Several of the guides that currently rank for "variable recurring payments API" list MaximumCumulativeAmount and MaximumCumulativeNumberOfPayments as VRP control parameters. Neither field exists. I checked the published OpenAPI definitions at v3.1.10, v3.1.11 and v4.0.1, and there are zero occurrences in any of them.
That is roughly the state of VRP documentation outside the specification itself: thorough on sweeping versus non-sweeping, silent on everything that actually costs you a sprint.
What Is the Variable Recurring Payments API and Who Has to Offer It?
A VRP is one long-lived consent that authorises many payments underneath it, each validated against limits the customer set when they authenticated. It is not a payment message repeated on a timer. It is a mandate held at the bank, with the bank enforcing the caps.
There are two flavours, and the split is regulatory rather than technical. The CMA mandated that the CMA9 offer open access to the VRP API for sweeping, which means moving money between accounts belonging to the same person. Open Banking Limited states the other half just as plainly: non-sweeping VRPs were not mandated by the CMA, so the CMA9 are not obliged to provide them. Six of the nine (HSBC, Santander, NatWest, Nationwide, Lloyds and Barclays) had sweeping live by the end of 2022. Sweeping is now a real rail, running 7.73 million payments in June 2026, up 6.7% on the month.
Commercial VRP is the one everybody writes about, and it arrived through a scheme rather than a mandate. The UK Payments Initiative went live on 2 June 2026, one quarter later than the Q1 2026 the FCA and PSR had signalled in December 2025.
The current standard is v4.0.1, released 1 April 2026, base path /open-banking/v4.0/pisp. The CMA9 were required to be on v4.0 by the end of March 2025, and running OBL 4.0 in production is a prerequisite for UKPI participation. If you are still building against 3.1.x, you are building against a migration target.
What Endpoints Does the VRP API v4.0.1 Expose?
Six paths, eight operations, and one of them is a trap.
| Method | Path | Purpose |
|---|---|---|
POST |
/domestic-vrp-consents |
Create the mandate |
GET |
/domestic-vrp-consents/{ConsentId} |
Read mandate + status |
DELETE |
/domestic-vrp-consents/{ConsentId} |
Revoke |
PUT |
/domestic-vrp-consents/{ConsentId} |
Version migration only |
POST |
/domestic-vrp-consents/{ConsentId}/funds-confirmation |
Balance check |
POST |
/domestic-vrps |
Execute a payment |
GET |
/domestic-vrps/{DomesticVRPId} |
Payment status |
GET |
/domestic-vrps/{DomesticVRPId}/payment-details |
Detailed status history |
Read the full article on tomcn.uk →
About the Author
I'm Tom Wang, an AI Developer & Fintech Developer — building AI agents, crypto payment infrastructure, and cross-border payout systems with Rust, Go, and TypeScript. Based in London, UK.
Currently open to new opportunities in fintech, crypto payments, and AI agent engineering.
Top comments (0)