Podcast 156: cVRP explained: open banking's challenge to cards and direct debit, with David Parker

For most of the last five years, UK open banking has lived under a recurring criticism: capability without consumer-facing impact. APIs were live, regulations were in place, and sandboxes were busy. None of it produced the consumer payment alternative the original PSD2 narrative implied.

This episode of the Fintech Garden Podcast steps into the moment that is starting to change.

In conversation with David Parker — founder and CEO of Polymath Consulting, Lead Ambassador to The Payments Association, and one of the longest-standing voices in UK payments — the focus is on cVRP: Commercial Variable Recurring Payments. The first open banking scheme was designed specifically to compete with card-on-file and direct debit.

The framing throughout the conversation is deliberate. This is not a forecast. This is a scheme with a CEO, a board, a published fee model, and merchants now being asked to put it on 2027 roadmaps.

The Phase Structure Is Doing Most of the Strategic Work

cVRP is launching in two phases, and the phase design is more important than most commentary acknowledges.

Phase 1 covers “safe businesses” — charities, utilities, investment accounts, and own-account transfers. No consumer protection layer. Fixed fee of approximately 7p per transaction plus the PISP charge, landing roughly at 10p to 12p all-in.

Phase 2 expands to broader retail with ad valorem pricing, likely around 15 basis points, with consumer protection. Pitched as an alternative to card-on-file at materially lower cost.

The sequencing is intentional.

Phase 1 generates volume in segments where the economic case is obvious and consumer protection is not the deciding factor. Phase 2 broadens to retail once operational maturity, brand recognition, and merchant tooling are in place.

This is the “crawl, walk, run” approach David refers to throughout. The crawl was longer than anyone expected. The walk is happening now. The run is what 2027 looks like if the volume builds.

cVRP Beats Card-on-File on Control, Not Just Price

The cost argument is real. 10-12p versus 20-30 basis points blended for card-on-file is a meaningful gap for high-volume recurring collectors.

But the structural argument is stronger than the price argument.

Card-on-file gives the merchant ongoing access to the user’s card. cVRP gives the user ongoing control over what the merchant can take.

A consumer paying for a streaming service on cVRP can cap the maximum monthly draw at £35, limit the agreement to 12 months, and revoke access instantly from the banking app. None of that exists on card-on-file at the consumer level.

This is the kind of functionality Mastercard built years ago through its Orbiscom acquisition — but kept in the B2B virtual card market under “Mastercard in Control.” It was never extended to consumers, partly because cards run on pull rails where these controls are harder to implement, partly because the commercial incentive favored the merchant.

cVRP runs on push rails — Faster Payments — which makes consumer-side control structurally natural.

Once users discover the controls, the user experience advantage compounds.

cVRP Fixes the Broken 25% of Direct Debits

Direct debit is cheap, reliable, and entrenched in UK consumer behavior. For roughly 75% of users with predictable income, it works.

The remaining 25% is where the failure mode lives.

Consumers paid weekly or with variable income see direct debits decline at higher rates. The cost of failure is asymmetric — the consumer pays bank fees, the merchant pays customer service costs, and the support workflow around changing direct debit windows is genuinely frustrating for both sides.

cVRP solves this with a two-step pattern.

First, an AIS (Account Information Service) call verifies that funds are actually available. Then, the cVRP push is initiated.

David’s framing: direct debit fires a missile in the dark. cVRP sends a tracker first, locates the target, then sends the missile.

For utility companies and subscription services with high-variability customer cohorts, this is operationally significant. The savings are not in displacing direct debit broadly. The savings are in resolving the 25% that has been quietly expensive for everyone for years.

Integration Is Lighter Than Merchants Expect

A common merchant assumption is that adding cVRP requires substantial reengineering. It does not.

Funds arrive via Faster Payments. Most UK merchants already receive Faster Payments. The infrastructure for inbound settlement is in place.

The work happens at two layers.

Gateway integration — the existing payment gateway needs to recognize and process cVRP authorization. Reconciliation — back-end accounting needs to handle the new flow.

