Pay by Bank in Hosted Checkout

Use this for: one-off or recurring Open Banking payments via Pay by Bank.

Hosted Checkout supports two types of Pay by Bank transactions:

• Single Immediate Payments (SIPs): one-off payments authorised by the customer in real time.
• Variable Recurring Payments (VRPs): ongoing payments made under a pre-approved mandate with configurable limits. This applies to both Sweeping and Commercial VRP.

The Pay by Bank type depends on the checkout scenario you configure:

One-off Payment (SIP)

Use this for: taking a single Open Banking payment from a customer.

For Pay by Bank (SIP), no additional fields are required beyond the standard transaction fields. The request structure is identical to one-off payments made with cards or wallets, created with Create payment links. See the One-off Payments page for full details.

Response

A successful request returns a link_id. Redirect the customer to the Hosted Checkout page for that link to complete the payment. The same response is returned for VRP mandate setup.

{
  "status": "success",
  "link_id": "01HZ6XKQR4NJTV8S2BWMCEGP7Y"
}

How it Works

1. The customer selects Pay by Bank at checkout.
2. They are redirected to their banking app or online banking portal.
3. The customer reviews and authorises the transaction.
4. The bank processes the payment instantly via Faster Payments.
5. Hosted Checkout confirms the outcome via status_update webhook and form POST. See Handling Hosted Checkout Responses for the payload, and Statuses for the values a payment can return.
6. Funds settle into your Acquired ledger and are batch settled to your external bank account each working day. See Settlement and the settled status.

Funds are transferred in real time, and no credentials are stored for future use.

Variable Recurring Payments (VRPs)

VRPs allow you to set up a mandate that authorises future payments within defined limits (amounts and frequency).

Unlike SIPs, which are single transactions, VRPs follow a two-step flow:

1. Mandate Setup via Hosted Checkout.
   You set the mandate details in the Create payment links request:

   • Maximum per-payment amount
   • Periodic limits (e.g. £100 per month)
   • The mandate's validity window, if you need one

   The customer is then redirected through their bank's Open Banking flow to authorise the mandate, selecting the account it will be taken from.

   Once authorised, a mandate_active webhook confirms the mandate is live. See Webhook Notifications for the payload.

   You can retrieve the full mandate at any point with Retrieve an open banking mandate. The response returns the limits you set, plus the details added during authorisation: the debtor account the customer selected, the creditor account payments are made to, the mandate status, term and reference.

   To create and manage mandates yourself rather than through Hosted Checkout, see Stage 1: Mandate setup on the Recurring Pay by Bank page.

2. Payment Initiation (outside Hosted Checkout).
   Future payments are initiated by you with Initiate a variable recurring payment. No customer interaction is required, as long as payments remain within the agreed mandate parameters.

VRP Scenarios

VRPs in Hosted Checkout use the same baseline fields as when storing credentials for cards and digital wallets, plus VRP mandate details. For those baseline fields, see Store credentials only and Charge + store credentials.

The following fields are required in addition to those baseline fields:

VRP Mandate Requirements

To successfully offer VRPs via Hosted Checkout, within the configuration.variable_recurring_payment you must include:

• type: the type of variable recurring payment (sweeping or commercial)
• periodic_limit.per_payment.maximum_amount: the cap per payment
• At least one period limit within periodic_limit (e.g. day, week, month) containing:
  • maximum_amount: cap for that period
  • alignment: calendar or consent (not required for the fortnight periodic limit; this defaults to consent)

These parameters define the scope of the customer's authorisation and must be honoured in every payment request under the mandate. If any of these fields are missing or malformed, the Create payment links request will fail.

Store Credentials Only vs. Charge + Store Credentials

The distinction between Store Credentials Only and Charge + Store Credentials depends on a combination of transaction.capture and transaction.amount:

Example Request

The payload below shows the baseline VRP structure. Toggle transaction.capture to switch between Store Credentials Only and Charge + Store Credentials scenarios:

{
  "transaction": {
    "order_id": "vrp-001",
    "currency": "gbp",
    "amount": 10.00,
    "capture": false
  },
  "is_recurring": true,
  "payment": {
    "reference": "Monthly Plan"
  },
  "configuration": {
    "variable_recurring_payment": {
      "type": "sweeping",
      "periodic_limit": {
        "per_payment": {
          "maximum_amount": 100
        },
        "month": {
          "maximum_amount": 300,
          "alignment": "calendar"
        }
      }
    }
  },
  "recurring": {
    "term": {
      "start_date": "2025-09-01",
      "end_date": "2026-09-01"
    }
  }
}

As with a SIP, a successful request returns a link_id to redirect the customer to. Set transaction.capture to true for the Charge + Store Credentials scenario. The payment.reference field is optional and defaults to your company name if omitted. The recurring.term object is optional; omit it if you do not need a validity window.

VRP Mandate Cancellations

VRP mandates can be cancelled by the customer either via their banking app or through the hosted Acquired revocation flow. Once cancelled, no further payments can be initiated under that mandate, even if the mandate limits have not been reached. For the revocation URL parameters, the redirect response and hash validation, see Cancel a Mandate.

VRP Mandate Cancellation at Bank

Customers can revoke consent directly from their bank at any time.

When this happens:

• The bank cancels the VRP mandate
• Acquired will send a mandate_cancelled webhook notification — see Webhook Notifications for the payload
• You should update your internal customer billing state accordingly

VRP Mandate Cancellation via Hosted Flow

In addition to cancellation through the bank, merchants must provide customers with the option to cancel a VRP mandate through a hosted Acquired journey.

To do this, redirect the customer to the VRP revocation URL for your environment:

The hosted revocation flow:

1. Displays mandate and payee details
2. Allows the customer to confirm cancellation
3. Cancels the mandate via Acquired's internal VRP cancellation API
4. Sends a mandate_cancelled webhook
5. Redirects the customer back to your application