What do we need in place to take donations online and by direct debit?

England and Wales: This page sets out the position in full. Scotland: the same position for your own online and Direct Debit giving; the law is stricter only if your platform counts as a professional fundraiser — see the Scotland section below. Northern Ireland: the same position, and a simpler one, because no statutory professional-fundraiser regime is in force there.

Do you need a licence or FCA authorisation to take donations online?

No. This is where most charities get stuck, in England and Wales, Scotland and Northern Ireland alike.

This page relies on the Code of Fundraising Practice, which applies whether or not you register. What it is, and registration itself, are covered when you register with the Fundraising Regulator and adopt the Code.

The Payment Services Regulations 2017 regulate the businesses that move money: banks, card processors, payment service providers and some platforms. A charity taking gifts for its own purposes is not one of them. In the Regulations’ words it is a “payment service user”. That is a person using a payment service “in the capacity of payer, payee, or both” (reg 2(1)).

The regulated party is whoever handles the money on the way to you. The Financial Conduct Authority’s perimeter guidance covers a platform that takes a percentage of what it raises for charities. It says such a platform is unlikely to fit the exclusion for charitable collections (PERG 15.5, Q34A). So the authorisation question belongs to the platform or its payment provider.

Two things follow. First, check that the regulated party is regulated. The Fundraising Regulator asks platforms to confirm that their payment service provider is regulated by the FCA, so ask for that and keep it. Second, strong customer authentication — the extra check a donor’s bank asks for — is a legal duty on banks and payment providers, not on you.

This answer is a reading of the Regulations’ definitions, backed by the FCA’s guidance; no regulator says it in one sentence. It covers a charity taking gifts for itself. A charity that regularly collects payments and passes them on to other organisations is outside what was established here.

Website donors have no statutory cooling-off period

A donor who gives through your website has no legal right to change their mind and get the money back. That is so in England and Wales, in Scotland and in Northern Ireland. The rights people half-remember are real, but narrow.

• Section 61 of the Charities Act 1992 (England and Wales) gives a right to cancel only for payments of at least a set figure to a professional fundraiser or commercial participator. The payment must be made by card after a radio or television appeal, or follow a spoken appeal not made face to face, such as a phone call. A web page is none of these.
• The Charities and Benevolent Fundraising (Scotland) Regulations 2009 make the same split, for the same two kinds of paid fundraiser.
• Northern Ireland has no statutory right at all. Section 151 of the Charities Act (Northern Ireland) 2008 has never come into force.
• Consumer law gives cancellation rights where the customer pays a price for goods, services or digital content. A gift with nothing supplied in return is not that.

What donors do have runs through their own bank. A Direct Debit taken in error comes back to them in full, straight away, under the Direct Debit Guarantee.

They can stop future Direct Debits or recurring card payments through their bank. The Payment Services Regulations 2017 give them that right, subject to a cut-off before each payment (reg 67(4)). They add a refund right in some cases (reg 79). The charity cannot block either.

So write a refund policy, and keep it honest. The Code has no cooling-off standard. What it says, in section 2.2, is this:

You must only refund a donation in line with your charitable institution’s policies or in exceptional circumstances. However, you must refund a donation if a donor correctly exercises their right to a refund.

So the Code expects refunds to follow the charity’s own policy. Say when you will refund a one-off gift and who decides. Say that a Direct Debit taken in error is refunded by the donor’s bank.

Leave out any legal cooling-off right for web gifts: there is none, and citing one misleads donors. You may offer more than the law requires, but giving money back is also a question of the charity’s powers. That is dealt with when you write your gift acceptance and refusal policy.

One change is coming, and its date is not fixed. The Digital Markets, Competition and Consumers Act 2024 creates a regime for subscription contracts. It is not in force. The government has announced a start date, but no commencement regulations exist, and the date has already moved once.

A plain monthly gift, with nothing given in return, is outside the Act’s definition on its face. That is this guide’s reading of section 254, and a law firm’s published view shares it. The risk is the thank-you: a regular gift that comes with a magazine, merchandise or access may be a subscription contract. The government has promised to exclude charitable memberships that give access to places, collections or performances, but has not yet legislated.

How to collect Direct Debits: three routes

Regular giving is a donor’s repeated gift, usually monthly, by Direct Debit or recurring card payment. How you collect the Direct Debits is the decision the rest of the set-up hangs on. Small charities often get it wrong by assuming they need their own bank sponsorship. Bacs, which runs the scheme, describes three routes:

Route	Who holds the Service User Number	Bank sponsorship	Who carries the Guarantee and the indemnity
Your own number, submitted by you	You	Needed — the bank checks your standing first	You
Your own number, through a bureau	You	Needed	You, with the bureau doing some or all of the processing
A Facilities Management provider, or a platform using its own number	The provider	Not needed — you are not a service user	The provider, by contract

The trade-off is control. Under your own number you control the instructions and carry the risk. Under a provider’s number you carry neither, but you depend on the provider for both — including whose name the donor sees.

Choosing is a trustee decision. The Code expects those who govern to take overall responsibility for fundraising, “including those you have delegated to others” (Code 2.1.1). Minute the route and the reason.