That is meaningful work, but it is not foundational. Most modern payment orchestration platforms will handle cVRP integration as part of their roadmap, and once they do, individual merchants will integrate through their existing PSP relationship.

The one genuine operational challenge is settlement timing. Faster Payments can take five to ten minutes. For dispatch-immediate merchants, that delay matters.

For most online retail, where dispatch happens hours or days later anyway, it does not.

The Phase 2 Debate Will Define cVRP’s Competitive Position

The most strategically interesting part of the conversation is the open question of who counts as a “safe” merchant.

Phase 1 economics — fixed fees, no consumer protection — are reserved for charities, utilities, and similar low-risk categories.

Phase 2 introduces consumer protection and ad valorem pricing.

But Phase 2 covers retail. And retail is not uniform.

A Waitrose loyalty card customer doing a £250 monthly grocery shop has a chargeback risk profile closer to a utility customer than to a high-risk online seller. Should Waitrose argue for Phase 1 fixed-fee treatment for its loyalty cohort? Should other supermarkets follow? Where does the boundary between “safe” and “needs consumer protection” actually sit?

These conversations are happening now, and how they resolve will determine whether cVRP’s cost advantage holds across categories or only in narrow ones.

This is the part of the cVRP story that requires watching the scheme’s communications, not just its technical roadmap.

Scheme Viability Is the Open Question

cVRP currently exists because large industry players are funding the scheme operations. There is a CEO. There is a board. There is governance.

What is not yet sustainable transaction volume.

Some industry voices privately question whether cVRP will still exist in three years. Others compare it to contactless — slow adoption followed by sudden inflection.

David refuses to pick a side. But he points to a useful signal.

Amazon now accepts “pay from your bank” through open banking. That is not a small operator dabbling. That is the largest online retailer in the world, signaling that the rails are credible.

Whether that becomes a tipping point or remains an isolated case will define cVRP’s trajectory.

For merchants planning ahead, David’s recommendation is direct. Start your 2027 roadmap planning in the next three to four months. Have cVRP on it, along with broader open banking.

Brand Is the Hidden Adoption Variable

Every successful open banking scheme worldwide has one thing in common.

Swish in Sweden. iDEAL in the Netherlands. Pix in Brazil.

All three have strong acceptance marks — visible at checkout, recognized by consumers, and associated with a reliable experience.

cVRP currently does not.

The technical capability is in place. The economic case is in place. The regulatory framework is in place.

The consumer-facing identity is not.

For Phase 2 retail adoption to scale, that has to change. And it has to change soon.

The Global View: Concentration, Not Fragmentation

The conversation closes on a useful reframing of a common narrative.

Fintech commentary often describes the global payment landscape as becoming more fragmented. The reality is closer to the opposite.

Brazil’s Pix went from zero to dominant in three years. That is not fragmentation. That is the concentration into a new dominant rail.

Europe’s Wero is being politically supported in a way that suggests consolidation, not dispersion.

Russia and India have effectively excluded international card schemes in favor of domestic alternatives.

What is increasing globally is the number of relevant local payment methods that any cross-border merchant must integrate. Whether that looks like fragmentation depends entirely on which side of the integration the merchant sits on.

For global operators, the obligation is the same regardless of framing. Alternative payment methods are no longer optional. They are a structural component of any modern commerce stack.

Stablecoins Remain a B2B Story

A short but useful exchange near the end of the episode.

Stablecoins are not yet a meaningful B2C payment instrument. The active center of gravity is wholesale B2B settlement.

That may change. It may not.

For fintech operators allocating product investment, this is a useful filter. The hype is high. The consumer volume is not.

The Operator Takeaway

cVRP has spent the last five years in a long crawl phase. The conversation makes a clear case that the walk and run phases will move faster than the crawl suggested.

For merchants — start the 2027 planning now. For payment gateways and PSPs, cVRP integration is becoming roadmap material. For consumers, the controls cards never offered are about to become standard. For regulators and the scheme operators, brand recognition is the hidden constraint.

UK open banking is finally producing a consumer-facing rail that competes on more than principle. The next two years will determine whether it stays that way.