The Mandate

36.0 What this chapter gives you#

1. You will be able to say what a Direct Debit Instruction legally is, and why it is an authority given to the service user rather than a contract with the payer’s bank.
2. You will be able to state what the Direct Debit Guarantee actually promises, who makes the promise, and who ends up paying for it.
3. You will be able to trace the money in a disputed collection from the payer’s immediate refund, through the paying bank, to the indemnity claim that debits the service user’s own account.
4. You will be able to count an advance notice period correctly and say what the notice must contain if it is to win a challenge.
5. You will be able to choose between paper, AUDDIS and Paperless Direct Debit for setting up a mandate, and say what obligations each route carries.
6. You will be able to read a DDICA reason code and say whether the claim is about notice, cancellation, authority or the name on the statement.
7. You will be able to work out the challenge deadline from the day a claim is reported, and say what happens at the end of working day nine and working day eleven.
8. You will be able to explain why the Guarantee is faster and broader than the Payment Services Regulations 2017, and where regulation 79(3) does and does not apply.
9. You will be able to explain why cancelling a Direct Debit cancels nothing else, and why a refunded payer may still owe the money.
10. You will be able to name the design choices that keep a collections product alive: storing the notice document, actioning ADDACS within three working days, treating day nine as code rather than a runbook, and putting the trading name in field 9.

Every other payment in this book is something you do. You tap a card, you press send, you hand over a note. A Direct Debit is something you stop doing. You do it once, and thereafter the money leaves without you touching anything, on dates you may not remember, in amounts you did not choose, for as long as neither side gets round to stopping it.

That is an extraordinary thing to hand to a stranger, and roughly five billion times a year in the United Kingdom people hand it over without a second thought. In 2025, Bacs processed 5.03 billion Direct Debits — a record for the system — as part of 6.86 billion Bacs payments worth £6.05 trillion in total. Nine in ten UK adults with a bank account have at least one Direct Debit running.

They do it because of a single short document that almost nobody reads: the Direct Debit Guarantee, five bullet points long, printed on the tear-off half of every mandate form and reproduced on every biller’s website. It is the most generous consumer protection attached to any sterling payment rail. It is more generous than the statutory rights that sit underneath it. And it is generous in a way that costs the person collecting the money, not the person paying it, which is why it works and why it is expensive to abuse.

The previous chapter covered the three-day cycle that carries the collection. This chapter covers the authority that permits the collection in the first place: what a Direct Debit Instruction legally is, how one is created on paper, by file, or over the telephone, what notice must be given before money moves, what happens when the payer objects, and — the question that decides whether a collections business survives — who ends up out of pocket.

The plain version#

Imagine you have an account at the corner shop.

The old way of settling it was that you walked in every month and paid what you owed. That works, but it means the shopkeeper has to chase you when you forget, and you have to remember. So you try something else. You write a short note and give it to the shopkeeper. The note says: take what I owe you, out of my money-box, on the first of every month. You sign it. The shopkeeper keeps it.

Two things about that note matter more than anything else in this chapter.

The first is that the note does not say an amount. You have not said “take £30”. You have said “take what I owe you”. The shopkeeper decides how much, and when, within whatever you agreed about the goods. That is what makes the arrangement useful — your bill genuinely does change month to month — and it is also what makes it frightening.

The second is who the note is addressed to. It looks as though you are giving permission to the shopkeeper. What you are actually doing is telling your bank that the shopkeeper is allowed to reach in. The bank is the one holding the money-box. It will honour requests from anybody you have named on a note like this, and it will not ring you up first.

The promise that makes it safe#

If that were the whole arrangement, nobody sensible would sign the note. So there is a second document, and it is the reason Direct Debit is trusted in Britain in a way that no equivalent arrangement is trusted in most other countries.

Your bank makes you a promise. It is short enough to say in full, and it is worth saying in full, because the exact words are the whole point:

If there are any changes to the amount, date or frequency of your Direct Debit, the organisation will notify you — normally ten working days — in advance of your account being debited, or as otherwise agreed. If an error is made in the payment of your Direct Debit, by the organisation or by your bank or building society, you are entitled to a full and immediate refund of the amount paid from your bank or building society. If you receive a refund you are not entitled to, you must pay it back when the organisation asks you to. You can cancel a Direct Debit at any time by simply contacting your bank or building society.

Read the second sentence again, slowly. You are entitled to a full and immediate refund from your bank. Not from the shopkeeper. Not after an investigation. Not if the bank agrees with you. You go to your own bank, you say an error has been made, and the money comes back.

There is no minimum amount. There is no stated deadline in the promise itself. There is no requirement to argue with the shopkeeper first. The bank refunds you and then goes and sorts it out with the shopkeeper afterwards, at its own inconvenience.

