Menu
EN
EnglishEN
Let’s talk

← All insights

Can a SEPA Direct Debit mandate be signed electronically?

Learn how electronic SEPA Direct Debit mandates work, what makes a signature legally binding, and why creditors need evidence of customer authorisation.

Jamie FeeUpdated

Can a SEPA Direct Debit mandate be signed electronically?

By Jamie Fee, Rebeam Ltd | 1 October 2026

Yes. The European Payments Council's 2025 SEPA Direct Debit rulebooks, for both the Core and the Business-to-Business (B2B) schemes, say a mandate "may be an electronic document which is signed using a legally binding method of signature". Both rulebooks are in version 1.1, in force since 5 October 2025, and neither lists the methods. Whether a ticked box, a one-time code or a digital certificate is enough depends on the law that governs your agreement with the payer. And if a payer later says a collection was never authorised, it is you, the creditor, who has to show the mandate is valid.

Electronic mandates are common, but they are not yet the norm. In the second half of 2025, 13% of the 11.7 billion direct debits made in the euro area, roughly 1.5 billion payments, ran on an electronic mandate, and the other 87% relied on consent given in other forms, according to the ECB's payments statistics for the second half of 2025, published on 22 July 2026.

Which ways of signing electronically does the scheme accept?

There are two routes, and they put the evidence in different hands.

The EPC e-Mandate service. Annex VII of each rulebook describes an optional service in which the payer fills in the mandate on your website and is then sent to their own bank to confirm it. A routing service, supplied by or for your payment service provider (PSP), passes the proposal to a validation service run by the payer's PSP, where the payer logs in with the authentication means their bank issued. Once the bank has validated the proposal, neither you nor the payer can change its data; a later change needs a formal amendment. The payer's bank records the authentication means used, a time stamp and the identifier of its validation service, and keeps that record for as long as the mandate exists and at least for the refund period for unauthorised transactions. If you offer this route, you must also let payers amend and cancel electronically. The messages are the ISO 20022 mandate messages pain.009 to pain.012, set out in the EPC's SDD Core e-Mandate Service Implementation Guidelines (EPC002-09, 2025 version 1.0, effective 5 October 2025).

The limit is reach. PSPs choose whether to join the service, as the creditor's PSP, the payer's PSP or both, so it works only when your PSP offers routing and the payer's bank offers validation. When it does, the rulebook's own comparison of paper and electronic mandates (Annex VIII) shows what you gain: if a payer claims an unauthorised debit after the eight-week refund period, the payer's bank must first check whether it or the payer made an error when the e-mandate was issued, and it can recover the refund from your PSP only if it concludes that neither did.

Your own electronic mandate. Outside that service, section 4.1 of both rulebooks lets you offer the payer "an automated means of completing the Mandate, including the use of an electronic signature": a web form, a signature platform or a one-time code sent to the payer's phone. The process step for electronic signing is a single line: "Procedures for the electronic signature of Mandate are subject to agreement between Participants", the rulebook's term for the PSPs that have joined the scheme. Your own PSP has the most at stake, because the creditor's bank must pay each refund to the payer's bank "regardless of the status of the Creditor's account or the Creditor itself", as the EPC reminded participants in 2013. Once the mandate is signed, you extract its data without altering the signed document and send it with each collection, as you would for a paper mandate.

That openness is deliberate. The rulebook versions applicable from 1 February 2014 described an electronic mandate as one "created and signed with a Qualified Electronic Signature". In its clarification letter EPC098-13 of 1 October 2013, the EPC told scheme participants that the signature methods in section 4.1 "are not exhaustive", and that other legally binding methods, including those used under national legacy schemes, could continue if they complied with the SEPA Regulation. Rulebook version 8.0, approved on 8 October 2014, removed the notion of a qualified electronic signature altogether.

The EPC's Clarification paper on the SDD Core and SDD B2B rulebooks (EPC132-17; its section 4 reads the same in version 5.0 of 5 October 2025 and version 5.1 of 30 September 2026) now puts the rule in one sentence: the validity of an electronically signed mandate "is primarily a matter of the law that applies in the relationship between the Debtor and the Creditor". It is just as plain about the burden: "The Creditor is always liable for the proof of the validity of the mandate" when the payer's bank asks for it, and "not all kinds of legally binding methods of signature may allow for easy proof" that the payer signed. Before you build a signing flow, ask your PSP in writing which methods it accepts for your collections, and whether it offers the e-Mandate service.

