Direct Debit or continuous payment authority: control and refund rights

If a company takes money from your account each month, the rules that protect you depend on how you agreed to pay. A Direct Debit is set up with your bank using your sort code and account number, and it comes with the Direct Debit Guarantee. A continuous payment authority (CPA) is set up with the company using your card details, and it does not have that guarantee.

The difference matters when something goes wrong. If a Direct Debit is taken in error, after you cancel it, or fraudulently, you are entitled to a full and immediate refund from your bank¹. If a CPA payment goes wrong, your rights come from different rules, and you may need to contact the company or your card issuer rather than your bank.

This page explains what each payment method is, who your agreement is with, how to cancel, and what refund rights you have when a payment goes wrong.

A CPA starts when you give your card details

A continuous payment authority is a type of regular payment made using your debit or credit card. It is set up when you give your card details to a company so they can take payments from you⁶. You do this by giving them your credit or debit card details, and they can then take money on agreed dates without asking each time⁷.

A CPA can also be called a recurring transaction or a regular card payment⁶. Your bank may use any of these terms. The Financial Conduct Authority calls them recurring card payments, and notes they are sometimes called continuous payment authorities⁸.

CPAs are common for magazine subscriptions, gym memberships, some debt collection agencies and payday loans⁶. When you apply for a payday loan online, you may be asked to give the company access to your bank account or credit union account through a CPA⁹. Payday lenders may also set up a direct debit or a CPA with your bank account, or ask you to post-date a cheque¹⁰.

The Post Office uses a CPA for its Drop & Go auto top-up service. By setting up auto top-up, you establish a continuous payment authority that authorises Post Office Ltd to debit your payment card to top up your account¹¹.

Strong Customer Authentication rules apply differently to Direct Debits and CPAs. Direct debits of fixed or variable amount that are initiated by the payee only, without any direct intervention from the payer, are out of scope of SCA. However, creating an e-mandate under a scheme requires SCA¹².

Direct Debit or CPA: who your agreement is with

The key difference is who holds the agreement. With a Direct Debit, you give permission to a business or organisation to collect money from your account, usually for bills or subscriptions¹³. The company sets up the Direct Debit using your sort code and account number¹. You need to sign a mandate with the company you want to pay, and the company then sets up the Direct Debit with your bank¹⁴.

With a CPA, your agreement is with the company, not your bank. You have given them permission to take payments from your card. This means that to cancel, you generally need to contact the company rather than your bank.

A continuous payment authority is not covered by any bank guarantee and can only be cancelled directly with the business that holds the authority¹⁵. This was the position set out in a 2012 report, and the same point was made in 2009 guidance¹⁶.

However, you can also ask your card issuer to block payments. Danske Bank states that you can cancel a continuous payment authority at any time by contacting the merchant, or you can contact them to block the payment². Under the Payment Services Regulations 2017, if you have been misled or tricked into agreeing to a CPA, your bank or card provider must cancel the payment authority¹⁷.

For Direct Debits, you can cancel at any time¹⁸. If you cancel a Direct Debit, your bank should ensure that no payments are taken, whether or not you owe money to the company¹.

The Direct Debit Guarantee does not cover a CPA

The Direct Debit Guarantee is a protection scheme offered by all banks and building societies that accept instructions to pay Direct Debits¹⁹. It applies to all banks and building societies taking part in the Direct Debit scheme¹.

Under the Guarantee, if the bank or an organisation you are paying makes a mistake, your bank must refund the payment to you¹³. If a payment error is made by the payee company or your bank or building society, you are entitled to a full and immediate refund of the amount paid²⁰. This covers payments taken after the Direct Debit is cancelled, payments taken on the wrong date, and wrong amounts being collected²¹.

Payments made by CPA are not covered by the Direct Debit Guarantee, but the law offers similar protections⁶. Recurring card payments are not covered by the Direct Debit Guarantee⁸. A continuous payment authority is not covered by any bank guarantee¹⁵.

The Financial Ombudsman Service has dealt with cases where a bank failed to cancel a Direct Debit. In one case, the ombudsman reminded the bank of its responsibilities under the Direct Debit Guarantee scheme, which covers exactly this sort of situation²².

For CPAs, there is no equivalent to the Direct Debit Guarantee¹. However, if you withdraw your CPA and money is still taken from your account, this is an unauthorised transaction. Your card issuer should give you a refund, including any interest or charges added because the payment was taken³.

Control over future payments: bank instruction or supplier agreement

With a Direct Debit, you give a company permission to take money from your account on an agreed date. With a standing order, you tell your bank to transfer money on a fixed date²⁴. The main advantage of Direct Debits is flexibility, as the payments can vary in amount or frequency¹.

The company is in control of when and how much is taken under a Direct Debit¹⁹. However, the payee must notify you in advance each time there is a change to the amount, date or frequency²⁰. Your energy supplier has to let you know about a payment increase before it happens, which is part of the Direct Debit Guarantee²⁵.