Where the money actually comes back from#

Here is the part people miss. The bank refunds you out of its own till, but it does not stay out of pocket. It turns round and takes the money back off the shopkeeper — directly out of the shopkeeper’s own bank account, without asking the shopkeeper first.

So the sequence is: shopkeeper takes £39.99 from you; you object; your bank immediately gives you £39.99; your bank then debits £39.99 from the shopkeeper. The shopkeeper can dispute that, with evidence, within a short window. If the shopkeeper does nothing, the money simply goes.

That is the entire economics of the Direct Debit Guarantee in one paragraph. The person collecting the money carries the risk of being wrong. Not the payer, and not, in the end, the bank.

A worked example, with real numbers#

Northgate Leisure runs a gym. It collects £34.99 a month by Direct Debit from 4,100 members on the first working day of each month.

In September 2026 it decides to raise the price to £39.99 with effect from the October collection, which falls on Thursday 1 October 2026.

The Guarantee’s default notice period is ten working days. Counting back ten working days from Thursday 1 October gives Thursday 17 September, and the notice has to arrive by then, so in practice Northgate posts and emails its members in the second week of September. The notice says the new amount, £39.99, and the date, 1 October, and it says who is collecting it in the name members will actually recognise on their statements.

On 1 October, 4,100 collections of £39.99 land. Total: £163,959.

One member, Mr Hale, does not remember any letter. On Monday 5 October he telephones his bank and says the gym has taken the wrong amount. His bank does not ring the gym. It does not ask him for the letter. Under the Guarantee it credits £39.99 back to his account that day.

His bank is now £39.99 down, so it raises an indemnity claim against Northgate Leisure. The claim reaches Northgate through a report on Tuesday 6 October. That day counts as working day one. Northgate has until the end of working day nine — Friday 16 October 2026 — to challenge it, and the only thing that will win the challenge is a copy of the advance notice showing the amount, the date and the address it was sent to.

If Northgate can produce it, the claim is cancelled and Northgate keeps the £39.99. If Northgate cannot produce it, or simply does not act in time, £39.99 comes out of Northgate’s bank account and Mr Hale keeps his refund.

And here is the sting in the tail: Mr Hale still owes the gym for October. The refund undid the payment. It did not undo the membership.

Why anybody collects money this way#

Given all that, why would Northgate use Direct Debit at all?

Because the alternative is worse. Cards expire, get reissued and get declined, and every failure needs a human being to chase it. With Direct Debit, Northgate knows on a fixed date that £163,959 will arrive in one lump, it reconciles only the exceptions, and the bill collects itself for years without either party doing anything. The Guarantee is the price of that, and for a business genuinely giving correct notice and taking correct amounts the price is low, because most claims never happen: most collections are right.

The Guarantee is not a tax on collecting money. It is a tax on collecting money carelessly.

Where the plain version stops being true#

The note is not addressed to your bank, and the Guarantee is not law. The plain version says you are telling your bank that the shopkeeper may reach in. Legally, a Direct Debit Instruction is an authority given by the payer to the service user — Bacs’ own definition is “an authority (paper, AUDDIS or PDD) from the customer allowing the service user to collect Direct Debit payments from their account” — and the Bacs guidance for anyone producing a mandate states flatly that “the DDI is not evidence of any contract between you and your customer’s payment service provider”. A copy is lodged with the paying bank so that it knows the collection is expected, but the mandate is not an agreement with that bank. Nor is the Guarantee a statute. It is a scheme rule: a promise that Pay.UK’s Bacs rulebook obliges every participating bank and building society to offer, enforced through contracts between scheme participants rather than through an Act of Parliament. Underneath it sit genuine statutory rights, in the Payment Services Regulations 2017, and those rights are in several respects narrower than the Guarantee. The technical section sets them side by side.

“Immediate” describes one side of the transaction only. The payer’s refund is immediate. Everything on the other side runs on working-day clocks: the claim reaches the collecting organisation through a batch report, the challenge window is counted in English bank working days, and the paying bank’s response has its own cut-off. A payer refunded on a Monday afternoon may be looking at a business whose money does not actually move for another fortnight. Cash-flow models that treat indemnity claims as instantaneous are wrong in both directions.

Almost no modern mandate is signed. The corner-shop image has a signed note, kept by the shopkeeper. In 2026 most new Direct Debits are set up over a website or a telephone with no signature anywhere in the process — Paperless Direct Debit — and the mandate travels to the payer’s bank as an electronic record through AUDDIS. That shifts a large burden. When there was a signature, the paying bank checked it. When there is not, the collecting organisation is responsible for establishing that the person giving the account details is entitled to give them, and it carries the loss if they were not. Modulus checking, which most systems do and which the scheme recommends, confirms only that a sort code and account number could exist together. It says nothing whatever about who owns the account.

