VRP Payments initiated by a PISP that do not rely on the application of an SCA exemption by the ASPSP, but rather the application of delegated SCA to each individual VRP Payment. This provides explicit consent for each payment instruction, dynamically linking the amount and a payee, allowing for flexibility on the VRP Consent Parameters.
Other pages in this section Account Selection at PISP Account Selection at PISP – Supplementary Info Account Selection at ASPSP Scheduled Payments – Future Dated Standing Orders International Payments Bulk / Batch Payments Multi-authorisation Payments Confirmation of Funds for PISPs Payment Refunds VRP Payments with SCA exemption VRP Payments under Sweeping Access VRP Payments with delegated SCA
This content is best viewed on a desktop browser. 1 CEG Checklist Requirements 1PISPs must either allow PSUs to specify consent parameters or pre-populate them for the PSUs enabling the PSU to amend any of them as required. 2 CEG Checklist Requirements 2PISPs must provide PSUs at least one of the following options:• Enter their Payer’s payment Account Identification details.• PISPs must allow PSUs to enter their payment Account Identification details in at least one of the ways specified in the OBL V3 Read/Write API Specifications (e.g. account number and sort code – with additional roll number if required, IBAN, PAN, Paym and other formats).• Select their Account Identification details (this assumes they have been saved previously).• Select their ASPSP in order to select their PSU payment Account from there later on in the journey. 3 CEG Checklist Requirements 3Use of clear language to the PSU that they will be consenting to give the PISP the ability to make payment on a (sporadically or periodically) recurring basis.PISPs must display the company’s trading name/brand name (i.e. the Client Name) to the PSU during the setup and revocation of consent. If the PISP is only trading with its registered company name then it must display that name to the PSU. 4 CEG Checklist Requirements 4PSU Consent to PISP PSU Consent to PISP PISPs must display the following information in the consent screen:Consent Parameters (as provided in item 1.) 5 CEG Checklist Requirements 5TermsPISPs must enable the PSUs to view their Terms on the consent screen. 6 CX Considerations 6PISPs should provide messaging to inform PSUs that they will be taken to their ASPSPs to complete the payment. 7 CX Considerations 7Generic PISP to ASPSP redirection screen and message. 8 CEG Checklist Requirements 8ASPSPs must allow PSUs to select the payment account to complete the VRP setup only if the PSU has not provided it to the PISP.It is up to ASPSP to consider relevant obligations relating to the FCA’s High Cost Credit Review: Overdrafts consultation paper and policy statement (CP18/42) & (PS19/16)”. 9 CEG Checklist Requirements 9ASPSPs must display all the consent parameter(s) as provided by the PISP. 12 CX Considerations 12For recognition based biometrics (e.g. Face ID) which can be more immediate the biometric authentication should be invoked after a delay or through a call to action to allow the PSU the ability to view the details. 13 CEG Checklist Requirements 13SCA Authentication must be the only action required at the ASPSPs (unless supplementary information required, refer to section Single Domestic Payments – Supplementary info. 14 CEG Checklist Requirements 14Generic ASPSP to PISP redirection screen and message. Please refer to section Effective use of redirection screens. 15 CEG Checklist Requirements 15PISPs must display the information received from the ASPSP. This information may include:• The unique identifier assigned to the VRP setup by ASPSPs. Select to scroll left Select to scroll right
This content is best viewed on a desktop browser. 1 CEG Checklist Requirements 1PISPs must enable the PSU to provide the below: Payee Account Name. Payee Account Identification details (e.g. account number and sort code or additionally roll number or full IBAN). 2 CEG Checklist Requirements 2PISPs must display the following information in the consent screen: Payment Reference, and any supplementary info, if it has been entered by PSUs or pre-populated by PISPs in item #1. Payee Information Payee Account Name. For Payee Account Identification details (e.g. account number and sort code or additionally roll number or full IBAN): If this has been provided by PSUs in item #1, then PISPs must also display this in the consent screen to allow PSUs to check and verify correctness. If this has been pre-populated by PISPs (e.g. in an eCommerce payment scenario) PISPs could choose whether to display this information or not. Payer Information If this has been provided by PSUs in item #1, then PISPs must also display this in the consent screen to allow PSUs to check and verify