Taking payments for self storage: Direct Debit, cards and the UK rules

This guide covers the UK as at 10 October 2026 and is general information, not legal advice. It explains who starts each payment, what the Direct Debit Guarantee promises, what happens when a Direct Debit is cancelled, unpaid or claimed back, the card surcharge ban and repeat card payments.

How can a UK storage operator collect a licence fee?

An operator can collect by card, Direct Debit, bank transfer, standing order or cash; these differ in who starts each payment, how the customer authorises it and what they can undo.

A Direct Debit is started by the operator: the Payment Services Regulations 2017 (PSRs) say a direct debit is “initiated by the payee on the basis of consent given by the payer” (regulation 2(1)). The customer gives that consent in a Direct Debit Instruction.

A one-off online card payment is started by the customer. Regulation 100(1) of the PSRs says a payment service provider (PSP) “must apply strong customer authentication” (SCA) where its user “initiates an electronic payment transaction”, subject to exemptions in technical standards (regulation 100(5)).

A bank transfer or standing order is started by the customer: the PSRs define a credit transfer as made “based on an instruction given by the payer” (regulation 2(1)).

What does the Direct Debit Guarantee promise your customer?

The Direct Debit Guarantee promises the payer notice of changes, a refund from their bank for an error, and the right to cancel. The payer’s bank gives it: Pay.UK, which owns Direct Debit, says on its payer site that it “is offered by all banks and building societies that accept instructions to pay Direct Debits”.

• Notice of changes. If the amount, date or frequency changes, “the organisation will notify you (normally 10 working days) in advance of your account being debited or as otherwise agreed”.
• A refund for an error. For an error by the organisation or the bank, the payer is “entitled to a full and immediate refund of the amount paid from your bank or building society”.
• Cancellation. The payer can cancel “at any time by simply contacting your bank or building society” (written confirmation may be required), and should tell the organisation too.

The same site says it “doesn’t cover you if you have a dispute with the biller”.

Bacs’s FAQ makes 10 working days a default: “The default period in the absence of any other agreement is a minimum of 10 working days plus postal time”.

GoCardless, a payment provider, says on a page last edited September 2025: “Under the GoCardless terms and conditions, customers agree to a three day notice period”.

The public scheme texts we read on 10 October 2026 speak of notice before the first payment and on a change of amount, date or frequency. GoCardless’s page says customers “must be notified in advance of each payment”.

On 10 October 2026 the scheme’s Service User’s Guide and Rules was open only to registered users of Bacs’s website, so we cannot say which reading it supports.

What happens when a Direct Debit is cancelled, unpaid or claimed back?

The customer’s bank sends one of three things: an advice of a cancelled or changed mandate, a returned unpaid collection, or an indemnity claim for a refund it made.

Cancelled mandates and unpaid collections

• A cancelled or changed mandate. The bank sends an Automated Direct Debit Amendment and Cancellation Service (ADDACS) advice. Bacs says to act “within 3 working days”; its Little Bacs guide (PDF last modified July 2024) says to act “immediately or you may be liable for any errors”.
• An unpaid collection. The bank returns it through Bacs’s Automated Return of Unpaid Direct Debits service, with a reason such as insufficient funds. On 10 October 2026 we found no public scheme text on how soon a return is reported.
• Rejected and copied Instructions. Bacs says rejections are notified “within five working days”, and a copy a bank asks for is due “within seven working days from the date of the request”.
• Instructions by phone or online. Bacs says these must be confirmed to the customer “within three working days” or, if the first collection falls within a month, with the advance notice.
• From 1 July 2027. No new service user numbers for paper Instructions will be created; Bacs’s Automated Direct Debit Instruction Service lodges Instructions electronically.

What is a Direct Debit indemnity claim, and can you challenge one?

An indemnity claim is the customer’s bank recovering from the operator a refund it has paid the customer; where the error was the organisation’s, says the Little Bacs guide, the bank “reclaims that amount back from you”.

Three terms differ:

• The refund for an error runs from the customer’s bank to the customer and does not end the debt: the payer site says “you’ll still owe them that money”.
• The indemnity is, in Bacs’s glossary, a document that contains a “legally binding undertaking to make payment to any paying PSP in response to an indemnity claim”.
• The indemnity claim is “A claim made by the paying PSP in respect of an incorrect Direct Debit being applied to an account”; the paying PSP is the customer’s bank.

For a payment against a fraudulent signature, Bacs’s FAQ says “You are liable”: the bank refunds the customer, then will “reclaim the amount refunded from you through an indemnity claim”.