Cancelling the Direct Debit does not cancel anything else. Telling your bank to stop paying the gym stops the payments and nothing more. The membership contract survives, the debt keeps accruing, and the gym is entitled to pursue it. The Guarantee is explicit that it does not affect the contract between payer and biller: you can claim the money back and still owe it. In the other direction, a mandate that nobody uses does not last forever either — paying banks remove dormant instructions after a set period, so a service user that stops collecting for a year or more may find the authority has quietly disappeared.

The Guarantee covers the mechanics, not the merits. It protects you if the amount, date or set-up was wrong. It does not protect you if the gym is terrible, if the goods never arrived, or if the company goes into administration owing you nine months of prepaid membership. Those are contract disputes, and the route for them is the biller, then the biller’s complaints process, then the courts — not the bank. Section 75 of the Consumer Credit Act and card chargebacks, which do reach into the merits, do not apply to Direct Debit at all.

The technical version#

The parties, and what each of them signs#

Five roles matter, and confusing any two of them produces most of the bad documentation on this subject.

The payer is the account holder whose account is debited. The service user is the organisation collecting, identified by a six-digit Service User Number (SUN) allocated by its bank. The paying payment service provider (paying PSP) holds the payer’s account, lodges the instruction on its records, applies the collection and, critically, is the party that owes the Guarantee. The sponsoring PSP is the bank that authorises the service user to submit to Bacs at all, vets it, sets its limits and stands behind it. And Pay.UK is the scheme operator and rule-maker, with Vocalink as the infrastructure provider that physically processes the files.

The service user’s own signature appears on a document the payer never sees: the indemnity. Bacs defines it as “a document under the Direct Debit Scheme that contains a legally binding undertaking to make payment to any paying PSP in response to an indemnity claim”, and adds that “an indemnity, in standard form, is an essential requirement of the Direct Debit Scheme”. That sentence is the legal engine of everything in this chapter. The Guarantee is a promise the paying bank makes to the payer; the indemnity is a promise the service user makes to every paying bank in the country, in advance, that it will make good whatever the Guarantee costs them.

Against the SUN, the scheme maintains a record on the Direct Debit Originator database (DDO): contact details, AUDDIS status, dormancy period, and the service user’s agreed advance notice period. That last field is not decorative. It is the number a paying bank looks at when deciding whether a claim about insufficient notice is well founded.

The mandate document#

The Direct Debit Instruction is a controlled document. Bacs publishes ten standard templates in A4, A5 and small formats, with and without an “official use” box, and the rule is that all DDIs must follow all of the wording and the order of the information in those templates. The design must be approved in writing by the sponsoring PSP before use, and again after any change. The Direct Debit logo is mandatory on every DDI.

The instruction half of the standard form carries these fields: the service user’s name and address, the six-digit Service User Number, the name or names of the account holder or holders, the branch sort code, the bank or building society account number, the name and full postal address of the payer’s bank or building society, a reference, a signature and a date. The operative sentence is fixed:

Please pay [service user] Direct Debits from the account detailed in this Instruction subject to the safeguards assured by the Direct Debit Guarantee. I understand that this Instruction may remain with [service user] and, if so, details will be passed electronically to my Bank/Building Society.

The Guarantee sits on a detachable portion, headed with the instruction that it “should be detached and retained by the payer”.

Several operational rules follow from the form and are routinely broken by first-time service users. The customer must not add amount or date restrictions to the mandate; if they have, the mandate is not valid as submitted. The mandate may only be lodged with the paying PSP by the service user, never posted in by the customer. Tear-off slips carrying extra marketing or account information must be detached before the form is sent onward. And when a mandate is submitted electronically the amount field must be zero — every Direct Debit Instruction is for an unlimited amount, and a non-zero value produces an AUDDIS rejection with reason code 7, “DDI amount not zero”.

Three ways to create a mandate#

Non-AUDDIS (paper). The historic method. The payer signs a paper DDI, the service user sends the physical form to the payer’s bank branch or to that bank’s central lodgement address, and the bank keys it in. Slow, error-prone, and shrinking. Pay.UK has announced that from 1 July 2027 no new non-AUDDIS Service User Numbers will be created by PSPs. Existing non-AUDDIS SUNs may continue to lodge new paper instructions and to collect against existing ones, but any SUN created after that date will be electronic only. Note also that a service user cannot mix the two on one number: separate SUNs are required for AUDDIS and non-AUDDIS instructions.

