cVRP opens to more merchants: who does what in the chain
Commercial variable recurring payments (cVRP) took another step forward on 9 November. The UK Payments Initiative (UKPI), which runs the cVRP scheme, has widened the categories of merchants that payment initiation service providers (PISPs) can serve with cVRP, in response to feedback from the market. Personal loan providers are now in scope. Rail tickets sold through accredited third-party retailers are covered, as well as those sold by train companies. Housing payments are covered more fully, through qualifying providers and agents, and donations can be taken through fundraising platforms. UKPI says it is moving towards major merchants offering cVRP in 2027, and is looking further ahead to areas such as agentic commerce and payments at the point of sale.
It's a welcome expansion of a scheme that has started carefully, in sectors where the case for flexible, bank-to-bank payments is strong.
One consent, many payments
What makes cVRP different is the way the customer gives consent. Instead of approving each payment, the customer agrees limits once, and payments that vary in amount and timing can then be collected within those limits. That consent is collected and held by the regulated PISP, not by the merchant. It's what makes cVRP useful for bills that change month to month, extra loan repayments or travel that reflects the journeys people actually take.
Who does what in the chain
A cVRP payment passes through several parties, each with a different role. The customer agrees the limits. The merchant provides the service, sometimes through an intermediary such as a ticket retailer, letting agent or fundraising platform. The PISP, which is regulated by the Financial Conduct Authority, holds the customer's consent and initiates each payment on the merchant's behalf. The customer's bank checks the payment against the agreed limits and sends it. UKPI's scheme sits across all of this, adding rules beyond those set by regulation on how payments are handled, who talks to customers and where liability lies when something goes wrong.
What the wider scope changes
The regulated roles don't change. The PISPs and banks taking part in UKPI are regulated firms, and the PISP still collects the consent and initiates the payments. What changes is the range of merchants those PISPs can serve. Many of the new categories, such as third-party ticket retailers and fundraising platforms, aren't regulated as payments businesses in their own right, and some sit between the customer and the business that ultimately provides the service. A PISP serving them carries the consent and the scheme obligations, and relies on each merchant being who it says it is and trading as expected for as long as the consent is live. That can be months or years.
UKPI has handled the expansion carefully, starting with merchant categories where fraud risk is low and existing customer protections fit its dispute framework, and adding new ones in response to what participants have learned. Clear scheme rules are the right foundation.
Rules work best with a current view
Rules decide what should happen when something goes wrong. Applying them well depends on PISPs, and the banks that rely on them, knowing that each merchant they serve is still the business they onboarded, still in good standing and still trading as expected. That matters more with every new merchant category the scheme opens up, and more again as major merchants come on board, which UKPI is aiming for in 2027.
Keeping that view current for every party in the chain, in support of PISPs and schemes like UKPI's, is the infrastructure layer Invela is building.
Invela is the infrastructure layer that makes open finance trustworthy - accrediting who's in the network, monitoring risk in real time, and ensuring liability lands in the right place.