correctness. If this has been pre-populated by PISPs (e.g. PSU already provided as part of VRP consent) PISPs could choose whether to display this information or not. 3 CEG Checklist Requirements 3SCA Authentication must be the only action required by the PSU. 4 CX Considerations 4The PISP must be able to submit a CoF request prior to making VRP payment and must receive a response back from the ASPSP. Please refer to section Confirmation of Funds for PISP – Y/N Response – Requirements #5 to #9 5 CEG Checklist Requirements 5ASPSP must reject the VRP Payment and provide an appropriate response back to the PISP if : The VRP payment submitted by PISP is outside the VRP Consent parameters. The VRP consent setup access is revoked by the PSU at the ASPSP. 6 CEG Checklist Requirements 6PISP Confirmation PISPs must display the information received from the ASPSP. This information may include: •The unique identifier assigned to the VRP payment by ASPSPs. Select to scroll left Select to scroll right
CEG Checklist Requirements & CX Considerations CEG Checklist Reference 1 PISPs must either allow PSUs to specify consent parameters or pre-populate them for the PSUs enabling the PSU to amend any of them as required. Example Consent Parameters: Maximum amount per payment and Currency (GBP for UK implementations). Maximum amount per month. Expiry Date (Ongoing or a Specific Date). Any supplementary information required which the ASPSP has published as required and is specific to that ASPSP. 22 22a 2 PSU payment Account Selection PISPs must provide PSUs at least one of the following options: • Enter their Payer’s payment Account Identification details. •PISPs must allow PSUs to enter their payment Account Identification details in at least one of the ways specified in the Open Banking Standard V3 Read/Write API Specifications (e.g. account number and sort code – with additional roll number if required, IBAN, PAN, Paym and other formats). • Select their Account Identification details (this assumes they have been saved previously). • Select their ASPSP in order to select their PSU payment Account from there later on in the journey. Note 1: In some of the above cases, PISPs may also need PSUs to provide their ASPSP name so that PISPs can check whether ASPSPs will be able to match the account identifier to the underlying PSU payment account. Note 2: The use of IBAN as an identification of the payer account for UK ASPSPs is not expected to be heavily used as account and sortcode are the main account identifiers used in the UK. IBAN however will be used by non UK ASPSPs implementing Open Banking Standard and offering their services in the UK. 24 3 Use of clear language to the PSU that they will be consenting to give the PISP the ability to make payment on a (sporadically or periodically) recurring basis. PISPs must display the company’s trading name/brand name (i.e. the Client Name) to the PSU during the setup and revocation of consent. If the PISP is only trading with its registered company name then it must display that name to the PSU. If there is a customer-facing service provider (e.g., Merchant) who is not a PISP but has a commercial relationship with a PISP and is providing the end service to the end-user, the PISP must ensure the software statement reflects this information correctly so that it can be displayed accurately to the PSU on the PIS-VRP ASPSP Dashboard. This could occur in Merchant journeys for example, where the Merchant contracts with a PISP to provide Variable Recurring Payment as a payment option on their platform. PISPs must also, populate the customer-facing service provider company name in the ‘On behalf of’’ field of the software statement, in order to inform the ASPSP about the relationship and allow the ASPSP to be able to display this information to the PSU (please refer to item #5). Only in instances where there is a customer-facing service provider acting on behalf of the PISP, the ‘On Behalf of’ name must be displayed to the PSU. PISPs must not populate the ‘ On behalf of’ field with the details of their TSP. 8f 4 PSU Consent to PISP PISPs must display the following information in the consent screen: Consent Parameters (as provided in item 1.) Payer Information PSU payment Account Identification and/or the selected ASPSP (based on item 2 options).Note: if PSU payment Account identification is provided by PSUs in item 2, PISPs could use this to identify and display the ASPSP without having to ask PSUs. 8b 5 Terms PISPs must enable the PSUs to view their Terms on the consent screen. 8c 6 PISPs should provide messaging to inform PSUs that they will be taken to their ASPSPs to complete the payment. Example wording: ‘We will securely transfer to YOUR ASPSP to authenticate“. 