Does EU e-signature law require a qualified signature?

No. In the EU, the reference is Regulation (EU) No 910/2014 (eIDAS). Its Article 25(1) says an electronic signature "shall not be denied legal effect and admissibility as evidence in legal proceedings solely on the grounds that it is in an electronic form", or because it is not a qualified signature. The regulation defines three levels:

  • an electronic signature, "data in electronic form which is attached to or logically associated with other data in electronic form and which is used by the signatory to sign" (Article 3(10)), which can be as light as a typed name;
  • an advanced electronic signature, which is uniquely linked to the signatory, capable of identifying them, created with data under their sole control, and linked to the signed data so that any later change is detectable (Article 26);
  • a qualified electronic signature, an advanced signature made with a qualified device and based on a qualified certificate, which "shall have the equivalent legal effect of a handwritten signature" (Article 25(2)).

Below the qualified level, recital 49 leaves the legal effect of an electronic signature to national law. That is why the EPC points to the law of your contract: a simple signature is not invalid, but its weight as proof depends on the jurisdiction and on the record around it.

Regulation (EU) 2024/1183 of 11 April 2024, in force since 20 May 2024, amended eIDAS without touching those two paragraphs of Article 25. It deleted Article 25(3) and moved the cross-border recognition of qualified signatures into a new Article 24a. It also created the European Digital Identity Wallet, which must let every natural person sign with a qualified electronic signature "by default and free of charge" (Article 5a(5)(g)); Member States may limit that free use to non-professional purposes. For consumer mandates, the strongest signature is becoming cheaper to offer. Nothing in eIDAS or in the rulebooks makes it compulsory.

What must an electronic mandate contain?

The same content as a paper one. Section 4.7.2 of each 2025 rulebook sets out the mandate's data (dataset DS-01), and it does not change when the mandate is signed on screen.

Element

Completed by

SDD Core

SDD B2B

Heading

You

"SEPA Direct Debit Mandate"

"SEPA Business to Business Direct Debit Mandate"

Legal text

You

Authorisation, plus the payer's refund right

Authorisation, plus a statement that the payer has no refund right once debited

Unique Mandate Reference

You

Required; may be given after signing, before the first collection

Same

Your name, address and Creditor Identifier

You

Required

Required

Type of payment

You

Recurrent or one-off

Recurrent or one-off

Payer's name and IBAN

Payer

Required

Required

Payer's address

Payer

Mandatory only when your PSP or the payer's PSP is in a non-EEA SEPA country or territory

Same

Payer's bank identifier (BIC)

Payer

Only if you ask for it and a PSP is in a non-EEA SEPA country or territory

Same

Date and place of signing, signature

Payer

Required

Required

Contract reference, reference parties

Either

Optional

Optional

Three details catch electronic forms out. The Core legal text must end: "A refund must be claimed within 8 weeks starting from the date on which your account was debited." Below it comes a second required line: "Your rights are explained in a statement that you can obtain from your bank". The B2B text must say instead that the mandate "is only intended for business-to-business transactions" and that the payer may ask their bank not to debit the account up to the due date. The field names must appear in one to three languages of the payer's country of residence, plus English if you cannot tell the payer's language in advance; the EPC publishes the mandate text in every SEPA language. And the payer's address matters most when a UK or Swiss bank is involved on either side, because both countries are in SEPA but outside the EEA.

Addresses are also moving. The 2025 rulebooks set 15 November 2026 as the date from which unstructured, free-text addresses would no longer be accepted in EPC payment messages. On 9 September 2026 the EPC's Payment Scheme Management Board delayed that end date and said it would set a new one in October 2026. The EPC still recommends moving straight to fully structured addresses, so an e-mandate form built today should collect the street, building number, postcode, town and country as separate fields.

Does it matter whether you use Core or B2B?

Yes, because the two schemes place the risk differently, and that changes what an electronic mandate has to achieve. Annex V of the 2025 Core rulebook summarises the differences; the B2B rulebook and the clarification paper fill in the rest.

