Pay by Bank lets customers pay directly from their bank account, authorising the transaction in their banking app rather than entering card details. It is used to fund accounts, repay loans, pay bills and taxes and send money, as well as to pay at checkout. This guide explains how Pay by Bank works, how the UK and EU approaches differ, how its costs compare with cards, and where the biggest opportunities for growth lie.
What is Pay by Bank?
Pay by Bank is a payment method that initiates a transfer directly from a customer’s bank account to a merchant, business or other payee (such as a lender, a wallet provider or a government body), authorised in the customer’s own banking app rather than through card details entered at checkout. It’s also known as account-to-account (A2A) payments, open banking payments, or bank transfer checkout, depending on the provider and market.
Pay by Bank is often considered alongside three other core payment methods:
A manual bank transfer. With a manual bank transfer, the payer manually enters the account and sort code details in their banking app. Pay by Bank is initiated by a regulated third party and pre-populates the payment details, removing any potential mistakes and ensuring consistent references..
Direct Debit. Direct Debit is a pull payment set up in advance and collected by the payee on a schedule. Pay by Bank is typically a one-time push payment authorised at the moment of purchase, though recurring variants now exist. This guide refers to them as Recurring Pay by Bank: in the UK they are built on Variable Recurring Payments (VRP), covered below, while in the EU they depend on scheme-specific mechanisms.
A card payment. Cards run over card scheme rails (Visa, Mastercard). The customer enters their card details and the payment is authorised within seconds by the card issuer, through the scheme and the merchant’s acquirer. Authorisation is instant, but the money is not: funds are settled to the merchant later, typically one to three days after the transaction, net of interchange, scheme and acquirer fees. Pay by Bank bypasses those rails entirely. The customer authorises the payment in their own banking app and the funds move over local instant-payment infrastructure, so the merchant can see the money in seconds rather than days.
How does Pay by Bank work?
The flow is broadly consistent across the UK and EU, although the underlying rails differ: Faster Payments in the UK and SEPA Instant Credit Transfer in the EU.
1. The customer selects pay by bank at checkout.
2. They select their bank from a list.
3. They’re either redirected to their bank’s website or handed off directly into their banking app (an “app-to-app” flow), which is generally faster and has a lower drop-off rate.
4. They authenticate using Strong Customer Authentication (SCA)—typically biometrics or a passcode within the banking app.
5. The bank initiates the payment over the local instant-payment rail.
6. The customer is returned to the merchant with payment confirmation, usually within seconds.
The entity that initiates the payment on the merchant’s behalf is called a Payment Initiation Service Provider (PISP)—a regulated role created by PSD2 in the EU and mirrored under the UK’s own open banking framework. Merchants typically don’t connect to banks directly; they connect through a PISP.
Pay by Bank in the UK
The rails and rulebook
UK Pay by Bank runs over Faster Payments, the UK’s real-time payment system. The framework itself, often called “open banking” in the UK, has two layers. The Competition and Markets Authority (CMA) Order of 2017 required the UK’s nine largest current account providers (the “CMA9”) to open standardised APIs to regulated third parties, and Open Banking Limited (OBL) oversees delivery of that remedy on the CMA’s behalf. Separately, and more broadly, the Payment Services Regulations 2017 (PSRs) require any provider that offers an online-accessible payment account to give regulated third parties access to it. Open banking is therefore not limited to the CMA9: banks, building societies, e-money institutions and payment institutions with in-scope accounts are all covered.
Which accounts are in scope. Payment accounts that can be accessed online are in scope, including personal and business current accounts and e-money accounts. Savings accounts, mortgages and loans are not payment accounts and generally fall outside the regime. In practice, Pay by Bank payments are made from current and e-money accounts, and what is available to a given merchant depends on the bank coverage of its provider.
