Mandates, consent and payment methods
Status: Product requirements; mandate text, card-on-file rules and bank debit authorisation require provider/legal approval.
Mandate record
Each mandate is specific to a merchant and consumer relationship. Capture merchant legal/trading identity, authorised method IDs or method classes, amount limits or variable-billing scope, frequency/trigger, notice requirements, fallback permission, effective and expiry dates, consent text version, affirmative acceptance timestamp, channel, session reference and revocation history.
Separate consent concepts: acceptance of platform terms, privacy notices, merchant payment mandate, use of backup methods and marketing communications. Do not bundle marketing consent with payment authorisation.
Payment methods
Store provider vault token/reference, method type, network/brand, masked suffix, expiry if applicable, status, provider account reference and ownership/verification status. Never store PAN, CVV or online banking credentials.
| Action | Required behaviour |
|---|---|
| Add | Use hosted/tokenised provider flow; verify successful tokenisation |
| Set primary | Update preference for the selected merchant, subject to mandate |
| Set backup | Require explicit opt-in and explain order of attempts |
| Remove | Check active mandates and in-flight collections; explain impact |
| Expired/invalid | Mark unavailable and prompt update before scheduled collection |
| Revoke mandate | Stop future initiation; preserve consent/revocation evidence |
| Replace method | New token and explicit authorisation if mandate scope changes |
Fallback policy
An alternate method must be covered by the active mandate and the consumer's merchant-specific preferences. Attempt selection must check method eligibility, decline category, previous attempts, merchant policy, scheme rules and cutoff windows. Record the decision and policy version for every fallback.
Revocation and in-flight operations
Revocation should take effect promptly for new collection attempts. Already submitted attempts may not be cancellable; display that distinction, contact the provider where cancellation is supported and reconcile the outcome. Never promise that revocation reverses a settled payment.
Audit evidence
Maintain append-only consent and revocation events including exact displayed terms version, method references, merchant scope, timestamp, actor and source channel. Apply retention rules and data minimisation after compliance review.
Open decisions
Variable-amount mandate thresholds, notification lead time, card-on-file authentication, PayTo/BECS availability, consent renewal triggers, consumer method ownership verification and dispute rights.