“Bank on file” in open banking refers to Commercial Variable Recurring Payments (cVRP). A customer authenticates and sets up a mandate, allowing future payments to be collected within agreed limits without requiring authentication for every transaction. Re-authentication may still be required periodically.
It offers a similar experience to card-on-file, with the convenience of recurring payments but using bank account rails instead of stored card credentials.
How Bank on File works
Bank on File doesn't store account details the way a card token works. When a customer sets up Bank on File, they complete a one-time Strong Customer Authentication (SCA) step with their bank. This creates a mandate, a record of their consent tied to agreed constraints: maximum per payment, maximum per period, expiry date, and merchant identity. All subsequent payments fire against that reference within those limits, with no repeat authentication required.
The customer retains control throughout. They can view, adjust, or cancel their mandate at any time directly through their banking app, which is a regulatory requirement of cVRP. That's a meaningful step up from Direct Debit, where cancellation can take several days, and customers have limited real-time visibility into what they've authorised.
What to check with any cVRP provider
Commercial VRP vs sweeping. Not all providers that support VRP support commercial mandates. Sweeping VRP, which covers me-to-me transfers between a customer's own accounts, has been live since 2022. Commercial VRP, where payments flow from a customer to a merchant or third party, is a different product entirely. Confirm explicitly that the provider supports merchant-payee mandates before going further.
Bank coverage. Coverage for commercial VRP isn't the same as general open banking coverage. Ask which UK banks are live specifically for cVRP today, and whether that coverage extends to your merchants' sectors. Wave 1 covers utilities, regulated financial services, rail, government, and charities. If your use case sits outside that, understand the timeline before committing.
UX options. The consent and authentication flow is where customers decide whether to trust the product. Look for a provider that offers both a hosted flow for faster launch and a custom build option for teams that want to own the full experience. Mobile handoff quality and the SCA experience matter here too, particularly for consumer-facing merchants.
Why use Yapily for Bank on File payments
Since 2017, Yapily has been helping PSPs bring open banking payments into production. With cVRP, that foundation extends to Bank on File flows, giving PSPs the infrastructure to offer merchants a saved bank payment method that's built using the cVRP framework in whose industry development Yapily has participated
Yapily is a founding member of the UK Payments Initiative (UKPI), the industry-led body that will govern commercial VRP at scale in the UK. That's not just positioning. It means direct involvement in developing the technical standards and commercial framework underpinning the UKPI scheme.
A live cVRP pilot is already running for Wave 1 sectors: utilities, regulated financial services, charities, government, and rail. Wave 2, covering e-commerce and subscriptions, is coming soon. The mandate model supports flexible customer-defined constraints, including maximum per payment, maximum per period, frequency, and expiry, with a real-time management dashboard and instant cancellation built in as a regulatory requirement.
Beyond cVRP, Yapily is a regulated AISP and PISP, so PSPs get payments and account data through a single integration. That covers one-off Pay by Bank, commercial VRP, scheduled payments, and bulk payouts on the payments side, alongside enriched account and transaction data through Yapily Data Plus. Business account connectivity is also supported, making this viable for SME and enterprise merchant use cases, not just consumer flows.
A single integration covers both UK and EU markets across more than 2,000 banks in 19 countries. Hosted Pages are available for faster launch, with direct API integration for teams that want to own the full experience. Yapily is trusted by companies including Google, Adyen, and Pleo to power their open banking infrastructure.
FAQs
Is Bank on File the same as Direct Debit?
No, though they serve a similar purpose. Direct Debit takes up to three working days to settle and gives customers limited real-time control. Bank on file via cVRP settles instantly, requires strong authentication at setup only, and lets customers adjust or cancel their mandate immediately via their banking app.
Do customers have to re-authenticate for every payment?
Customers authenticate once using Strong Customer Authentication (SCA) at setup. All subsequent payments within the agreed mandate limits go through automatically. If a payment would exceed those limits, re-authorisation is required.
Can bank on file replace card-on-file for subscriptions and e-commerce?
Yes, that's the intended use case for cVRP Wave 2, expected H2 2026. For Wave 1 sectors (utilities, financial services, government, charities, rail), it's available in pilot now. The advantages over card-on-file: no stored credentials, SCA at setup, instant settlement, and lower transaction costs.
What happens when a customer cancels their mandate?
Customers can withdraw their cVRP consent. Once the withdrawal takes effect, further payments cannot be initiated under that mandate. Unlike Direct Debit, where cancellation can take days and payments can still slip through, a cVRP mandate revocation is immediate. No further payments can be collected once it's cancelled, giving customers significantly more control.