Ahead of the Budget on 28 October, Yapily is making two asks. To HM Treasury and the FCA: confirm the statutory instrument that opens the way to Wave 2 with a firm date to lay it, and make agentic payments part of the long-term regulatory framework for open banking. To UKPI: write agentic payments into the Wave 2 rulebook from day one. Together, they make Wave 2 the UK’s opening move in agentic commerce.
This is the first in a series by James Tiltman, VP of Payments in Product at Yapily, on the future of open banking payments, covering checkout optimisation, programmable payments and agentic commerce. It looks at the rollout of cVRP, and what needs to happen for it to become the mainstream alternative payment method it has the potential to be.
Earlier this year, under the UK Payment Initiative (UKPI), Commercial Variable Recurring Payments (cVRP) went live in the UK. cVRP lets a payer set pre-defined guardrails for a business to collect funds, with limits per transaction and on total value within a defined period.
Wave 1 covers energy and utilities, telecoms, regulated financial services, government and charities. These sectors were chosen because they are regulated, trusted and low risk, the sensible place to launch a new scheme. That is a sound risk decision, not a strategy.
The market has read it as one anyway. Every Wave 1 sector runs on recurring billing, so the positioning has become “cVRP vs. Direct Debit”. I don’t buy it, and I don’t think UKPI intended it. The switching cost is too small for the biller and too invisible to the customer for cVRP to take meaningful share from Direct Debit. On that pitch, cVRP won’t deliver the alternative to cards and Direct Debit set out in the Government’s National Payments Vision.
cVRP solves for a checkout problem, not a billing problem
What cVRP does well is let a bank recognise a customer returning to a merchant they’ve already given a mandate to, and let them pay again without re-authenticating. That is a checkout problem.
Today, every open banking payment at checkout means the same round trip: redirect, authenticate, confirm, redirect back, even for a merchant the customer has paid ten times before. Cards solved checkout friction years ago. cVRP is the mechanism that lets a bank say “this customer already gave this merchant standing authority, within limits I hold” and skip that friction on every repeat visit, with the security and cost benefits of account-to-account. It is the missing piece open banking needs to compete with cards at an online checkout.
That makes ecommerce the primary use case for cVRP, not a nice-to-have. Recurring billing then gains traction off the recognition built at the online checkout.
Why Wave 2 can’t wait
Wave 2, which brings ecommerce into scope, was first described as arriving in the second half of 2026. It is now targeted for the end of H1 2027, tracking the legislative timetable: Wave 2 depends on a Treasury statutory instrument under the Data (Use and Access) Act 2025, currently expected between the end of 2026 and July 2027.
The result is that the use case with the strongest product-market fit has the longest wait, while the industry pitches cVRP into sectors where behaviour change is slowest and early volumes will be modest, at best. The volume that makes a new scheme commercially viable sits in ecommerce, where merchants have a real incentive to move off cards and customers transact often enough for the returning-customer advantage to compound.
For context, Direct Debit processed a record 5.0 billion payments in 2025 (Pay.UK), against 351 million open banking payments reported by Open Banking Limited (OBL). Open banking passed 40 million payments in a single month for the first time in May 2026, and ecommerce is where most of the growth still to come sits.
Checkout is becoming a conversation, not a page
The next version of checkout isn't going to be a customer clicking through a payment page; it'll be an agent acting on a customer's behalf, completing a purchase without a human present at the moment of payment. That is coming fast, and the card schemes are already moving to make their rails the default.
Account-to-account has a genuine advantage here, but a narrow window to use it. A card token trusts the merchant to charge within reason. A cVRP mandate has the bank enforce the ceiling before the money moves. Any agent given spending authority needs that version of consent underneath it.
But today’s cVRP wasn’t designed for agents. A mandate covers one customer and one merchant, while an agent needs to compare suppliers and act across a category of spend. Nothing lets a customer authorise “an agent shopping for groceries, within these limits”, and nothing in the payment marks it as agent-initiated, so neither bank nor customer can later tell which purchases the agent made.
Closing those gaps takes work at every layer: legislation, regulation, standards and scheme rules. That is why the asks below don’t just focus on a single regulatory body.
My two asks before the Chancellor delivers the budget
1. HM Treasury and the FCA: legislate for Wave 2, and regulate for agents
We are calling on HM Treasury to use the Budget on 28 October to confirm the statutory instrument under the Data (Use and Access) Act, with a firm date for laying it before the end of this year.
A date gives banks, payment providers and merchants a timetable to build to. The legislation also gives participants the legal footing to collaborate with confidence. The FCA and PSR’s January 2026 non-prioritisation statement covers Wave 1 pricing only and is not a legal safe harbour under competition law. HM Treasury has itself acknowledged that market participants may have concerns about how centralised pricing sits under the Competition Act 1998, and has proposed addressing this in the long-term Open Banking framework..
The FCA then has its own part to play. Its long-term regulatory framework for open banking is the right place to make account-to-account ready for agents. Standards for agent-initiated payments belong alongside the work on payment status and financial crime information sharing, and the framework for schemes needs room for products like multi-merchant mandates to develop above the baseline. Agentic payments belong in the FCA’s consultation next year.
2. UKPI: write agents into the rulebook
Alongside agreeing a proportionate consumer protection model for Wave 2, UKPI needs to build the scheme for agents from the start. That means mandates that cover a category of spend across multiple merchants, and scheme rules for agent-initiated payments, developed in step with the standards work at OBL and its successor. Building these in now will cost far less than retrofitting them later, and it gives UK pay by bank a product ready for where checkout is heading.
But this is not a job for any one firm. Government needs to set the timetable, but the industry needs to decide whether and how it can meet it.
Why it matters right now
Agents will start buying on customers’ behalf whether or not account-to-account is ready. A confirmed Wave 2 date, a regulatory framework built with agents in mind, and a rulebook that supports them give merchants and providers a reason to build for that demand now. Get all three done, and Wave 2 will become the UK’s platform for agentic commerce, not a delayed extension of an alternative billing product. In this sense, we can transform the delayed rollout of cVRP into an advantage for consumers.
Consent and checkout are only part of the agentic payments question. The next article in this series turns to settlement, and how stablecoins and smart contracts could help payments settle across the multi-party flows that agentic commerce creates.