For CPAs, the FCA rulebook states that a firm must not amend the terms of a continuous payment authority without first obtaining the customer's consent, after having fully explained the reason for the amendment²³. This rule has applied since 1 April 2014⁴.

Where a customer is in financial difficulties, a firm must not request payment on a CPA more than twice on the same agreement once it has already been refused⁴. The FCA's Consumer Credit sourcebook sets out this limit²⁶. The nidirect guidance states that a CPA must not be used more than twice to recover money from your bank account¹⁰.

For Direct Debits, you cannot revoke the payment order after the end of the business day preceding the day agreed for debiting the funds⁵. This means you need to cancel before that deadline if you want to stop a specific payment.

If you have a power of attorney, both the donor and the attorney can set up, amend or cancel regular payments and Direct Debits while the donor has mental capacity. If the donor lacks mental capacity, only the attorney can do so²⁷.

Refund rights when a payment goes wrong

If a Direct Debit payment is made wrongly, you are entitled to receive a refund from your bank¹⁶. Under Regulation 79, you are entitled to an unconditional refund from your payment service provider of the full amount of any Direct Debit transaction⁵. If the originator or the bank makes an error, you are guaranteed a full and immediate refund of the amount paid¹.

Direct Debit indemnity is a way of claiming back unauthorised Direct Debits. This includes where you were not given required advance notice of a change of amount or date, or were debited an incorrect amount, earlier than the agreed date, or in error¹⁴.

For CPAs, the position is different. If you withdraw your continuous payment authority and the money is still taken from your account, this is an unauthorised transaction. Your card issuer should give you a refund, including any interest or charges added because the payment was taken³.

If you have been misled or tricked into agreeing to a CPA, you have rights under the Payment Services Regulations 2017, and your bank or card provider must cancel the payment authority¹⁷.

The Financial Ombudsman Service has considered cases where a customer asked their bank to cancel a CPA and the bank cancelled the card instead. The ombudsman also dealt with a case where a customer complained that the bank failed to cancel a Direct Debit²².

If you need to withdraw a CPA, sample letters are available. National Debtline provides a letter to withdraw your continuous payment authority from a buy now pay later company²⁸, a letter to withdraw from a payday loan company²⁹, and a letter to withdraw from your card issuer³⁰. Business Debtline provides similar letters for payday loan companies³¹ and card issuers³².

You will need to write to your card issuer asking for the payment to be stopped³³. The letter tells your card issuer that you are withdrawing your authority for payments to be debited from your card³⁰.

How to cancel each type of payment

The process for cancelling depends on which type of payment you have.

To cancel a Direct Debit:

1. Contact your bank or building society. You can cancel at any time¹⁸.
2. Your bank should ensure that no payments are taken after cancellation¹.
3. If a payment is still taken, you are entitled to a full and immediate refund under the Direct Debit Guarantee²⁰.

To cancel a CPA:

1. Contact the company that holds the authority. You can cancel at any time².
2. Alternatively, contact your card issuer to block the payment².
3. If money is still taken after you withdraw the CPA, contact your card issuer for a refund³.
4. If you have been misled or tricked into agreeing to the CPA, your bank or card provider must cancel it¹⁷.

If you are in financial difficulties, a firm must not request payment on a CPA more than twice on the same agreement once it has been refused⁴.

What happens when you switch bank accounts

When you switch bank accounts, your Direct Debits, standing orders and bill payments are automatically redirected to your new account³⁴. Banks have worked together to make sure this happens³⁴.

The switching service is free of charge. At the request of a consumer, transferring and receiving payment service providers must provide access to the switching service³⁵.

If you have a CPA, switching bank accounts does not automatically update your card details. Once you have opted out of a CPA, you will need to provide your new card details yourself to any merchant you have CPA agreements with².

If you are switching energy supplier and pay by Direct Debit, you can still switch if you have owed your supplier money for less than 28 days. Your debt will be added to your final bill³⁶.

For more on switching bank accounts, see Switching your bank account: a step-by-step checklist.

Where to get help

If you have a problem with a Direct Debit or CPA that you cannot resolve with your bank or the company, you can complain to the Financial Ombudsman Service. The ombudsman handles complaints about banking and payments, including regular payments¹³.

Free, impartial help is available from:

• MoneyHelper for general guidance on money matters
• National Debtline for sample letters to withdraw a CPA²⁸
• Business Debtline for sample letters if you are self-employed or run a business³¹
• Citizens Advice for help with stopping a future payment on your debit or credit card³⁷
• StepChange for debt advice if you are struggling with payments⁶

If you are in financial difficulties, a firm must not request payment on a CPA more than twice on the same agreement once it has been refused⁴. If you are being pursued for payments you cannot afford, seek free debt advice.

For more on making a complaint, see Writing an effective complaint letter or email.