If a customer does not recall authorising a Direct Debit and the service user cannot supply the Instruction within 7 working days, “you must refund the PSP with the amount of the payment”. The same answer says “There may be circumstances where you can challenge the indemnity claim”.

On 10 October 2026 Bacs’s pages on the challenge process were open only to registered users of its website.

In its guide, GoCardless, a payment provider, describes how a claim arrives and what a challenge needs:

• The notice. The bank raises the claim against the service user and informs them in a “Direct Debit Indemnity Claim Advice (DDICA) report”.
• The reasons. It says the most common include an amount or date that differs from the advance notice, no prenotification of the debit, a disputed advance notice, a wrong account number or type, and a payment taken “more than 3 working days after the due date”.
• The evidence. It says a service user needs evidence “that the payment was extracted in accordance with the advance notice, and that the fault lies outside of your actions”.

GoCardless gives two time limits: its guide, last edited September 2025, says “The service user has 9 days in which to dispute the claim”. Its undated support page, for UK merchants on its Pro package, says they “only have 7 working days from the date the claim was raised to submit evidence to GoCardless”.

On 10 October 2026 we found no public scheme text that states a time limit for refunds to payers or for indemnity claims, or says there is none. GoCardless says “there is no time limit on when claims can be made” (September 2025).

The Financial Conduct Authority (FCA) says the UK scheme “is at liberty to continue to offer a longer period to request refunds” (Approach Document, paragraph 8.236). That is longer than the 8 weeks the PSRs give a payer to ask for a refund of a payment the payee started (regulation 80(1)).

The refund under regulation 79(1) exists only where the authorisation did not specify the exact amount and the amount was more than the payer could reasonably have expected (regulation 79(2)). Regulation 79(3) adds an unconditional refund only for euro direct debits under Regulation (EU) 260/2012.

The FCA says the same of the 13 months the PSRs give for notifying an unauthorised or incorrectly executed payment: the scheme “would not be prevented from continuing to offer a longer period for refunds” (paragraphs 8.184 and 8.186). It does not say what the scheme’s period is.

Can you charge extra for paying by card, or discount Direct Debit?

For a consumer debit or credit card, or another non-commercial payment instrument, regulation 6A(1) of the 2012 Regulations says a payee “must not charge a payer any fee”. The ban, in force since 13 January 2018, applies only where both payment providers are in the UK (regulation 6B) and only to contracts entered into after 18 July 2017 (regulation 1(3)).

Otherwise, and for commercial cards and a consumer’s other methods, regulations 4 and 6A(2) cap a fee at cost. For a contract entered into on or before 18 July 2017, regulation 6A does not apply at all; regulation 4 caps a consumer’s fee only for contracts entered into on or after 6 April 2013 (regulation 1(2)).

The government’s 2018 guidance allows a discount for one method if other payers are not “effectively faced with a surcharge that does not comply with the Regulations” (paragraph 13.2). It was last updated on 22 June 2018; on 10 October 2026 its gov.uk address led to a National Archives copy.

The guidance pre-dates the switch to “the United Kingdom” in regulation 6B (31 December 2020) and the Digital Markets, Competition and Consumers Act 2024 (the DMCC Act), and says it “will not bind a court” (paragraph 1.4).

Paying by card: consumers and business customers

• The method, not the buyer. Business Companion, Trading Standards guidance for Great Britain (reviewed April 2025), says “the method of payment, rather than the status of the buyer” decides: a sole trader’s personal card is covered, a corporate card is not.

The sources differ on whether the cap reaches business customers. Business Companion says it “only applies to contracts made between businesses and consumers, and not to business-to-business contracts”. Regulation 6A(2) states no such limit, and the 2018 guidance applies the cap to “most payments between businesses made with commercial payment instruments” (paragraph 2.2). This guide does not settle it.

In Northern Ireland, which Business Companion does not cover, nibusinessinfo.co.uk (undated) says “do not charge consumers a fee for using a credit or debit card”.

Direct Debit, bank transfer and cash

For consumers, regulation 4 caps a fee for any method at “the cost borne by the trader for the use of that means”. The 2018 guidance names cash, cheques, cards, credit transfers and direct debits (paragraph 8.5), and Business Companion adds standing orders.

Regulation 5 limits regulation 4 to a “sales or service contract” and a few others, excluding contracts “for the creation of immovable property or of rights in immovable property”. On 10 October 2026 we found no text that says where a storage licence falls; regulation 6A applies either way (guidance, paragraph 8.4).

On 10 October 2026 we also found no text deciding whether a sterling Direct Debit, a bank transfer or a Faster Payment is a non-commercial “payment instrument” under the ban. The 2018 guidance names euro direct debits and credit transfers, under the Single Euro Payments Area (SEPA) rules, as within the ban (paragraph 5.2); that paragraph does not name sterling ones.