“A bank must authorise you” is true only under your own number. The Fundraising Regulator’s guidance on cashless donations says:

You cannot accept payments by Direct Debit unless a Bacs participating bank or building society authorises you to do so.

That is right if you collect under your own Service User Number. If a provider or platform collects under theirs, no bank authorises you, and none needs to. Bacs’s own guide says the Facilities Management client “is not a service user” and “does not have a SUN”.

The Guarantee is the scheme’s promise, not a statute. It gives the donor advance notice of any change to the amount, date or frequency. It gives them a full and immediate refund from their bank if a payment is taken in error. And it lets them cancel at any time through their bank.

No statute places it on a charity. It reaches you through the scheme rules and your sponsor’s or provider’s contract. The advance-notice period is a scheme default: if you want a different one, agree it with the donor at sign-up.

What the donation form must get right: Gift Aid and consent

An online form repeats whatever it gets wrong on every gift. Two parts of it carry legal weight.

The Gift Aid declaration. What a Gift Aid declaration must contain is set out when you design a compliant Gift Aid declaration; build the form from that page. The mistake a web form makes at scale is a tick-box that says only “I am a UK taxpayer”. HMRC’s guidance is explicit:

A statement that ‘I am a UK taxpayer’ is not sufficient to meet the charity’s requirement to advise a donor of the tax implications of making a Gift Aid donation. … If the explanation is insufficient the Gift Aid declaration will not be valid and the charity may need to repay tax to HMRC.

The explanation need not sit inside the declaration, but you must be able to show the donor was given it. A monthly gift usually runs on an enduring declaration. HMRC’s guidance is that enduring declarations are kept for as long as the gifts continue, with the time limit running only from the last one. The records are set out when you set up your Gift Aid record-keeping and audit trail.

The marketing opt-out, on the form itself. Since 5 February 2026, a charity may email or text supporters without their consent under its own soft opt-in. One of its conditions is that a simple, free way to refuse was offered when the details were first collected, and in every message since. A form that never offered it cannot be fixed later, so the opt-out must be on the form.

The soft opt-in reaches only details collected on or after that date. An earlier donor comes within it if they give their details again and are offered the opt-out then. The full rule is on set up consent and preference management for marketing.

Holding donor data. Keeping a donor’s records is a separate question from emailing them. For gift records, thank-you letters and admin, most charities rely on legitimate interests; the Gift Aid part rests on legal obligation.

Screening or profiling donors to target bigger gifts is different. The ICO publishes no charity-specific mapping. This guide’s reading is that it is hard to rest on legitimate interests and is likely to need explicit consent. Say which basis you rely on in your privacy notice and your data protection policy.

Honesty and security. The Code expects fundraising not to mislead, including by leaving things out (1.2.1). It also expects appropriate security for online and card payments (3.5.1). Its guidance points to the card industry’s standard, PCI-DSS, and to the Direct Debit scheme rules.

Checking a donation platform before you use it

Most of what the Code says about online giving is written for the platform, in section 9. Your part is a check, made before the donate button goes live.

1. Fees shown before payment details. The Code expects a fee-charging platform to show donors three things before it asks for payment details (9.1.3). They are how its fee is worked out and how much it will take from the gift. The third is how the fee can be changed or removed, where it can be. A “tip” the donor adds counts as a fee here.
2. A real way to pay no fee. The Regulator’s platform guidance says platforms should let donors give for free without effort. Its example is a “zero fee or tip” option given equal prominence. That is guidance, not a Code standard.
3. Your own website. Your site may send donors to a fee-charging platform. If so, the Code’s one line addressed to you is that you should make sure its fees, and how they are charged, are clear.
4. A regulated payment provider. Ask the platform to confirm that its payment service provider is regulated by the FCA.
5. Its professional-fundraiser status, in writing. See the next section.
6. Gift Aid it handles for you. Where a platform acts as a Gift Aid donor intermediary, HMRC’s guidance puts the record-keeping on the platform. It says the charity “may have to repay that Gift Aid” if the records are not kept. That belongs to the tax hub, and this page stops there.

Is the donation platform a professional fundraiser?

This is the one open legal question on the page, and the page does not answer it. The Code says, verbatim: “Some online fundraising platforms fall within the definition of a professional fundraiser or commercial participator”. It does not say which. The research behind this guide found no Charity Commission, OSCR or court source that applies the test to a donation platform.

In England and Wales the test is in section 58(1) of the Charities Act 1992. A professional fundraiser includes anyone who carries on a fund-raising business, which the section defines as:

any business carried on for gain and wholly or primarily engaged in soliciting or otherwise procuring money or other property for charitable, benevolent or philanthropic purposes

Those words make it a real question for a platform that charges fees. Whether a platform solicits, when you or a supporter write the appeal, turns on its own terms. That is for a solicitor. If the answer is yes:

• England and Wales. The Act requires a written agreement meeting the prescribed requirements. Without one, the agreement cannot be enforced against the charity, and the fundraiser is not entitled to be paid under it. A court can order otherwise (s.59(4) and (5)). These are civil consequences, not a crime. The platform must also give donors a statutory statement that includes how its pay is worked out (s.60(1)(c)). Failing to is its offence (s.60(7)), with a defence of having taken all reasonable precautions and exercised all due diligence (s.60(8)).
• Scotland. The agreement must be in writing and signed by both sides. Failing, without reasonable excuse, to meet that requirement is itself an offence. The money must reach the charity within a fixed period that cannot be varied by agreement. The statement duty applies to every solicitation, however small.
• Northern Ireland. Nothing in law. The statutory regime has never been switched on.