AUDDIS (Automated Direct Debit Instruction Service). The service user keeps the signed original and transmits the mandate details electronically through Bacs to the paying PSP, which validates them and, if it accepts, sets up the instruction on its database. AUDDIS is mandatory for all new service users that submit directly to Bacs. Three transaction codes carry the traffic:

Rejections come back through the Bacs messaging service and appear on the AUDDIS Bank Rejected Direct Debit Instruction Report. Bacs states that notification of any rejected instruction will reach the service user within five working days of the instruction being sent to the paying PSP. Some failures — a failed modulus check, for instance — are caught by Bacs before the file ever reaches the paying bank and are returned immediately.

Paperless Direct Debit (PDD). Sign-up by telephone, website, telephone keypad, face to face or interactive television, with no signature at any point. PDD is available only to service users who already have live AUDDIS status and who satisfy additional criteria, and it carries a distinct set of obligations:

• The service user, not the bank, is responsible for verifying the customer’s identity, address and account details. Bacs publishes a Direct Debit verification measures document listing acceptable methods.
• Modulus checking at the point of sale is strongly recommended. It does not verify that the account belongs to the payer.
• Every telephone script, internet screen, confirmation letter and item of supporting material must be approved by the sponsoring PSP before use, and again after any change.
• Two members of staff must successfully complete the mandatory Paperless Direct Debit training course.
• One type of application per SUN is recommended, so that different sign-up channels can be monitored and controlled separately.
• Voice recording of telephone sign-ups is recommended.
• Service users may be subject to annual review of their PDD processes, and failure to comply with the scheme rules may result in removal of sponsorship and exclusion from the Direct Debit Scheme altogether.

PDD carries its own confirmation rule, and it is one of the most frequently misquoted requirements in the scheme. The service user must send confirmation to the customer within three working days of the verbal or internet instruction. Alternatively — and only if the first collection is made within a month of the Direct Debit being set up — the confirmation may incorporate the advance notice, in which case it must be received by the customer no later than the service user’s advance notice period before the first collection.

Two further timing rules apply to all mandates regardless of channel. All Direct Debit Instructions should be submitted to the paying PSP within ten working days of the customer signing, even if the first collection is months away. And if a paying PSP asks to see a copy of a mandate, the service user must provide it within seven working days of the request; failure to do so exposes the service user to liability for every Direct Debit collected under that instruction. For a PDD service user there is no signed copy to produce, which is precisely why a disputed authority nearly always ends in a refund.

Mandates also expire from disuse. Bacs’ published material is not internally consistent here, and practitioners should check the current rulebook rather than rely on either figure quoted second-hand: the Bacs glossary describes a default dormancy period of thirteen months, noting that this was temporarily increased to twenty-four months to limit the impact of pandemic payment holidays, while the Bacs FAQ states that paying PSPs hold DDI details for a minimum of twenty-four months from receipt or last payment. An extended dormancy period may be applied for through the sponsoring PSP at the point of joining AUDDIS. Whichever number applies, the operational consequence is the same: a service user collecting annually, or seasonally, must know its dormancy setting or its mandates will evaporate between collections.

Advance notice#

Advance notice is the single most important operational obligation in the scheme, because it is the obligation that most indemnity claims allege was breached.

The default period, in the absence of any other agreement, is a minimum of ten working days plus postal time. Working days for scheme purposes means English bank working days, excluding Saturdays, Sundays and public holidays, regardless of where in the United Kingdom either party sits. The period is recorded against the SUN on the Direct Debit Originator database, and it can be shortened by agreement with the payer — many subscription businesses run on three or five working days, stated in their terms — but the shortened period must be agreed, documented and reflected on the DDO, not simply adopted.

Notice is required in two circumstances. Before the first collection under a new mandate. And before any change to the amount, date or frequency of an existing one. Note what is not on that list: notice is not required before an unchanged, already-notified collection, which is why an annual notice covering a fixed schedule is sufficient for a fixed-amount arrangement.

The notice must reach the payer — the account holder, not a spouse, not an account administrator, not a purchasing department that happens to have signed the contract. It must state the amount and the date. It must identify the service user in the name the payer will actually see on the bank statement, which for organisations trading under a different name from their registered name means using the trading name that appears in field 9 of the Bacs record. And the notice document itself, like every other piece of Direct Debit literature, requires written approval from the sponsoring PSP before use.

Where the Guarantee says “or as otherwise agreed”, it is also worth noting the sentence that follows in the published wording: if the payer requests the organisation to collect a payment, confirmation of the amount and date is given at the time of the request rather than in advance. That is the clause that makes one-off, payer-initiated collections workable, and it is the clause that subscription businesses most often try to stretch beyond its meaning.

