🔁 Direct debits and mandates around the world

Anatomy of a mandate: three things, one word

Direct debit is the only mass-market payment instrument in which the creditor, not the payer, issues the debit order. The payer does nothing on the due date. They consented once, sometimes years earlier, and the money leaves their account without any action on their part. On the agreed date, the creditor sends a collection instruction to its bank, which forwards it to the payer’s bank for execution. This reversal of who initiates the payment drives every rule that applies to the instrument. It sets the dispute windows, the advance-notice obligations, the financial guarantees required of the creditor, and how long a collected payment can still be reversed.

The term “direct debit” covers three distinct things, and each system’s rules name them separately. The authorization is the act by which the payer consents. It is called a mandate in Europe, a Direct Debit Instruction in the UK, a Direct Debit Request in Australia, an authorization in the US, and a recorrência in Brazil. The collection instruction is the message a creditor sends its bank for a specific due date. The rail is the system that clears and settles the transactions. A single rail often carries two authorization regimes that give opposite rights. The creditor’s exposure therefore depends on the authorization regime that applies, not on the rail the payment travels over.

Direct debit systems are classified first by where the authorization is stored. There are four options: with the creditor itself, with the payer’s bank, with a central third party, or in the payer’s banking app. That location determines who bears the burden of proof in a dispute. It also sets how long the transaction can be reversed, and the channel through which the creditor learns that a customer has canceled.

SEPA Direct Debit: two rulebooks, two risk regimes

SEPA Direct Debit is the direct debit scheme shared across the Single Euro Payments Area, live since 2009. Its rules are written by the European Payments Council, an industry association that publishes the rulebooks but runs no infrastructure. Clearing goes through EBA Clearing, national clearing houses, or bilateral links between banks. SEPA covers 41 participating countries (EPC), well beyond the euro area and the European Union. Two schemes share the same brand. Core and B2B give the payer rights so different that the creditor’s risk changes by an order of magnitude.

• The SEPA creditor identifier (SCI) and the unique mandate reference (UMR) together identify a mandate anywhere in SEPA. A single identifier covers all 41 countries; a creditor does not need one per market.
• Pre-notification at least 14 calendar days before the due date, unless both parties agree on a shorter period. A dated schedule showing the amounts counts as pre-notification for every line on it.
• Submission no later than D-1 (business day) and no earlier than D-14, whatever the sequence type. The due date D is the date the payer’s account is debited.
• Expiry after 36 months: a mandate with no collection submitted for 36 months lapses. Resuming collections requires a new mandate and a new reference.
• The rulebooks in force are the 2025 v1.1 versions (EPC016-06 for Core, EPC222-07 for B2B), effective since October 5, 2025.

After eight weeks, the rules change. The only transactions that can still be disputed are those presumed unauthorized: the mandate does not exist, was revoked with the creditor, or lapsed after 36 months. The payer’s bank then opens a request for proof of consent, and the creditor must produce the mandate. The outer limit is 13 months after the debit. An SDD Core collection therefore stops being refundable without a reason after eight weeks, but the residual exposure tied to the mandate lasts more than a year.

SEPA Direct Debit coexists with domestic direct debit schemes that it did not replace. Switzerland runs LSV+ (SIX) and Debit Direct (PostFinance) outside SEPA for its Swiss franc payments. Denmark, Norway, and Sweden keep Betalingsservice, AvtaleGiro, and Autogiro, denominated in their own currencies. Germany has used the Elektronisches Lastschriftverfahren at the checkout since 1980: a direct debit mandate signed at the point of sale, with no payment guarantee and no scheme fee. It skews every comparison of card market share in the country. Finland went the other way. Its national direct debit disappeared in 2012, and Finnish banks chose not to offer SDD, favoring e-invoicing instead.

US ACH debits: an authorization, not a mandate

In the US, the authorization is the act by which the payer consents to be debited over the ACH network, and its form depends on the channel used to obtain that consent. The US system has no mandate in the European sense: no standardized creditor identifier, no mandate reference in the message, and no sequence check. The form of authorization is declared in a three-letter code, the SEC code, carried in the ACH entry. The rules are written by Nacha, a private association. Clearing is handled by two competing operators, FedACH (the Federal Reserve Banks) and EPN (The Clearing House). No other country has two clearing operators side by side in this way.

The ODFI (Originating Depository Financial Institution), the bank that sends the entry into the network, bears the risk. It gives Nacha contractual warranties on the entries it submits. In return, it imposes reserves, submission limits, and requirements on third-party processors on the creditor. A US creditor therefore negotiates its access terms with its bank, not with the scheme, and each ODFI sets its requirements based on its own risk appetite.

Two changes have reshaped ACH debits. The first is Same Day ACH, launched in 2016, which offers three same-day settlement windows. Its per-payment limit was raised to $1 million in March 2022. It handled 1.4 billion payments worth $3.9 trillion in 2025, up from 1.2 billion and $3.2 trillion in 2024 (Nacha, 2026). The second is account validation, required on the first WEB debit to a given account since March 19, 2021. Checking how the provider implements it is the first audit item for any US program. The legal foundation remains Regulation E (12 CFR 1005), which protects consumers against unauthorized transfers. Other disputes fall outside its scope.