So ask the platform, in writing, whether it considers itself a professional fundraiser or a commercial participator for your appeals, and keep the answer. If it says yes, or will not say, read use a professional fundraiser or commercial participator. The agreement is its subject.

Scotland and Northern Ireland: what changes

Scotland. For a charity’s own online and Direct Debit giving, nothing in the England and Wales position changes. The Code applies in practice and OSCR points charities to it, but complaints go to the Scottish Fundraising Adjudication Panel.

The differences arise only if a platform is a professional fundraiser under section 79 of the Charities and Trustee Investment (Scotland) Act 2005. They are in the professional-fundraiser section — on the agreement, the reverse of England and Wales. OSCR also says that direct debits sit outside Scotland’s collections licensing:

at the current time collections of direct debits, standing orders and other promises of money are not included as part of the licensing regime

Northern Ireland. The Code applies by voluntary agreement, and here no statutory professional-fundraiser regime sits alongside it. The regime in section 151 of the Charities Act (Northern Ireland) 2008 has never come into force. So a platform that would be a professional fundraiser in Great Britain attracts no statutory agreement, statement or refund duty.

The Direct Debit scheme, the Payment Services Regulations, PECR and Gift Aid apply as everywhere else. The charity soft opt-in expressly covers Northern Ireland charities.

One point is not settled: whether a Direct Debit sign-up on the doorstep is a collection under the House to House Charitable Collections Act (Northern Ireland) 1952. No Northern Ireland regulator has said. It is a doorstep question, not an online one.

Recording the set-up and reviewing it

The deliverable is a working set-up and a record of the checks behind it. Minute these seven things.

1. The Direct Debit route you chose, and why.
2. The platform or provider, with its confirmation that its payment provider is FCA-regulated.
3. Its fee display, checked on the live donation page against the Code’s standard.
4. Its written answer on professional-fundraiser status.
5. The Gift Aid wording and the tax explanation, checked against design a compliant Gift Aid declaration.
6. The opt-out wording on the form, and the date it went live.
7. The refund policy.

Look at it again when the platform, the form or the thank-you for regular donors changes, and when the subscriptions regime starts.

With the set-up minuted, the next step is to run a fundraising event lawfully.

Common mistake: assuming a street Direct Debit sign-up needs the same licence as a cash collection

They look like the same activity, but a Direct Debit instruction is a promise of future payment, not money collected. OSCR says so for Scotland, in the words quoted above. In England and Wales no statutory permit regime for sign-ups was identified, though any cash taken in the same street activity still needs whatever licence or permit the local rules require.

Sign-up pitches are controlled by voluntary site management agreements between fundraising organisations, not by law. In Northern Ireland the doorstep question is not established. Street and door-to-door collecting is covered when you run a collection lawfully.

Common mistake: believing you need your own bank sponsorship to take Direct Debits

The Regulator’s cashless-donations guidance states it as a flat rule; it is true only under your own Service User Number. Believing it, small charities decide Direct Debit is out of reach, or take on service-user indemnity and Guarantee liability they did not need. A Facilities Management provider or a platform can collect under its own number instead.

Common mistake: promising donors a statutory cooling-off period for website gifts

The section 61 right (England and Wales) and consumer cancellation rights are half-remembered, and neither applies to a web gift. A refund policy that cites a right that does not exist misleads donors, which the Code expects you not to do (1.2.1). The reverse mistake costs too. A charity that refuses a refund the donor is due, such as a Direct Debit taken in error, loses it through the donor’s bank anyway.

Worked example

Tollgate Youth CIO, in England, adds a donate button to its website. One-off gifts go by card through an online giving platform. Monthly gifts go by Direct Debit through the same platform, which collects under its own Service User Number. A donor gives online, ticks the Gift Aid box, and a few weeks later asks for her money back because she has changed her mind.

She has no statutory right to a refund. No cooling-off period applies to a web gift. The only refund right in the fundraising statutes is tied to broadcast and phone appeals by paid fundraisers.

Tollgate refunds only if its own policy allows it or the circumstances are exceptional. If it does, the Gift Aid position on a refunded gift is a question for the tax hub, and is not answered here. A Direct Debit taken in error would be different. She would have had it back from her own bank under the Guarantee, whatever Tollgate thought.

Tollgate needed no bank sponsorship and no FCA authorisation: the platform is the service user and the regulated party. What its trustees did need to record was the choice of platform and the checks on its fee display and payment provider. They also recorded the platform’s written answer on professional-fundraiser status.