Failures of advance notice surface in three different message streams, which is a good indication of how seriously the scheme takes it: a collection returned unpaid with ARUDD reason code 4, “advance notice disputed”; a mandate amended or cancelled with ADDACS reason code D, “advance notice disputed”; and indemnity claims under DDICA reason codes 1 and 2. Bacs publishes best-practice material specifically aimed at reducing indemnity claim volumes, and clear, timely, correctly addressed advance notice is the first item on it.

The Guarantee, clause by clause#

The authoritative text, as published by Bacs and reproduced on every compliant mandate, is five bullets. Taken one at a time:

“This Guarantee is offered by all banks and building societies that accept instructions to pay Direct Debits.” The promisor is the payer’s own bank, not the biller and not Pay.UK. A payer never has to deal with the collecting organisation to obtain a refund, and a bank cannot decline on the basis that it disagrees with the payer’s account of events.

“If there are any changes to the amount, date or frequency of your Direct Debit [the organisation] will notify you (normally 10 working days) in advance of your account being debited or as otherwise agreed. If you request [the organisation] to collect a payment, confirmation of the amount and date will be given to you at the time of the request.” The notice obligation, restated to the payer as a right. The parenthesis is why “ten working days” is universally quoted as the rule despite being a default rather than a fixed requirement.

“If an error is made in the payment of your Direct Debit, by [the organisation] or your bank or building society, you are entitled to a full and immediate refund of the amount paid from your bank or building society.” The operative promise. Note the breadth: it covers errors by either party, it is full rather than partial, and it is immediate. There is no stated time limit, no minimum value, and no condition that the payer exhaust the biller’s complaints process first.

“If you receive a refund you are not entitled to, you must pay it back when [the organisation] asks you to.” The clawback. Practically, this is the clause that makes the whole design tolerable to service users: a refund obtained wrongly is recoverable as a debt, and a service user with good records can pursue it.

“You can cancel a Direct Debit at any time by simply contacting your bank or building society. Written confirmation may be required. Please also notify [the organisation].” Cancellation is unilateral, immediate and requires no justification.

How that compares with the statutory position#

It is worth being precise about the relationship between the Guarantee and the Payment Services Regulations 2017 (SI 2017/752), because a good deal of published commentary treats them as the same thing.

Under regulation 67, a payment transaction is authorised if the payer has consented to its execution; a Direct Debit Instruction is that consent, given in advance and for an unspecified amount.

Regulation 79 then gives the payer a right to a refund from its own PSP for an authorised transaction initiated by or through the payee, but only where two conditions are both met: the authorisation did not specify the exact amount, and the amount exceeded what the payer could reasonably have expected given previous spending, the framework contract and the circumstances. Regulation 80 requires the payer to make that request within eight weeks of the debit, and requires the PSP either to refund or to justify its refusal within ten business days.

Regulation 79(3) does provide an unconditional refund right, but it applies to euro direct debits within the scope of Regulation (EU) 260/2012 — the SEPA regulation — and not to sterling Bacs Direct Debits. This is the point most often got wrong: for a sterling Direct Debit, the unconditional right comes from the scheme Guarantee, not from statute.

Regulation 74 sets the long-stop: a payment service user loses the right to redress for an unauthorised or incorrectly executed transaction unless it notifies its PSP without undue delay and in any event no later than thirteen months after the debit date. Where a transaction genuinely was unauthorised — a mandate the payer never gave — regulation 76 requires the PSP to refund as soon as practicable and in any event no later than the end of the business day following the day it becomes aware, subject to a suspected-fraud exception.

Set side by side:

The practical consequence is that a UK Direct Debit payer almost never needs to invoke the statute. The Guarantee is faster, broader and unconditional, and banks apply it as a matter of course. Where a bank refuses, the payer’s route is the bank’s own complaints procedure and then the Financial Ombudsman Service.

Cancellation, and what it generates#

A payer cancels by contacting the bank or building society — increasingly by switching a toggle in a banking app — and the scheme’s own consumer guidance adds two pieces of practical advice: written confirmation may be required, and the cancellation should be made at least a full working day before a collection is due, because a collection already inside the three-day cycle may be too far along to stop. If money is nonetheless taken after cancellation, that is squarely within the Guarantee.

Cancellations and amendments reach the service user through ADDACS, the Automated Direct Debit Amendment and Cancellation Service. The reason codes a service user will actually see include:

ADDACS advices must be actioned immediately, or within three working days of receipt. That deadline is a scheme rule, not a courtesy, and repeated failure to observe it is a compliance matter with the sponsoring PSP. Reports are available on the Payment Services Website for a limited retention period — most Bacs reports for 37 calendar days, ADDACS and AWACS for 60 calendar days — after which they are gone from the service user’s view.

