Direct Debit vs card-on-file for UK subscriptions, Bacs rules and retries

What to take away

How Bacs Direct Debit scheme rules govern UK recurring collection

Bacs Payment Schemes Limited, part of Pay.UK, writes the rulebook that every UK bureau, bank and service user works to. The rules cover how an AUDDIS instruction is lodged, when advance notice must reach the payer, what a service user must hold as proof of mandate, and what happens when a collection fails.

Two obligations shape day to day operations. You must give the payer advance notice of each collection, typically at least ten working days before the first one and the same period before any change to the amount or date. You must also keep the mandate and the audit trail that proves the payer authorised it.

Bacs scheme rules also fix the collection cycle. A collection submitted on day one is processed through the input, processing and settlement days, so money lands on a known date rather than on demand. That predictability is the point. It is also why a failed collection cannot simply be re-presented the next morning.

Failure arrives as ARUDD, the automated return of unpaid Direct Debits. Each return carries a reason code. Codes such as 1 (instruction cancelled), 2 (payer deceased), 4 (advance notice disputed), 5 (no account or wrong account number) and 6 (no instruction) need different answers. Treating them as one bucket is how recovery rates stall.

If your billing sits inside a wider operating model, the subscription commerce operating workflow that keeps collections, dunning and reporting on the same clock is the one that keeps return rates honest.

GOV.UK's VAT guidance is the reference point when a price change or a cross-border subscriber forces you to revisit how the collection is documented.

Bank of England monetary policy shapes the cost of money and the value of recovering a small monthly amount.

Bacs does not set a per item fee for service users, so the cost sits in bureau and sponsor bank contracts. GoCardless publishes 1% plus 20p per successful collection, capped at £4, and a £10 fee per indemnity claim. Volume bureau contracts are quoted in pence per collection, and the pence figure depends on volume.

The Direct Debit Guarantee and what it promises subscribers

The Direct Debit Guarantee is a promise made to the payer, not to you. It says the payer gets an immediate refund from their bank or building society if an error is made, and that the refund is made without argument about who was at fault.

The guarantee also gives the payer the right to cancel at any time by telling their bank, and the bank must act. Notice of the guarantee must be given to the payer, usually with the advance notice of the first collection.

For a subscription business this changes the shape of disputes. A subscriber who wants out does not have to negotiate with you. They can go to their bank, get the money back, and the cancellation happens whether or not your retention flow was mid-conversation.

The practical consequence is that billing teams should treat guarantee wording as product copy. It must be accurate, it must appear where the payer will see it, and it must not be buried under a marketing promise that contradicts it.

Consumer law sits alongside the scheme. The CMA's consumer enforcement guidance sets out how subscription terms, cancellation routes and pricing claims are assessed, and unclear payment terms are a recurring theme in enforcement work.

Indemnity claims: causes, costs and how to reduce them

An indemnity claim is what happens when a payer's bank refunds a Direct Debit under the guarantee and then claims the money back from you. It is not the same as an unpaid item. The money was collected and has now been reversed.

Claims cluster around a few causes. A collection taken after cancellation, an amount different from what was notified, a collection after the payer moved bank, or a mandate that cannot be produced when challenged. Each is an operational failure rather than bad luck.

The cost is more than the refunded amount. You lose the revenue, you lose the subscriber, you spend time on evidence, and repeated claims feed into how your service user standing is viewed. At scale, indemnity claims are a signal that mandate management is weak.

Reduction is mostly plumbing. Keep cancellation effective the moment it is received, suppress the next collection before submission rather than after, and reconcile your mandate list against what the bureau holds. Advance notice that actually reaches the payer prevents a large share of claims on their own.

Evidence matters when a claim is challenged. If you can show the mandate, the notice and the collection history, you have a case. If you cannot, you pay and move on. That is why mandate records should be treated as controlled documents, not as rows in a table nobody owns.

Payment data is personal data, and the security duties around it are not optional. The ICO's security guidance covers the expectations for protecting subscriber payment details, including the access controls and retention limits that apply to mandate records.