7 Generic PISP to ASPSP redirection screen and message. Please refer to sections Browser based redirection – PIS, App based redirection – PIS and Effective use of redirection screens. 8 Additional Parameters ASPSPs must allow PSUs to select the payment account to complete the VRP setup only if the PSU has not provided it to the PISP. It is up to ASPSP to consider relevant obligations relating to the FCA’s High Cost Credit Review: Overdrafts consultation paper and policy statement (CP18/42) & (PS19/16)”. 23 9 ASPSPs must display all the consent parameter(s) as provided by the PISP. These details must be displayed as part of the authentication journey on at least one of the following screens without introducing additional confirmation screens (unless supplementary information is required, refer to section Single Domestic Payments – Supplementary info. ASPSPs’ Authentication screen (recommended). ASPSP to PISP redirection screen 28a 10 ASPSPs must support all the periodic limits and be capable to handle multiple periodic limits in a single consent. The ASPSPs may restrict to one-period alignment (i.e. consent or calendar) for a single periodic limit in a single consent. Note – e.g.: Max cumulative amount per calendar year and Max cumulative amount per consent year may not be an acceptable combination in one VRP consent, however, Max cumulative amount per calendar year and Max cumulative amount per consent month is acceptable. 28e 11 The ASPSP should not put restrictions when the consent is set up but can apply restrictions if the amount(s) in the individual payment orders submitted exceed the limits in the direct, online channels. 12 For recognition based biometrics (e.g. Face ID) which can be more immediate the biometric authentication should be invoked after a delay or through a call to action to allow the PSU the ability to view the details. 13 SCA Authentication must be the only action required at the ASPSPs (unless supplementary information required, refer to section Single Domestic Payments – Supplementary info. The ASPSP authentication must have no more than the number of steps that the PSU would experience when directly accessing the ASPSP channel. 19 1 14 Generic ASPSP to PISP redirection screen and message. Please refer to section Effective use of redirection screens. 15 PISP Confirmation PISPs must display the information received from the ASPSP. This information may include: • The unique identifier assigned to the VRP setup by ASPSPs. 25 26
CEG Checklist Requirements & CX Considerations CEG Checklist Reference 1 PISPs must enable the PSU to provide the below: Payee Account Name. Payee Account Identification details (e.g. account number and sort code or additionally roll number or full IBAN). 22 2 PISPs must display the following information in the consent screen and additional VRP payment information: Payee Information Payee Account Name. If this has been provided by PSUs in item 1, then PISPs must also display this in the consent screen to allow PSUs to check and verify correctness. For Payee Account Identification details (e.g. account number and sort code or additionally roll number or full IBAN): If this has been pre-populated by PISPs (e.g. in an eCommerce payment scenario) PISPs could choose whether to display this information or not. Payer Information If this has been provided by PSUs in item 1, then PISPs must also display this in the consent screen to allow PSUs to check and verify correctness. If this has been pre-populated by PISPs (e.g. PSU already provided as part of VRP consent) PISPs could choose whether to display this information or not. Additional Payment Information (if any) Payment Amount. Payment reference Debtor reference (optional) 28 3 SCA Authentication must be the only action required by the PSU. 19b 4 The PISP must be able to submit a CoF request prior to making VRP payment and must receive a response back from the ASPSP. Please refer to section Confirmation of Funds for PISP – Y/N Response – Requirements items 5 to 9. 5 ASPSP must reject the VRP Payment and provide an appropriate response back to the PISP if : The VRP payment submitted by PISP is outside the VRP Consent parameters. The VRP consent setup access is revoked by the PSU at the ASPSP. 28d 5a ASPSPs must offer the same minimum and maximum payment limits for payment types, as they offer in their direct online channels. 28f 6 PISP Confirmation PISPs must display the information received from the ASPSP. This information may include: • The unique identifier assigned to the VRP payment by ASPSPs. Note: PISPs that will be offering refunds to PSUs must incorporate the PISP refund journey within the VRP customer journey. 25 26
VRP Payments under Sweeping Access Previous Related articles Please select API specifications Domestic VRP consents Domestic VRP payments VRP payment usage examples Card Based Payment Instrument Issuers – CBPIIs Next