the annual charge lands.
The protection gap nobody advertises
Here is the part the cheerful fintech press releases skate over. The Direct Debit Guarantee — that famous promise of a full, immediate refund if a payment is taken in error — does not apply to VRP. There is no statutory equivalent. If a commercial VRP collects the wrong amount, you are relying on the bank's own dispute process and the protections in the Payment Services Regulations 2017, not the simple guaranteed reversal you would get from a botched direct debit.
That does not leave you defenceless. An unauthorised payment — one that breaches the limits you set, or one you never agreed to — must be refunded by your bank under the same rules that cover any unauthorised transaction. But a disputed payment that fell within your agreed limits is a murkier affair, settled through a complaint and, if that fails, the Financial Ombudsman Service. This is the genuine trade-off, and it deserves to be said plainly rather than buried: you are swapping a strong, well-understood after-the-fact guarantee for strong before-the-fact controls. Whether that is a good deal depends entirely on how much you trust your own limit-setting versus your bank's refund desk. For a £9.99 subscription the risk is trivial; for a four-figure monthly payment it is anything but, and the absence of a guaranteed reversal should weigh on the decision.
Where you can actually use VRP in 2026
Sweeping is the easy win and you may already be using it without noticing. If you hold an account with any of the CMA9 — Barclays, Lloyds, HSBC, NatWest, Santander, Nationwide, Danske, Bank of Ireland or AIB — and you use a savings or budgeting app that moves money between your accounts, that is almost certainly sweeping VRP under the bonnet. Set it up the next time your app offers to "automatically move spare cash"; there is no downside, since the money stays in your name and the service is free by law.
Commercial VRP is patchier, and honesty demands you check rather than assume. A handful of areas have moved first:
- Account top-ups for investment and trading apps, where instant settlement genuinely matters.
- Selected utility and council payment trials, where suppliers want to cut card-processing fees.
- Wallet and e-money top-ups, replacing the stored card that used to break on reissue.
- A slow trickle of subscription merchants, though this remains the least developed corner — and the one most people care about most.
My recommendation is straightforward. Use sweeping now: it is free, mature and risk-light. Treat commercial VRP as worth trying where the provider offers it for one-off or top-up payments, but do not yet rip out your direct debits for essential bills like energy, water and council tax. For those, the Direct Debit Guarantee remains the better protection until VRP earns an equivalent safety net. Keep the guarantee where the stakes are highest; experiment with VRP where they are not.
What to watch before you commit
Two things will decide whether VRP becomes the default or stays a niche convenience. The first is whether the industry, prodded by the Financial Conduct Authority and the new Open Banking entity replacing the original implementation body, builds a consistent dispute and refund standard that rivals the Direct Debit Guarantee. The second is pricing: commercial VRP only spreads if banks set per-transaction fees low enough that merchants prefer it to cards, and that negotiation is still live.
For now, the smart move is to understand the two versions, grab the free one, and read the permission screen carefully before you authorise anything commercial. Check the per-payment cap, the monthly cap and the end date every single time — those three numbers are your whole defence, and unlike a direct debit, nobody is going to hand the money back just because you asked nicely.