Cancellation from the service user’s side uses transaction code 0C, and the scheme also provides a cleaner mechanism for a planned ending: the collection transaction codes distinguish the first collection under a mandate (01), a subsequent collection (17), a re-presentation of a previously unpaid item (18), and the final collection (19). Submitting a collection as code 19 tells the paying PSP to delete the instruction from its records, and may produce a “final collection” annotation on the payer’s statement. Using it correctly avoids the common failure mode of a mandate left live for years after the last payment.

One structural point about cancellation deserves emphasis, because it explains a recurring category of indemnity claim. A payer who cancels with their bank and never tells the service user leaves that service user submitting collections against an instruction that no longer exists. Those collections will be returned unpaid, and if the payer is annoyed enough they may also generate a claim. The mirror-image case — the payer who cancels with the service user but not the bank, and the service user who fails to submit a 0C — leaves a live authority nobody intends to use.

Indemnity claims#

An indemnity claim is defined by Bacs as “a claim made by the paying PSP in respect of an incorrect Direct Debit being applied to an account”. It is the mechanism by which the Guarantee’s cost is passed from the paying bank to the service user, under the standing indemnity the service user signed when it was sponsored.

Claims arrive as DDICA advices in the service user’s Bacs reports, carrying one of eight reason codes:

Codes 1 and 2 are advance notice failures. Codes 3 and 4 are cancellation failures. Codes 5 and 6 are authority failures, and code 6 is the reason a Paperless Direct Debit service user must have documented verification: with no signature to produce, the claim is close to unanswerable. Code 8 is the quiet killer of subscription businesses trading under names their customers have never heard of.

Code 7 is different in kind. It is the route by which a service user raises a claim on behalf of a payer who has come to it directly asking for money back — a refund the service user has decided to make. Rather than sending the customer to their bank, the service user initiates the reversal itself through the Payment Services Website, and may enter details for up to twelve Direct Debits for a single payer in one request.

The challenge process. Since 4 March 2024 challenges are raised centrally through the Payment Services Website rather than by email to each individual paying bank; the old bank-by-bank process was closed on 31 May 2024. The timetable, as published in the Bacs DDIC Challenge Process service user guide and accurate at time of writing, works like this. The day the claim is raised and the report made available counts as working day one. The service user must raise any challenge before the end of working day nine; a claim neither accepted nor challenged by that point is automatically accepted, and the money leaves. Up to five pieces of supporting evidence may be attached — typically a copy of the Direct Debit Instruction, a copy of the advance notice, or a call recording. The paying bank then reviews and either accepts or rejects; a rejected challenge may be relodged with better evidence, still within the day-nine window. If the paying bank has neither accepted nor rejected a challenge by the end of working day eleven, the claim is automatically cancelled in the service user’s favour.

Older vendor documentation frequently quotes a fourteen-working-day window. That figure belongs to the pre-2024 arrangements; the operative deadline today is the end of working day nine. The authoritative text is the Service User’s Guide and Rules to the Direct Debit Scheme — version 5.9 at the time of writing — available to registered users on the Bacs site, and it is what a sponsoring bank will hold a service user to.

Four supporting reports are available through the Payment Services Website: a monthly challenge and response report summarising claims raised, challenged, accepted and rejected; an ad hoc challenge and response audit report produced within fifteen minutes of request; an in-progress challenge and response report; and an in-progress report for reason code 7 requests.

Refund requests are not indemnity claims. The scheme distinguishes the two. A refund request is a claim by a paying PSP for money back where the error was the paying PSP’s own — for example, it failed to action a cancellation and paid the collection anyway — and therefore falls outside the valid indemnity claim criteria. Settlement of a refund request is at the discretion of the service user. A service user that treats every incoming request as an obligation is paying for other people’s mistakes.

Who bears the loss, in order#

Putting the sequence in one place, because it is the answer to the question everyone actually has:

1. The payer bears no loss. The Guarantee makes them whole immediately, from their own bank, without conditions.
2. The paying PSP bears the loss temporarily. It funds the refund out of its own money for the days it takes an indemnity claim to run.
3. The service user bears the loss finally, in the ordinary case. The claim debits its bank account under the standing indemnity, whether or not it agrees, unless it challenges successfully inside the window.
4. The sponsoring PSP bears the loss if the service user cannot. That is the whole reason sponsorship exists, and the whole reason it involves financial assessment, account limits, document approval, mandatory training and the power to withdraw. A sponsor that lets an insolvent or careless service user run up claims is buying those claims.
5. The payer may still owe the underlying debt. A successful claim reverses the payment and leaves the contract intact. If the service is delivered and the contract is valid, the service user retains its ordinary legal remedies for the debt, including debt collection and the county court. The bank’s decision to refund is an administrative act under scheme rules, not a judgment on the contract.