Variable Recurring Payments (VRP) and Commercial VRP
Variable Recurring Payments (VRP) lets customers pre-authorise a merchant/business to make a series of payments within the limits they set (maximum per payment, maximum per period), without re-authenticating each time. Two distinct categories exist:
Sweeping VRP moves money between a customer’s own accounts for defined use cases (e.g., topping up a savings account). It was first mandated for the CMA9 (the nine largest UK current account providers) in 2022, but support now extends well beyond them. Providers supporting VRP today include NatWest, Royal Bank of Scotland, HSBC, Barclays, Lloyds, Halifax, Bank of Scotland, Santander, Nationwide, First Direct, Danske Bank, Bank of Ireland, Allied Irish Bank, Monzo and Mettle, which together cover over 90% of UK accounts (see Plaid’s VRP coverage list for the account types supported at each).
Commercial VRP covers payments between customers and businesses. It is newer than sweeping VRP and is rolling out in phases through the UK Payments Initiative (UKPI), a group of banks and fintechs that includes HSBC, NatWest, Barclays and Lloyds. Plaid is a founding member.
For anyone evaluating Recurring Pay by Bank in the UK today, the key point is that Commercial VRP is live for a defined set of sectors, but not yet for e-commerce.
Live now (Wave 1, from 2 June 2026):
energy, utilities and telecoms; regulated financial services; e-money institutions; government; and registered charities.
Not yet live (Wave 2):
general e-commerce and subscriptions. UK Finance and Deloitte have published a proposed commercial model, but as of October 2026 UKPI has not adopted it, so there is no live e-commerce Commercial VRP.
Fraud levels on open banking payments are low relative to the wider market. Open Banking Limited reports around one in 6,000 payments was fraudulent in 2025, against around one in 2,500 across the UK payments industry. The fraud that does occur looks different from card fraud:
Mostly APP fraud.
Authorised push payment (APP) fraud, where the customer is tricked into approving a payment, accounts for more than two-thirds of reported cases. Investment scams are among the largest categories by value, which helps explain the higher fraud rate by value: pay by bank is used more for higher-value transfers, which scammers target.
Lower-risk journeys.
Rates are lower for VRP than for single payments, and lower for app-authenticated journeys than for browser ones.
Little card-style fraud.
For comparison, UK Finance reports £423.5 million of remote purchase card fraud in 2025, where stolen card details are used online.
Pay by Bank is already used at scale for money movement, not just checkout. Zilch offers it for repayments to its 5 million+ customers, Revolut customers use open banking to fund their accounts, and HMRC has offered “Pay by bank account” for tax payments since 2021. At checkout, adoption accelerated in 2026: Amazon UK and eBay UK both added it in February, joining Just Eat and Ryanair.
Pay by Bank in the EU
The rails and rulebook
EU Pay by Bank runs over SEPA Instant Credit Transfer, the euro-area equivalent of Faster Payments. The current legal foundation is PSD2 (the second Payment Services Directive), which remains the operative framework today; with its successor, PSD3/PSR, coming soon (see below).
Two newer pieces of regulation,often mistakenly conflated,are also worth noting:
The Instant Payments Regulation (IPR, EU 2024/886) laid the foundation for instant payments becoming default in Europe. It requires euro-area payment service providers to be able to send and receive instant credit transfers since 9 October 2025, at no higher cost than a standard (non-instant) transfer. Non-euro-area EU member states have until 2027 to comply.
Verification of Payee (VoP), the EU's equivalent of the UK's Confirmation of Payee, has been mandatory for euro-area providers since 9 October 2025 (non-euro-area providers have until July 2027). VoP is an obligation created by the Instant Payments Regulation, not by PSD3/PSR.
PSD3/PSR: where things stand
The EU’s payment services framework is being updated through a package of two new laws: PSD3 (a directive that countries write into national law) and the PSR (a regulation that applies directly across the EU). EU lawmakers agreed the package in principle in late 2025, and the European Parliament’s ECON committee approved the final texts on 5 May 2026.
It is not yet law. Formal adoption and publication in the Official Journal are still outstanding, and as of early October 2026 no date has been confirmed, although publication is expected in the second half of 2026. The PSR then applies 21 months after entry into force (27 months for Verification of Payee), which points to application around 2028.
