Direct Debit, Standing Order or Continuous Payment Authority? The UK Decision Tree for Actually Stopping a Subscription

In the UK the same monthly charge can leave your account by three different payment rails, and only one of them can be switched off by your bank alone in a way that also makes every later charge an unauthorised, refundable transaction. A Direct Debit, a standing order and a continuous payment authority all look like the same £12.99 going out. They are not the same instrument, they are not stopped the same way, and the wrong lever leaves the money going out.

Most advice treats all three as "a subscription". That is the mistake. This guide shows you how to identify the rail from your own statement or banking app, then applies the matching lever — with the statutory basis for each, so you can quote it if a call handler pushes back.

Last reviewed: September 9, 2026. Scope: UK personal current accounts and UK-issued debit and credit cards. Rights below are sourced to the Payment Services Regulations 2017, the FCA's consumer guidance and the Bacs Direct Debit Guarantee, all checked on the review date. This is practical guidance, not legal advice.

Three Rails, Three Completely Different Powers

The distinction is about who holds the instruction and what identifier it uses.

• Direct Debit. The company holds the instruction, set up against your sort code and account number. It can vary the amount and the date, but it must tell you in advance — normally 10 working days, under the Direct Debit Guarantee. In exchange you get the strongest refund promise of the three.
• Standing order. You hold the instruction. You told your bank to send a fixed amount to a sort code and account number on a fixed date. As Which? puts it, only you can alter the payments — and you get no Direct Debit Guarantee, because there is nobody else to blame.
• Continuous payment authority. The company holds the instruction, set up against your card number. It can change the amount and the date freely, with no advance-notice rule and no mandate list anywhere in your banking app. The FCA describes these plainly: recurring card payments "let businesses charge your payment card on a recurring basis without getting your permission each time".

Streaming, cloud storage, an AI plan, a news app: those all bill on the third rail — the one with no mandate to find and the sharpest legal lever attached to it. Nobody expects that combination, which is why identifying the rail comes before anything else.

How to Identify the Rail From Your Own Statement

Do this before you touch anything. Two minutes of identification saves a fortnight of the wrong escalation.

1. Open the mandate lists first, not the transaction feed

Every UK current account has a screen listing active Direct Debits and a separate screen listing standing orders. In Monzo, for example, Direct Debits live under Payments, then Schedule. If the merchant appears on one of those two screens, you have your answer immediately. If it appears on neither, and money is still going out, it is a card CPA.

2. Read the statement code

On a printed or exported statement the rail is usually spelled out. NatWest's list of statement abbreviations uses D/D for Direct Debit, S/O for standing order and POS for a debit card transaction. Other banks use their own codes, and some exports carry none at all, but the pattern holds: a card transaction never carries a Direct Debit code.

3. Check the shape of the line

If the descriptor itself is the obstacle — an abbreviation you cannot map to any service you use — work through the recurring billing descriptor decoder before you start cancelling things. Guessing the merchant and cancelling the wrong subscription is a common and expensive detour.

What Each Rail Actually Lets You Do

This is the table worth keeping. The legal basis column matters because it is what a call handler cannot argue with.

The refund right most people never use

There is a fourth lever that sits across two of the rails and is almost invisible in consumer advice. Under regulation 79 of the Payment Services Regulations 2017, you can reclaim an authorised payment initiated by the payee if two conditions are met: the authorisation did not specify the exact amount, and the amount charged "exceeded the amount that the payer could reasonably have expected taking into account the payer's previous spending pattern, the conditions of the framework contract and the circumstances of the case".

Regulation 80 sets the clock: you must ask within 8 weeks of the debit, and your provider has 10 business days to refund you or give a reasoned refusal naming the bodies you can escalate to. This is the right that covers a metered plan that suddenly bills five times its usual amount, or a gym that adds a fee you never agreed a figure for. It does not cover a flat £12.99 that was always going to be £12.99.

One precision worth knowing, because banks get it wrong too: regulation 79(3) gives an unconditional refund only for euro direct debits under EU Regulation 260/2012. A sterling Bacs Direct Debit is not covered by that paragraph. Your no-questions refund on a UK Direct Debit comes from the Direct Debit Guarantee, which is scheme rules your bank signed up to, not from the statute.

Stopping a Continuous Payment Authority: The Wording That Works

The FCA's position is unambiguous. You can cancel by contacting the business or by asking your card issuer, and "once you've asked them to, your card issuer must stop the payments – even if you haven't contacted the business". Citizens Advice puts the same rule the other way round: your card issuer "has no right to insist that you ask the company taking the payment first", and you can tell it by phone, email or letter.

This is not new guidance. The FCA had to remind banks of exactly this obligation back in 2013, after firms had been telling customers to go and sort it out with the merchant, and made them review complaints going back to November 2009. The failure mode it identified then is still the one to watch for now: the bank cancels or replaces your card instead of the authority. That does not work, because card networks pass updated credentials to merchants automatically — the mechanism we broke down in why subscriptions keep charging after you replace your card.

Say this, not "cancel my card"

"I am withdrawing my consent to the execution of the series of payment transactions to [merchant] on the card ending [last four digits], under regulation 67(4) of the Payment Services Regulations 2017. Please record this as a cancellation of the continuous payment authority itself, not as a card block or card replacement. Please confirm in writing, with a reference and the date. Any payment to this merchant debited after today will be an unauthorised transaction under regulation 76, and I will expect it refunded along with any charges it causes."