That ordering is why the Guarantee can be as generous as it is. The cost of generosity is loaded onto the party best placed to prevent the error, and that party has posted a legally binding undertaking, is vetted annually, and can be removed from the scheme. Fraudulent set-up is a good illustration: Bacs’ own guidance states that where a payment is made against a fraudulent signature, the service user is liable, but the paying PSP must refund the customer immediately and then reclaim through an indemnity claim. The customer’s position is never in question. Only the allocation between the two institutions is.

The scale of it, as of writing#

Direct Debit is not a niche instrument, and the Guarantee therefore stands behind a very large fraction of British household finance. Pay.UK’s published Bacs statistics for 2025 record 5,029,499 thousand Direct Debits — 5.03 billion — from a Bacs total of 6.86 billion payments worth £6.05 trillion. Over 113 billion Direct Debits have been collected since the mechanism began, out of more than 183.6 billion Bacs transactions since 1968.

The 2025 breakdown gives a sense of what the mandate actually carries:

Within those, the individual lines are instructive: 648 million mobile telephone collections, 398 million general insurance, 304 million domestic fuel, 232 million council tax, 188 million water, 157 million television licences and 149 million road tax. These are not discretionary purchases. They are the fixed costs of running a household, and they are collected on an authority the payer can revoke in ten seconds and reverse without giving a reason.

A note for implementers#

If you are building a collections product, the following is the short list that separates systems that survive their first year from systems that do not.

Store the advance notice, not just the fact that one was sent. A challenge under DDICA code 1 or 2 is won or lost on producing the document, its amount, its date and its delivery address. A boolean flag is worthless.

Reconcile ADDACS within three working days, automatically. Every code 1, 3, B and C changes what you may submit next month, and the three-working-day rule is a scheme obligation with a compliance consequence.

Treat day nine as a hard deadline in code, not in a runbook. Claims arrive in batch reports, weekends and English bank holidays do not count, and an unattended inbox in the first fortnight of January will cost real money.

Use transaction code 19 for final collections and submit 0C when a customer leaves. Live mandates against departed customers are how code 4 claims are born.

If you are running Paperless Direct Debit, treat verification as the product, not the paperwork. You have no signature. Under code 5 or code 6 you will be asked to prove authority within seven working days, and if you cannot, you pay. Voice recordings, timestamped screens, address matching and audit trails are your entire defence.

And put your trading name — the one the customer will recognise — in field 9. Code 8 claims are almost always self-inflicted.

The mandate is a small document. It authorises an indefinite series of payments of unspecified amounts, and it is backed by a promise that the payer can call in at any time, for any reason, and get their money back the same day. That combination sounds unworkable, and it would be, were it not for the fact that the entire cost of being wrong sits with the one party who can choose not to be. That is the design. It has held for over fifty years, across five billion collections a year, and it holds precisely because nobody collecting money by Direct Debit can afford to be casual about it.

36.98 Common wrong ideas#

Wrong: the mandate is an instruction you give your bank. Right: it is an authority given by the payer to the service user, and Bacs states plainly that the DDI is not evidence of any contract between the service user and the payer’s payment service provider.

Wrong: the Direct Debit Guarantee is law. Right: it is a scheme rule in Pay.UK’s Bacs rulebook, enforced through contracts between participants, and the statutory rights underneath it in the PSRs 2017 are in several respects narrower.

Wrong: the unconditional refund right for a sterling Direct Debit comes from the Payment Services Regulations. Right: regulation 79(3)'s unconditional right applies to euro direct debits under Regulation (EU) 260/2012, and for sterling Bacs it is the scheme Guarantee that is unconditional.

Wrong: “immediate” describes the whole transaction. Right: only the payer’s refund is immediate, while the claim, the challenge window and the paying bank’s response all run on English bank working days, so the service user’s money may not move for another fortnight.

Wrong: modulus checking confirms the customer owns the account. Right: it confirms only that a sort code and account number could exist together and says nothing whatever about ownership, which is why a Paperless service user must verify identity itself.

Wrong: the challenge window is fourteen working days. Right: that figure belongs to the arrangements closed in 2024, and the operative deadline is the end of working day nine, after which an unchallenged claim is automatically accepted and the money leaves.

Wrong: a refund under the Guarantee cancels what you owe. Right: the refund undoes the payment and not the contract, and the service user keeps its ordinary legal remedies for the debt.