The main differences between PSD2 and the PSD3/PSR package are:
A regulation as well as a directive. PSD2 is a directive that each member state transposed into national law, which is one reason rules differ from market to market. The PSR is directly applicable, so most conduct and open banking rules will apply uniformly, while PSD3 covers licensing and supervision and merges the payment institution and e-money regimes.
Open banking access. Banks must offer a dedicated API for third-party providers, and the PSD2 requirement to also maintain a fallback interface is removed. Banks must also give customers a dashboard showing the access permissions they have granted and let them withdraw them.
Fraud and liability. Payee name checks (Verification of Payee) extend to all credit transfers, transaction monitoring and fraud data sharing between providers become explicit obligations, and providers take on more liability, including refund obligations where a customer is tricked by someone impersonating their bank.
The local scheme landscape
Unlike the UK, where one national framework applies, EU Pay by Bank adoption has developed market by market, through bank-backed national and pan-European schemes layered on top of SEPA Instant. The most significant:
Wero, run by the European Payments Initiative (EPI), is the most ambitious pan-European effort. The bank-backed wallet launched for peer-to-peer transfers in Germany, France and Belgium in 2024 and now has more than 55 million users (EPI, September 2026). Its move into e-commerce has been slower than planned: it is live in Germany and Belgium, rolling out in phases in France, and still to add in-store and recurring payments.
Other national schemes remain dominant in their home markets:
BLIK (Poland): 2.9 billion transactions in 2025 and 20.7 million active users.
Bizum (Spain) and Swish (Sweden): each has tens of millions of users, in Bizum’s case more than 60% of the Spanish population, and Swish about 8 million in a country of roughly 10 million.
iDEAL (Netherlands): being migrated to Wero, due to complete by 2027.
These schemes are starting to interconnect through the EuroPA alliance (BLIK, Bizum, MB WAY, Vipps MobilePay, Bancomat and Wero), with cross-border e-commerce and in-store interoperability planned from 2027.
How the EU differs from the UK
No EU-wide equivalent to Commercial VRP exists yet. Recurring account-to-account payments in the EU are scheme-specific. There is not a single rulebook the way UK Commercial VRP is being built out under UKPI.
Enforcement and scheme coverage differ market by market. Each country’s National Competent Authority (NCA) enforces PSD2, and member states transposed it differently, so bank API quality, consent flows and regulatory interpretation vary from market to market. There is also no single national scheme: an EU merchant is in practice integrating with SEPA Instant as a common rail, plus a patchwork of national and pan-European schemes with varying reach.
Pay by Bank vs. card payments
Pay by Bank offers three core structural advantages: no interchange or scheme fees, real-time settlement instead of a multi-day cycle, and minimal exposure to card-data security requirements. The trade-offs sit mostly on the other side of the ledger, including refunds, disputes, and recurring payments.
As the table shows, pay by bank removes the card scheme and interchange layer entirely, replacing it with a direct connection between payer and payee. Fewer intermediaries generally mean fewer fees, although costs vary by provider, volume, and market. But cost is only one part of the trade-off. Pay by bank also changes how merchants handle processes such as refunds and payment security.
Fraud is the other major difference. Card-not-present fraud is the largest source of card losses online, and merchants often carry part of that cost through chargebacks. Pay by bank removes that vector: the customer authenticates with their own bank, and there are no reusable card credentials to steal. The fraud that does occur is mainly authorised push payment (APP) fraud, which in the UK is handled between the banks involved under the Payment Systems Regulator’s mandatory reimbursement rules, not through a chargeback against the merchant.
On the other hand, pay by bank can simplify some of the security and compliance requirements associated with accepting cards. The Payment Card Industry Data Security Standard (PCI DSS) sets security requirements for any business that handles, stores, or transmits card data, covering everything from network security and access controls to regular testing. Because pay by bank never touches card data, it falls outside this scope almost entirely, reducing a compliance burden that applies to card acceptance regardless of a merchant’s size.