Fees that are not surcharges, and discounts

• A fee that is the same for every method. The guidance says booking or handling fees “are not covered by the Regulations” where they do not differ by payment method (paragraph 14.2), as with Business Companion’s £10 or 10% booking fee.
• Late and failed-payment fees. On 10 October 2026 we found no mention of late-payment, failed-payment or default charges in the 2018 guidance.
• A discount for one method. The guidance says the same discount “must be offered in all situations where regulation 6A(1) applies”, and, where regulation 4 or 6A(2) applies, other price gaps may not exceed processing cost (paragraph 13.3).
• What a charge may contain. The guidance allows only costs “for use of the payment method in question”, not overheads or set-up fees, and no averaging across methods (paragraphs 9.2 to 10.3).

If a fee breaks the rules

Regulation 10 makes a contract term requiring a fee charged in breach “unenforceable to the extent that the charging of the fee contravenes regulation 4 or 6A”, and that part of the fee is to be repaid.

Trading Standards in Great Britain, and a named department in Northern Ireland, must consider complaints (unless frivolous or vexatious, or taken on by another authority) and may seek an injunction, or in Scotland an interdict (regulations 7 and 8). On 10 October 2026 we found no criminal offence or monetary penalty in the Regulations themselves.

Since 6 April 2025 the DMCC Act has also listed regulations 4 and 6A to 10 for court action (Schedule 15) and for direct enforcement by the Competition and Markets Authority (CMA) (Schedule 16). There, section 182(6) caps a penalty at “£300,000 or, if higher, 10% of the total value of the turnover”.

That the section 182 penalty can therefore follow a breach of regulation 4 or 6A is our reading, and on 10 October 2026 we found no CMA case on payment surcharges.

Two neighbouring rules are not the surcharge rules. Regulation 66 of the PSRs limits what a payment provider may charge its own customer for meeting its duties under Part 7, and stops the operator’s provider preventing a charge, a discount or steering.

Regulation 40 of the Consumer Contracts Regulations 2013 makes an extra payment payable by a consumer only with their “express consent”, obtained before they became bound by the contract; a pre-ticked box is not that consent. Our guide to the cooling-off period sets out that rule in full.

How do repeat card payments work?

The customer authorises a series once, through a mandate, and the operator then starts each later payment. The FCA calls these merchant-initiated transactions (MITs) and says “MITs are payments initiated by the payee” (policy statement, November 2021). SCA applies “regardless of whether the customer is a consumer or a business” (Approach Document, paragraph 20.10).

• Setting up the mandate. Paragraph 20.9 says a mandate given “through a remote channel” is “subject to strong customer authentication”; paragraph 20.59 says that for a card continuous payment authority it “will only be required if the payer initiates the first payment”. Later payments needing no action from the payer are not subject to it.
• A price rise outside the mandate. Payments at a price outside “the scope of the initial mandate or agreement” would be “unauthorised unless the customer agrees to amend the mandate or set up a new mandate” (FCA, paragraph 20.9; policy statement, PDF page 28).

HM Treasury’s consultation “Modernising Payment Services Regulation” closed on 6 October 2026. It says the government “has therefore already committed to commencing the revocation” of the PSRs’ SCA regulations “to enable the FCA to make more outcomes-based rules about authentication requirements”.

It is a consultation, not law: on 10 October 2026 legislation.gov.uk showed regulation 100 in force. The Financial Services and Markets Act 2023 lists the PSRs for revocation, but on that date the revocation was in force only for regulation 158 (from 14 December 2023).

Card data: PCI DSS and SAQ A

For card data, the Payment Card Industry (PCI) Security Standards Council says Self-Assessment Questionnaire (SAQ) A is for merchants whose account data functions are “completely outsourced” to third parties validated as meeting the PCI Data Security Standard (PCI DSS), in a post of 30 January 2025. It adds that SAQ A merchants do not store, process or transmit any account data in electronic form on their systems or premises.

Since spring 2025 an eligibility criterion has asked them to confirm their site is “not susceptible to attacks from scripts”.

• Redirect or embed. FAQ 1588 (February 2025) applies that criterion only to a page that embeds a provider’s payment form, such as in an iframe, not to a redirect or an emailed payment link.

What this guide does not cover

This guide does not cover cash handling, reconciling bank transfers, card chargebacks, or any provider’s fees or contract. Four neighbouring topics have their own pages:

• VAT on the licence fee. Our entry on VAT on self storage sets out when storage is standard-rated and how to show prices with VAT.
• Late fees and interest. Our guide to late fees and interest covers what the law says for consumers and business customers.
• The 14-day right to cancel. Our guide to the cooling-off period covers whether, and how, that right applies to storage booked online.
• Chasing a missed payment. Our entry on dunning covers the reminders, retries and escalating steps after a payment that does not clear.