Bacs: the Service User Number and the Direct Debit Guarantee

Bacs is the UK’s batch clearing system for sterling payments, in service since 1968. It is owned by Pay.UK and operated by Vocalink, a Mastercard subsidiary. It carries two products: Bacs Direct Credit for salaries, pensions, and benefits, and Direct Debit for recurring bills. The UK processed 5.0 billion direct debits in 2025 over Bacs, out of 6.86 billion Bacs payments worth £6.05 trillion (Pay.UK, 2025 annual statistics). The rail has 33 direct participants and about 330 indirect participants (Pay.UK, end of 2025).

Access to the scheme goes through the Service User Number (SUN), a six-digit identifier that the sponsoring bank assigns to the creditor. The number identifies the entity financially liable for indemnity claims, and the creditor gets one only after showing its bank that it is financially strong enough to repay them. A creditor without a SUN goes through a bureau service and collects under a third party’s number. That third party then carries the liability the scheme attaches to the number.

• AUDDIS (Automated Direct Debit Instruction Service): setting up and canceling instructions, initiated by the creditor.
• ADDACS (Automated Direct Debit Amendment and Cancellation Service): amendments and cancellations made by the payer or their bank; the file that tells you a customer has just left.
• ARUDD (Automated Return of Unpaid Direct Debits): the cycle’s unpaid debits, with the reason for each.
• DDICA (Direct Debit Indemnity Claim Advice): notice of an indemnity claim, meaning a refund already paid to the payer and recovered from the creditor.
• Advance Notice: the creditor tells the payer the amount and date before each debit. The notice period is set in the sponsorship agreement: 10 business days by default, shorter if both sides agree.

Variable Recurring Payments (VRP), which grew out of UK open banking, are where this market is heading. The mandate lives in the payer’s banking app, and payments run over the Faster Payments rail. Settlement is immediate, with no comparable refund guarantee. Sweeping, meaning transfers between accounts held by the same person, is live; commercial VRP is not yet live at scale. The two models expose billers to different risks. With Bacs direct debit, a collection can be reversed with no time limit. With VRP, the customer can revoke the authorization instantly, alone, at any time, with no notice to the creditor.

Asia-Pacific: BECS, PayTo, GIRO, DuitNow AutoDebit

BECS (Bulk Electronic Clearing System), also known as Direct Entry, is Australia’s batch clearing system for retail payments, the equivalent of the US ACH. It went live in 1994 and is governed by the rules of AusPayNet, the industry’s self-regulatory body. It accepts transactions of up to A$100 million, though its day-to-day traffic is low-value: salaries, benefits, and bill payments. The authorization is called a Direct Debit Request (DDR). It comes with a DDR Service Agreement, in which the creditor sets out its own commitments to the payer on advance notice, dispute handling, and cancellation. AusPayNet publishes the BECS regulations, the BECS procedures, and drafting guidelines for DDRs.

BECS was supposed to be retired. In November 2023, AusPayNet had set a shutdown target of June 2030, in favor of the NPP instant payment rail. AusPayNet dropped that target date in December 2025, for lack of a credible account-to-account roadmap. The Reserve Bank of Australia published an updated risk assessment of BECS in March 2026 without setting a new deadline. The shutdown date is therefore open again. In the meantime, BECS still carries most of Australia’s recurring payments.

PayTo, launched in 2022 by NPP Australia (part of Australian Payments Plus), is BECS’s designated successor. Its mandate is a digital object that is created, amended, suspended, and revoked in real time in the payer’s banking app. Three features set it apart from earlier direct debit models and rule out reusing their integrations as is. Settlement is immediate and final. There is no multi-day reject window for the creditor to adjust its cash position. Revocation is unilateral and instant, and the payer exercises it with their own bank. Finally, the creditor learns that a customer has left the moment it happens, not at the next collection cycle.

India: NACH, e-NACH, UPI AutoPay, and the 2026 e-mandate framework

NACH (National Automated Clearing House), operated by NPCI since 2016, is India’s bulk clearing rail, carrying recurring direct debits one way and bulk disbursements the other. Its paperless version, e-NACH, registers a mandate online via Aadhaar, net banking, or a debit card, with no paper form and no wet signature. UPI AutoPay is the equivalent on the instant payment rail: the mandate is linked to the payer’s UPI ID and executed by the switch. Indian creditors therefore have two families of mandates, running on two separate rails. Success rates depend on which family they choose.

NACH also handles a use case that no other country runs at this scale. Through the Aadhaar Payment Bridge System (APBS), the Indian government pays direct benefit transfers to hundreds of millions of recipients identified by their Aadhaar number rather than an account number. Routing relies on a continuously updated mapping table between Aadhaar numbers and bank accounts, not on the paying agency’s own database of bank details. On the debit side, the value processed on NACH Debit is growing about 27% a year (NPST analysis of RBI data, 2026).

The legal framework for these mandates was rewritten on April 21, 2026. The Digital Payments – E-mandate Framework, 2026 (circular RBI/CO.DPSS.POLC.No.S56/02.14.003/2026-27) repeals the circulars issued since 2019 and consolidates them into a single text. It applies equally to cards, UPI, and prepaid instruments, for both domestic and cross-border recurring transactions.