The two clauses doing the work are "series of payment transactions" and "not a card block". Regulation 67(4) is what lets you kill the whole series rather than one payment: it says the payer may withdraw consent to a series at any time, so that future transactions are not regarded as authorised. Regulation 76 is what turns anything that gets through into a refundable unauthorised transaction, with the refund due no later than the end of the business day after your provider becomes aware.

If the issuer refuses, complain formally in writing, and take it to the Financial Ombudsman Service once you have a final response or eight weeks have passed. And if the problem is that you cannot get into the merchant's account to cancel the agreement in the first place, the CPA route is your backstop — the rest of that path is in cancelling a subscription when you cannot log in.

Using the Direct Debit Guarantee Properly

The Guarantee is short, and its actual wording is narrower than most people assume. It gives you a "full and immediate refund of the amount paid" where an error is made in the payment by the organisation or your bank. It also entitles you to advance notice, normally 10 working days, of any change to the amount, date or frequency.

So the strong claims are the ones about the payment being wrong:

• The company took a different amount from the one it notified.
• The company took the payment on a different date.
• The company gave you no advance notice of a price rise before collecting the new figure.
• The company collected after you cancelled the mandate.

A price rise that you were properly notified about is not an error, even if you hate it. That is a cancellation decision, not an indemnity claim. Cancelling the Direct Debit is easy and always available; the Guarantee also confirms you can cancel at any time by contacting your bank, and asks you to notify the organisation too. Do both, in that order: company first, bank second.

The Two Mis-Diagnoses That Cost People Money

1. Killing the payment does not kill the contract

The FCA states it directly: "Cancelling a recurring card payment does not necessarily end your contract with a business. It will still be your responsibility to pay any money that you owe under a contract." Citizens Advice says the same about stopping payments tied to a loan, gym membership or magazine subscription — you will need to make another arrangement to pay.

The practical damage is worst on gyms, telecoms and anything that is a credit agreement, where a stopped payment turns into arrears, then collections, then a mark on your file. Cancel the agreement first, keep the confirmation, then stop the payment. If you need the platform-by-platform cancellation routes, they are in the complete cancellation guide.

2. Switching banks does not move your CPAs

The Current Account Switch Service moves, in its own words, "all your regular incoming payments (like your salary or benefits) and outgoing payments (Direct Debits, standing orders, bills)", along with your balance and saved payee details. Card CPAs are not on that list, because CASS operates on account-level payment arrangements and a CPA is held by the merchant against your card number. Banks say so plainly where they bother to mention it at all: Starling warns that "recurring payments set up on your old card, like subscriptions, won't switch automatically".

The result is a clean split: after a switch, your utilities and gym follow you and your streaming stack does not. Whatever sits on the card rail keeps billing a card attached to an account you are about to empty, and nothing in the switch confirmation tells you which ones those are. That is the exact scenario the bank-switch subscription review is built for, and it is also why a banking app is not a subscription tracker: the app can only show you the rails it controls.

A third trap: the CPA may not belong to the merchant at all

Plenty of subscriptions are billed by an intermediary. Of the 49 services in SubBuddy's own service database, 24 carry a documented third-party billing route through Apple, Google Play, Amazon, Roku or a mobile carrier — Netflix, Spotify, Duolingo, Notion, Calm and The New York Times among them. If you subscribed that way, the CPA on your statement belongs to the app store, not the service. Cancelling that authority does not cancel the subscription, and it does break every other purchase running through that store account. Cancel in the store's subscription settings instead.

What Changes in January 2027

Everything above is the payments-side backstop. The merchant-side rules are about to get much stronger. On 9 August 2026 the government brought the Digital Markets, Competition and Consumers Act subscription regime forward to January 2027, after two earlier delays had pushed it towards spring 2027.

From then, traders will have to give clearer up-front information, send regular renewal reminders, and provide what the announcement calls "a much easier exit to contracts" — plus a 14-day cooling-off period after a trial converts or a long contract renews. The government's estimate is an average saving of £14 a month per unwanted subscription.

Two caveats. It regulates traders, not banks, so the CPA lever remains your backstop when a trader ignores the rules. And it is a commencement date that has already moved twice. Until it lands, the payment rails are what you actually control — which is a good reason to know, for every subscription you hold, which of the three you are on. Recording the rail alongside the price and renewal date takes seconds when you add a subscription, and it saves the entire diagnosis step later.

US readers have a different, deadline-driven system rather than a rail-driven one, built on Regulation E and Regulation Z rather than the PSRs — the contrast is laid out in the US recurring-charge dispute deadlines.

Sources and Scope

• FCA: recurring card payments — the definition of a CPA, the cancellation deadline, the issuer's duty to stop payments without merchant contact, and the contract caveat.
• PSRs 2017, reg. 67 and reg. 83 — consent to a series of transactions, withdrawal of that consent, and the end-of-business-day-before revocation deadline.
• PSRs 2017, reg. 76 — the provider's refund duty for unauthorised transactions and the next-business-day timing.
• PSRs 2017, reg. 79 and reg. 80 — the conditional refund right for payee-initiated payments of unspecified amount, the 8-week window and the 10-business-day response.
• Bacs Direct Debit Guarantee — the advance-notice period, the full and immediate refund wording, and cancellation via your bank.
• Citizens Advice: stopping a future card payment — that the issuer cannot insist you contact the merchant first, and that the debt survives.
• Current Account Switch Service: common questions — what the switch covers and the advice to check third-party authorisations before closing an account.
• GOV.UK, 9 August 2026 — the January 2027 start date for the DMCCA subscription rules, the 14-day cooling-off period and the £14-a-month estimate.

Service-billing figures are counted from SubBuddy's own service dataset as of September 9, 2026 and describe documented alternative billing routes, not a survey of how readers actually pay.