How StoreBay fits today

Bacs Direct Debit is the default way StoreBay collects a recurring licence fee. Direct Debits are set up on GoCardless’s own pages, so StoreBay never stores your customers’ bank details.

StoreBay emails your customer an advance notice, with the invoice attached, at least three working days before each Direct Debit it collects.

Pay.UK’s payer site says changes are normally notified 10 working days ahead or as otherwise agreed; GoCardless says its customers agree a three-day period (September 2025). Whether your customers’ mandate terms agree a period as short as three working days is a question for GoCardless or your adviser.

A Direct Debit invoice is marked paid when GoCardless confirms the payment, usually the working day after the collection date. If a bank reverses a Direct Debit later, the invoice goes back to owing and the chasing starts again.

When StoreBay retries a failed Direct Debit automatically, it does so at most twice, each time after fresh notice to the customer. A declined card is tried against the customer’s other saved cards, then up to three more times over the following days.

When a card payment fails, StoreBay emails your customer once per invoice, with a link to update their payment details, unless you switch that email off. It sends no email of its own when a Direct Debit is returned unpaid before payout.

StoreBay takes no cut of your payments and adds nothing to your payment provider’s own card and Direct Debit rates. It does not add a surcharge for paying by card. Staff can take a card payment over the phone, or record cash, cheques, bank transfers, standing orders and payments on your own card terminal.

Our billing page sets out how StoreBay collects by Direct Debit or saved card and what happens when a payment fails.

Our self storage software page sets out what StoreBay does for an operator and what to look for in any such software.

Questions to put to your adviser

Put these to a solicitor, or to your payment provider where its terms decide:

• Does the notice period in your mandate terms match the notice you send?
• Do the scheme rules require notice before every collection, or only the first and changes?
• On an indemnity claim, could you produce the Instruction within 7 working days, and when must a challenge reach your provider?
• Is your storage licence a “sales or service contract” for regulation 4, or inside the regulation 5(2) exclusions?
• Does the cap in regulation 6A(2) reach business customers paying by commercial card?
• If you discount one method, does the discount reach consumers paying by card?
• Is a sterling Direct Debit or a bank transfer a “payment instrument” under regulation 6A(1)(b)?
• Does your card payment page redirect to your provider or embed its form?
• Can your terms change the amount taken by card or Direct Debit without a new mandate?

Sources

All read on 10 October 2026 unless marked otherwise.

• Consumer Rights (Payment Surcharges) Regulations 2012: the ban, the cap and enforcement.
• The government’s guidance on those Regulations and its publication page, June 2018, in the National Archives.
• Business Companion, Payment surcharges: Trading Standards guidance for Great Britain.
• nibusinessinfo.co.uk, Pricing legislation: Northern Ireland business advice.
• Consumer Contracts Regulations 2013, regulation 40: express consent to extra payments.
• Payment Services Regulations 2017, regulations 2, 66, 67, 79, 80 and 100: definitions, charges, consent, refunds and authentication.
• Interchange Fee Regulation, article 2 and SEPA Regulation, article 1: card and euro payment definitions.
• DMCC Act 2024, section 150, Schedule 15 and Schedule 16: the enforcement routes.
• DMCC Act 2024, section 182, read on 9 October 2026: the penalty cap.
• The FCA’s Approach Document (May 2026): authentication, recurring payments and refunds.
• The FCA’s policy statement 21/19 (November 2021): merchant-initiated payments and mandates.
• HM Treasury, Modernising Payment Services Regulation, consultation published July 2026.
• PCI Security Standards Council posts on SAQ A updates (30 January 2025) and FAQ 1588 (28 February 2025), and FAQ 1588 itself.
• The Direct Debit Guarantee and help pages on claims, rights and safeguards and issues with a Direct Debit, on Pay.UK’s payer site.
• Bacs frequently asked questions, glossary and pages on Direct Debit services, ADDACS, electronic Instructions, the 1 July 2027 change and indemnity claims.
• Bacs, Direct Debit guide and rules: the log-in notice.
• Bacs, Little Bacs guide to Direct Debit, PDF last modified July 2024.
• Pay.UK, Bacs System Principles, January 2026.
• GoCardless (payment provider, secondary): its page on payer protections and indemnity claim guide, last edited September 2025, and an undated support page on challenges.
• gov.uk, search for “payment surcharges”.