SDD Core

SDD B2B

Who can be the payer

Consumers and businesses

Businesses only, where national law lets the payer give up the refund right

Refund of an authorised collection

Within 8 weeks, with no reason needed

None

Refund of an unauthorised collection

Within 13 months; the payer's bank recovers it from your PSP

Within 13 months if no B2B mandate covers the collection; the payer's bank cannot recover it from your PSP

Payer's bank checks the mandate

No obligation

Must confirm the mandate data with the payer before the first debit, then check every collection against it

Latest settlement of a return

5 inter-PSP business days after settlement

3 inter-PSP business days after settlement

Collection must reach the payer's bank

Between 14 calendar days and 1 inter-PSP business day before the due date

Same

Pre-notification to the payer

At least 14 calendar days before the due date, unless you agree otherwise

Same

e-Mandate service

Optional (Annex VII)

Optional (Annex VII)

PSPs registered, 11 September 2026

2,742

2,299

For a B2B e-mandate, your signature record is only half the job. If the payer's bank has not received the mandate data, it may reject the first collection with reason code MD01, "No Mandate", and the clarification paper calls it good practice for the business payer to confirm the mandate with its own bank before that first collection. Once three inter-PSP business days have passed, the risk of an unauthorised B2B debit sits with the payer's bank. Reach is narrower too: the EPC's overview of scheme adherence of 11 September 2026 lists 443 fewer PSPs in B2B than in Core, so check the payer's bank before you offer a B2B mandate.

What happens if a payer disputes a collection?

In Core, a refund within eight weeks needs no reason and no check of the mandate. The mandate becomes your evidence when a payer says the debit was never authorised. The Payment Services Directive (EU) 2015/2366 gives the payer until 13 months after the debit date to raise that claim (Article 71), and the Core rulebook then runs a fixed clock:

Step

From and to

Maximum time

Payer's bank accepts the claim for review and asks for a copy of the mandate

Payer's bank to your PSP

4 banking business days

Your PSP forwards the request

Your PSP to you

3 banking business days

You accept the claim, or dispute it with a copy of the mandate

You to the payer's bank, via your PSP

7 banking business days

Payer's bank decides; its decision is final within the scheme

Payer's bank

30 calendar days after it received the claim

If you do not answer in time, the payer's bank may decide on the payer's evidence alone and claim the refund from your PSP, which recovers it from you under your agreement. When you do answer, the rulebook's guidance tells the bank to compare the mandate with the collection data: the scheme, the Unique Mandate Reference, your identifier and name, the payer's IBAN and name, the BIC, the transaction type, the date of signing and the signature. It also checks that the mandate had not been cancelled, and had not lapsed because no collection was presented under it for 36 months.

Such claims are not rare events in the data. The 2025 EBA and ECB report on payment fraud, published on 15 December 2025, counted 73,935 fraudulent direct debits worth €112 million across the reporting countries in 2024, and most of that value came from unauthorised transactions.

What should you keep as evidence?

Both rulebooks set the storage rule in section 4.1. You must keep the signed mandate, paper or electronic, intact for as long as it exists, together with any amendment and its cancellation or lapse. After cancellation, you keep it as national law and your PSP's terms require, and at least for as long as a payer could still claim a refund for an unauthorised collection. The SEPA Regulation (EU) No 260/2012 allows a third party to store mandates on your behalf (Article 5(3)(a)(ii)), so a signature platform can hold the record, as long as you can retrieve it well inside the seven-banking-day answer window.

For an electronic mandate, keep a pack you could hand over the same day:

  • The mandate exactly as the payer saw it: heading, legal text, your name, address and Creditor Identifier, and the language shown
  • The data the payer entered: name, IBAN, and address or BIC where the rulebook requires them
  • The Unique Mandate Reference, and the date you gave it to the payer if that came after signing
  • The signing record: date, time, method and result, whether a one-time code to a verified number, a qualified certificate or the bank's validation under the e-Mandate service
  • Proof that the record has not changed since signing, such as a sealed PDF or a stored hash
  • Every amendment and the cancellation, each with its date
  • Each pre-notification you sent, with its date
  • The collection history, to show that the mandate never went 36 months without a collection
  • A retention date for the whole pack, set from the last collection under the mandate, or later if national law requires

Where does Rebeam fit?

Rebeam is a commercial payments partner. Regulated payment services are provided directly by the relevant licensed financial institution, which in scheme terms is your PSP. Rebeam helps businesses collect recurring euro revenue through SEPA Direct Debit Core: we start with how you operate, then help establish an appropriate collection process, and every collection is initiated only after a valid customer mandate. Service availability depends on your business model, customer geography, expected volumes and applicable onboarding requirements.

If you are still deciding whether Direct Debit suits your billing at all, our guide to SEPA Direct Debit vs bank transfer for recurring euro payments compares the two. To discuss your collection workflow, contact Rebeam.

Sources