Card-on-file failure handling compared with Direct Debit retries

Card-on-file failure handling starts with a different problem. The card is not a mandate. It is a credential with an expiry date, an issuer and a risk score, and any of those can change without telling you.

Failures split into two families. Involuntary failures come from expired cards, reissued cards, insufficient funds, issuer rules and fraud checks. Voluntary failures come from a subscriber who has decided to leave but has not told you.

Recovery levers differ accordingly. For involuntary failures you retry, you update the card through an account updater service, and you ask the subscriber for a new card at the moment the old one is close to expiry. For voluntary failures you need a reason to stay, not another attempt.

Compared with Direct Debit, cards give you more freedom and less certainty. There is no fixed scheme calendar for re-presentment, but issuers apply their own limits on how many attempts they will accept, and repeated attempts on the same card can trigger blocks.

Cards also carry higher processing cost per transaction and a chargeback exposure that Direct Debit does not have in the same form. The trade is flexibility: cards work for self-serve sign-ups, for subscribers outside the UK and for amounts where a mandate is impractical.

On cards, regulated UK consumer debit interchange is capped at 0.2% and credit at 0.3%. Gateway pricing such as Stripe is 1.5% plus 20p for UK cards, before any chargeback fee. Account updater services include Visa Account Updater, Mastercard Automatic Billing Updater and Amex Cardrefresher.

Many UK subscription firms run both. The split is usually by segment rather than by preference, and the reporting has to separate the two, or the failure rate you quote will be an average of two different things.

Retry timing, representation rules and dunning sequence design

Representation is the term for presenting a failed Direct Debit again. Under Bacs scheme rules, a failed Direct Debit can be re-presented no more than twice. The first re-presentation must be at least three working days after the original presentation date, and the second at least three working days after the first.

The payer must still have been notified of the collection.

Retry strategy design for Direct Debit therefore starts with the return code. An insufficient funds return can justify a re-presentation after the three working day minimum, timed to a point in the month when funds are more likely. A closed account or a cancelled instruction cannot be fixed by retrying at all.

For cards, retry timing is a modelling question. Attempts on the same day rarely help. A realistic cadence is four attempts at day 0, day 3, day 7 and day 14, with no same day repeats. Spacing attempts gives the issuer a different decision to make.

A dunning sequence should do three things in order: tell the subscriber what happened, give them a way to fix it, and set a deadline before access changes. The message and the retry should be coordinated, not run as separate campaigns.

Worked timeline example

Service levels for how quickly a failed payment is handled should be written down and owned. Subscription commerce service standards are the kind of thing that looks administrative until a regulator or a large enterprise customer asks for them.

Choosing the right rail for subscription management by segment

Segment first, rail second. A UK household paying a fixed monthly amount for a predictable service is a Direct Debit customer. A self-serve sign-up on a mobile device, possibly outside the UK, is a card customer. Forcing either into the other rail creates avoidable failure.

Direct Debit suits utility-like billing, memberships, insurance and anything where the amount is stable and the relationship is long. It is cheap per collection, it settles predictably, and the guarantee gives subscribers confidence to stay.

Cards suit low-value, high-volume, self-serve and international billing, plus anything where the subscriber expects to manage the payment method themselves. The cost per transaction is higher and the failure modes are more varied.

Some firms use both within one product: card at sign-up for speed, then a prompted switch to Direct Debit once the subscriber has stayed a few months. That migration is worth designing deliberately, because the switch itself is a payment event that can fail.

Whichever mix you choose, the commercial case depends on numbers you can defend. Subscription commerce key metrics that separate rails, segments and failure reasons are what turn a payment argument into a decision.

At portfolio level, the operating model matters as much as the rail. Subscription commerce operations that scale depend on mandate hygiene, clear ownership and a retry calendar that someone is accountable for.

A table comparing cost, failure rate and recovery levers

Read the table as a set of trade-offs rather than a ranking. Direct Debit gives you a cheap, predictable collection with a strong subscriber promise attached. Cards give you reach and flexibility with weaker certainty and higher unit cost.

The mistake to avoid is running one retry strategy across both rails. The rules, the failure reasons and the recovery levers are different, and a blended failure rate hides which rail is actually leaking revenue.

Common questions