Benefits of pay by bank
Lower structural cost than card payments by removing interchange and scheme fees.
Real-time settlement, improving cash flow versus the 1–3 day card settlement cycle.
No card-on-file expiry problem, a common source of failed recurring payments and involuntary subscription churn.
Reduced PCI DSS scope, since no card data passes through the merchant’s systems.
Strong authentication built in, since every payment is authorised via the customer’s own banking app.
Current limitations of Pay by Bank
Pay by Bank requires SCA with the bank for every transaction. Whilst this creates an extremely secure payment method, it leads to some user friction and limits usefulness for some use cases (e.g. point of scale).
Refunds require a separate outbound payment rather than a reversal. On its own, that can be operationally slower for merchants without existing payout infrastructure. Providers that include Virtual Accounts remove most of this friction: funds land in an account the merchant can see in real time, and refunds can be sent from that same account.
There is no chargeback scheme. Card networks give consumers a dispute mechanism that direct bank-to-bank payments do not replicate.
Coverage and app quality vary by bank, making execution a real consideration. A poor redirect or app-handoff experience can directly cost a merchant sales in a way a slightly clunky card form typically doesn’t.
Where Pay by Bank fits today
Fits well today:
Account funding, top-ups, and other high-value transactions (e.g. e-money and neobank top-ups, crypto exchanges, investment platforms). Pay by bank's cost advantage over cards generally grows with transaction size so the savings can be more meaningful on larger baskets.
Loan repayments. Lenders and buy now, pay later providers can collect repayments directly from the customer’s bank account instead of over card rails, which cuts processing fees and avoids failed payments from expired or replaced cards. Zilch, for example, offers Pay by Bank for repayments to its 5 million+ customers
Remittances and money transfer. Money transfer providers can fund transfers straight from the sender’s bank account, avoiding card fees on what are often larger-value transactions and getting fast confirmation that funds have arrived before the transfer is sent.
Bill pay and government payments. Pay by bank fits naturally with HMRC-style use cases, where the payer already has a direct financial relationship with the payee.
iGaming. The sector has been an early adopter because online gambling and betting often require instant settlement and strong authentication. Pay by bank is therefore well suited to its regulatory and cash-flow needs.
Marketplace payouts and invoice settlement. Pay by bank can work well for B2B use cases where recurring-payment maturity matters less than one-off settlement speed.
E-commerce checkout. Growing quickly as larger merchants add it as an option alongside cards, particularly for higher basket values.
Less suited today:
Subscriptions with variable or unpredictable amounts. Until recurring-payment mechanisms (UK Commercial VRP, EU scheme-specific mandates) mature further and extend into e-commerce, pay by bank is less suited to these transactions.
F2F point of sale, particularly low value, high frequency.
How to choose a pay by bank provider
Few merchants build Pay by Bank connectivity in-house. It means becoming (or partnering with) a PISP, managing consent flows, keeping up with each scheme’s technical requirements, and tracking rule changes in every market you operate in. Most merchants and fintechs therefore connect through a provider, so the real question is which kind.
Some providers offer basic payment initiation: an API that sends the payment request to the bank and leaves everything else to you. Others, such as Plaid Link, offer a full out-of-the-box solution. The difference matters most in Europe, where bank journeys vary widely. A full solution typically handles:
Authentication and returning users.
SCA and app-to-app flows are optimised per bank, and returning users skip bank selection, avoid double SCA (common in Spain and Italy) and have details like IBANs prefilled.
Manual inputs and localisation.
Banks that require users to type in an IBAN or username (mainly in Germany and Italy) are handled for you, with local language and IBAN support built in.
Settlement, refunds and recurring payments.
Virtual Accounts give real-time settlement visibility, instant refunds and reconciliation, and recurring payments are available in the UK through VRP.
Plaid’s Payments products offer one API across 20 European markets and multiple rails (Faster Payments, SEPA Instant and SEPA Credit Transfer), plus Payouts for sending funds back to customers. Zilch used this combination to streamline repayments and refund handling.
Get in touch to find out how Plaid can help.