• The first transaction under a mandate always requires an additional factor of authentication (AFA). No exceptions.
• After that, AFA is not required up to ₹15,000 per transaction. Above that amount, it is required again at the time of debit.
• Threshold raised to ₹1 lakh per transaction for three categories: insurance premiums, mutual fund subscriptions, and credit card bill payments.
• Pre-debit notification at least 24 hours before each debit, showing the payee’s name, the amount, the date and time, the mandate reference, and the purpose.
• The right to decline individual transactions, and mandate revocation validated with AFA.
• No charges to the customer for using the e-mandate service, and a post-debit notification listing the ways to file a complaint.

Pix Automático: a mandate born on an instant payment rail

Pix Automático is the recurring payment authorization feature of Brazil’s Pix system, defined in Article 11-Q of the Pix regulation annexed to Resolução BCB No. 1 of August 12, 2020. It went live on June 16, 2025, a date set by Resolução BCB No. 402 of July 22, 2024. The payer’s provider automatically initiates a Pix from the payer’s account on instruction from the payee’s provider, subject to the payer’s prior, specific authorization. It runs on the Pix rail, which carried 79.8 billion transactions worth R$35.36 trillion in 2025 (BCB, 2026).

• Mandatory for payer-side providers: every Pix participant that offers transaction accounts must offer Pix Automático to its customers. Offering it as a payee’s provider is optional.
• Business payees only, with an active CNPJ (Brazilian company registration number). Pix Automático does not handle person-to-person transfers or one-off payments.
• Free for the payer: payers cannot be charged. The payee’s provider is free to charge its own customer.
• No brand of its own: the Banco Central do Brasil prohibits any derived logo or symbol. You cannot put a badge on a Pix Automático flow.
• Declared frequency (weekly, monthly, quarterly, semiannual, or annual), with an open-ended term, a set number of payments, or an end date.

Two features specific to Pix Automático have no equivalent in the other systems covered here. The first is the Pix Automático limit, a daily cap per transaction account, separate from the standard Pix limit and not overlapping with it. A request to raise it must be processed within 8 hours at most, compared with at least 24 hours for the standard Pix limit (BCB Normative Instruction No. 512 of August 30, 2024). The second is the credit line attached to the account, drawn on by default when funds are insufficient. The payer can turn it off authorization by authorization, from the Pix Automático menu in their app.

Dispute windows compared

The dispute window is the period during which a direct debit that has already been collected can still be clawed back from the creditor’s account. Each scheme’s rules set its length, which ranges from two days to unlimited depending on the country. A collection becomes earned revenue only once that window has closed. The table below ranks the regimes from shortest to longest exposure.

These regimes fall into three groups. B2B and instant regimes expose the creditor little or not at all, since the payment is final within days, sometimes seconds. Traditional consumer regimes expose it for 2 to 13 months, and the burden of proof falls on the creditor. The UK regime is a group of its own, because it has no time limit at all. A company selling the same subscription in Munich, Chicago, and Manchester therefore needs three different provisions for an identical product.

These windows apply alongside local law; they do not replace it. A refund denied under the rulebook may still be owed under consumer law, and vice versa. The scheme governs how funds move between banks; it does not decide the underlying dispute between the creditor and its customer.

Running a multi-country direct debit program

A multi-country direct debit program collects recurring receivables over several national rails from a single billing system. Its hard problems are the mandate registry, evidence retention, and cash forecasting, more than API integration or file formats. The most common integration failures come from a data model that assumes a universal mandate, and from a retry policy tuned for a single return regime.

• Treat return files as product data. ADDACS and ARUDD in the UK, R codes in the US, SEPA R-transactions, pain.011 and pacs.002 in Brazil: on rails where the mandate lives with the payer, these are the creditor’s only cancellation signals.
• Tell revocations apart from returns. A US R07, an ADDACS cancellation, or a canceled Pix authorization ends the series for good. Retrying after one is a breach of contract, not a collections optimization.
• Choose the strictest regime the customer will accept. SDD B2B rather than Core when the payer is a business, CCD rather than PPD in the US: you trade friction at sign-up for exposure that is orders of magnitude smaller.
• Check account validation at enrollment. Required on the first US WEB debit since March 19, 2021, it is still the most cost-effective measure everywhere else: half of structural rejects come from account details that were wrong from the start.
• Track the unauthorized return rate separately from the overall return rate. It is the metric banks and scheme operators watch (Nacha sets a 0.5% threshold), and its drift, not the return rate, is what gets a creditor cut off from the rail.

Legacy rails such as Bacs, ACH, BECS, and GIRO are not going away, despite announced shutdown timetables. Australia has withdrawn its deadline. A second generation of mandates is growing alongside them, hosted at the payer’s bank and running on instant payment rails: PayTo, Pix Automático, UK Variable Recurring Payments, and UPI AutoPay. This generation removes return risk and replaces it with revocation risk. For a biller, the work shifts from managing returns to retaining customers, and the overall workload is no lighter.