Wrong: the Guarantee covers you if the goods are bad or the company collapses. Right: it covers the mechanics — amount, date and set-up — and not the merits, and Section 75 and card chargebacks, which do reach the merits, do not apply to Direct Debit at all.

Wrong: every claim a paying bank raises must be paid. Right: a refund request, where the error was the paying PSP’s own, falls outside the valid indemnity claim criteria and is settled at the service user’s discretion.

Wrong: an unused mandate stays live indefinitely. Right: paying PSPs remove dormant instructions after a set period, so a service user collecting annually or seasonally must know its dormancy setting or find the authority has quietly evaporated.

36.99 Chapter summary in 20 lines#

1. A Direct Debit is the one payment you set up once and then stop doing, and Britain ran 5.03 billion of them in 2025 out of 6.86 billion Bacs payments worth £6.05 trillion.
2. People hand over that authority because of the Direct Debit Guarantee, five bullet points promising a full and immediate refund from the payer’s own bank if an error is made.
3. The refund is unconditional in practice: no minimum amount, no stated deadline, and no requirement to argue with the biller first.
4. The bank does not stay out of pocket, because it raises an indemnity claim and debits the collecting organisation’s own account.
5. That is the entire economics of the scheme — the party collecting the money carries the risk of being wrong.
6. Legally the mandate is an authority given by the payer to the service user rather than a contract with the payer’s bank, and the Guarantee is a scheme rule rather than a statute.
7. Five roles matter: the payer, the service user with its six-digit Service User Number, the paying PSP that owes the Guarantee, the sponsoring PSP that vouches for the service user, and Pay.UK as rule-maker.
8. The service user’s own signature appears on the indemnity, a standing, legally binding undertaking to reimburse any paying bank in the country.
9. The mandate itself is a controlled document with fixed wording and fixed field order, requiring written approval from the sponsor before use and again after any change.
10. Every Direct Debit Instruction is for an unlimited amount, which is why an electronic mandate carrying a non-zero amount is rejected under AUDDIS reason code 7.
11. Mandates are created on paper, through AUDDIS, or with no signature at all through Paperless Direct Debit, and no new non-AUDDIS Service User Numbers will be created after 1 July 2027.
12. Paperless sign-up moves verification from the bank to the service user, and brings script approval, mandatory training, recommended voice recording and possible annual review with it.
13. Advance notice, by default ten working days plus postal time and recorded against the SUN, is the obligation that most indemnity claims allege was breached.
14. Notice is required before a first collection and before any change of amount, date or frequency, must reach the payer personally, and must name the service user as the statement will show it.
15. Cancellations and amendments arrive through ADDACS and must be actioned within three working days, and a payer who cancels with the bank but not the biller leaves collections that will fail.
16. Indemnity claims arrive as DDICA advices under eight reason codes covering notice failures, cancellation failures, authority failures, service-user-requested refunds and disputed trading names.
17. The day a claim is reported counts as working day one, a challenge must be raised by the end of working day nine, and a challenge the paying bank has neither accepted nor rejected by the end of day eleven is cancelled in the service user’s favour.
18. Set against the Payment Services Regulations 2017, the Guarantee is faster, broader and unconditional, so a UK payer almost never needs to invoke the statute.
19. The loss runs in a fixed order: never the payer, temporarily the paying bank, finally the service user, and the sponsoring PSP if the service user cannot pay — while the payer may still owe the underlying debt.
20. The design holds because the whole cost of being wrong sits with the one party who can choose not to be, which is why nobody collecting by Direct Debit can afford to be casual about it.

Sources: Pay.UK and Bacs published scheme material (bacs.co.uk pages on Direct Debit, AUDDIS, Paperless Direct Debit, indemnity claims, Direct Debit Instruction templates and logo, the glossary, the FAQs, the guide and rules index and the notice on non-AUDDIS service user numbers after 1 July 2027; the DDI 1 template; The Little Bacs Book), directdebit.co.uk (the Direct Debit Guarantee, how to claim, cancelling a Direct Debit, your rights and safeguards), Pay.UK’s Bacs Payment System pages and Bacs annual processing statistics 2025, the Payment Services Regulations 2017 (SI 2017/752, regulations 67, 74, 76, 79 and 80) as published on legislation.gov.uk, and the published description of the Direct Debit Indemnity Claim challenge process via the Payment Services Website. Bacs message and indemnity reason codes cross-checked against independent implementation documentation; the authoritative text is The Service User’s Guide and Rules to the Direct Debit Scheme, v5.9 at the time of writing, available to registered users. All timings, limits and figures accurate at time of writing.