Continuous payment authorities

A continuous payment authority (CPA) is a type of recurring payment that a merchant sets up on a customer’s card account using their debit or credit card details. As part of this process, the merchant should get the customer’s permission (‘standing authority’) to take payments as and when they’re due.

A customer should be able to cancel a CPA by contacting the merchant or the card provider. 

This page is guidance for card providers. According to the Payment Services Regulations, if a customer asks you to cancel their CPA, you must honour this request. If any further payments are made after their request to cancel, these are unauthorised and you must refund them to the customer.

 Customers may complain about difficulties in cancelling a CPA. For example, they may say:

• they’ve struggled to get you, the card provider, to cancel a CPA
• you didn’t cancel a CPA in time to stop a payment being taken

Customers may complain about the CPA itself. For example, they may say they:

• didn’t authorise a CPA on their account
• were completely unaware they were entering into a CPA – this sometimes happens when signing up to a ’free trial’ offer
• didn’t agree to the amounts or frequency of the payments
• didn’t agree to renew the agreement after a fixed term

When assessing whether you, the card provider, have done something wrong, we’ll usually take into account: 

• how the CPA was set up
• any discussions you had with your customer about the CPA
• the card’s terms and conditions
• any relevant laws and regulations, including the:
  • Payment Services Regulations
  • Consumer Credit Act, if the payment is from a credit facility
• what you’ve already done to put things right

We may also look at the underlying agreement between the customer and merchant.

Cancelling a CPA

If a customer asked you to cancel their CPA, we’d expect to see that you:

• did so without unnecessary delay
• refunded any unauthorised payments

We’ll consider:

• how long it took you to cancel the CPA
• whether the customer gave you enough time to cancel the CPA
• whether your failure to cancel a CPA in time had an impact on the customer

We recognise that it can be difficult to stop a CPA – but you shouldn’t hold the customer liable because of this. We recommend that you find a solution that won’t disadvantage them. For example, you could monitor their account and refund any further payments from a cancelled CPA. You can then recover the money from the merchant in your own time.

However, we also recognise that if a merchant has started the process of taking a payment, then it's too late for the customer to cancel a CPA to stop this payment from being authorised. Only payments taken after this would be unauthorised.

Complaints about a CPA

We’ll look at the evidence to see whether:

• the merchant got the customer’s agreement to set up a CPA
• the customer clearly understood and agreed to the terms of the CPA (for example, the payment amounts and dates)

If the evidence shows the merchant didn’t get the customer’s informed agreement, then we’ll consider the CPA to be unauthorised. In this case, we’d expect you, the card provider, to refund any payments under the terms of the Payment Services Regulations.

We can also look into a complaint about the merchant itself, if it’s a provider of financial services. This might be where a customer uses a CPA for short-term ‘payday’ loan payments or insurance premiums.

See also our guidance on disputed transactions.

You should give your final response to complaints about payment services within 15 days. Find out more about time limits for businesses.

We only look at complaints that you’ve had a chance to look at first. If a customer complains and you don’t respond within the time limits or they disagree with your response, then they can come to us.

Find out more about how to resolve a complaint.

If we find you’ve done something wrong, we’ll ask you to put things right. 

This could include refunding any:

• unauthorised payments (unless the merchant has already refunded these)
• charges and interest you’ve applied to the customer’s account as a result of unauthorised payments

We may ask you to compensate the customer for any:

• direct losses they’ve suffered, like charges from a third party because of missed or late payments
• distress and inconvenience they’ve suffered

• Payment Services Regulations