Recurring payments in South Africa: card tokenisation vs DebiCheck vs Capitec Pay VRP

Match the method to how your customers pay and how predictable the amount is. Our verdicts:

• Digital subscriptions, SaaS and memberships sold online: card tokenisation. Customers sign up in one step, and a card gateway's subscription tools do most of the work.
• Insurance premiums, school fees, gym contracts and loan instalments: DebiCheck. The amounts are predictable, the customer pays from a bank account, and the customer's own bank confirms the mandate.
• Bills that change month to month, where many customers bank with Capitec: pilot Capitec Pay VRP alongside cards or DebiCheck.
• Customers who prefer to approve each payment themselves: send a payment request each cycle, by PayShap Request or a pay-by-bank link, rather than collecting automatically.
• One large purchase paid off over time: that is buy now, pay later, not recurring billing; see the BNPL section below.

Plan for two methods: one default, and one fallback for customers the default does not suit. The rest of this page explains why, and links to a deeper guide for each method. For the rails underneath all of them, see how payments work in South Africa.

Each method answers three questions differently: who authorised the collection, how the amount is set, and how long it can be disputed.

Recurring payment methods in South Africa compared

Method	Who authorises	How the amount works	Dispute window	How you integrate
Card tokenisation	The customer, at the first card payment	Any amount you charge the stored card	Card scheme chargeback rules	A card gateway's tokenisation or subscriptions API
Ordinary debit order	The business, on the mandate it holds	Set by the mandate	60 calendar days from 13 April 2026	A bank or collections provider
DebiCheck	The customer confirms the mandate with their own bank	Inside the terms the customer approved	60 calendar days from 13 April 2026	A bank or collections provider
Capitec Pay VRP	The customer gives a standing consent with limits	Varies within the agreed limits	Ask your provider	Stitch, which offers Capitec Pay VRP

Last verified: 2026-11-05. Sources, checked 2026-11-05: PASA, Stitch. Dispute windows and provider offerings as published; we re-check them regularly. Registered Mandate shares the debit order dispute window and is covered in its own explainer.

Two things follow from the table. First, every mandate-based method in the table carries the same dispute window: the dispute period for debit orders, DebiCheck and Registered Mandates fell from 365 days to 60 calendar days from 13 April 2026^{[PASA, checked 2026-11-05]}. Second, the methods differ most on who authorised the collection, which decides how strong your position is when a customer says they never agreed.

When customers expect to pay by card and sign up online. You take the first payment through your gateway's checkout, receive a token for the card, and charge the token on each billing date without the customer present.

What it costs is the card rate on every charge. Published card rates, all excluding VAT, include 2.9% + R1^{[Paystack pricing, checked 2026-11-04]} at Paystack, 2.95% + R1.50 on the Growth plan^{[Peach Payments fees page, checked 2026-11-04]} at Peach Payments, 2.95% for local cards^{[Stitch Express pricing, checked 2026-11-05]} at Stitch Express and 3.2% + R2 for credit and cheque cards^{[payfast.io fees page, checked 2026-11-05]} at Payfast. On a low monthly price, the fixed part of the fee is a large share of each charge, so price your plans with it in mind.

Its weaknesses are the card's own: cards expire, get replaced after fraud, or run out of credit, and each of those turns into a failed charge you must recover. A good card subscription setup therefore includes a way for customers to update their card, retries on a sensible schedule, and emails that ask for action before access is cut. Our guides cover the detail: card tokenisation and subscription billing for the general build, failed recurring payments for retries and dunning, and, if you use Paystack, the Paystack hub's subscriptions and recurring billing guide.

When the amount is predictable and the customer pays from a bank account. PayInc runs the schemes behind these collections: EFT credits and debits, DebiCheck, Registered Mandate, PayShap and real-time clearing^{[SARB media release and FAQ, checked 2026-11-05]}. You do not connect to PayInc yourself. In the SARB Governor's words, "at the moment, anyone who wants to access the payment system has to go through a bank"^{[BIS: Kganyago, checked 2026-11-05]}, so you collect through your bank or through a collections provider that works with one.

The choice between an ordinary debit order and DebiCheck comes down to authorisation. With an ordinary debit order, the mandate you hold is your authority. DebiCheck, formally Authenticated Collections^{[PASA, checked 2026-11-05]}, adds a step: the customer confirms the mandate with their own bank before you collect. That step costs you some sign-ups, because a customer who ignores their bank's prompt never completes. It buys you much stronger evidence when a collection is questioned.

Our verdict: use DebiCheck for new mandates where disputes or affordability are a real risk, such as insurance, credit and long contracts. Keep ordinary debit orders where the dispute risk is low and your bank or provider supports them for your use case. The DebiCheck integration guide covers the mandate flow, debit orders vs DebiCheck covers the switch, and Registered Mandate explained covers Registered Mandate, another scheme PayInc runs^{[SARB media release and FAQ, checked 2026-11-05]}.

If you would rather have a team design the collections flow with you, Mctaba Labs payment integration builds recurring billing on South African rails.

Between DebiCheck and cards. Variable recurring payments let a customer give one standing consent with limits, after which the merchant can collect different amounts without the customer approving each one. Stitch announced Capitec Pay VRP on 4 December 2025, and Stitch calls it the first variable recurring payments offering in South Africa^{[Stitch blog, checked 2026-11-05]}. Stitch offers Capitec Pay, Capitec Pay VRP and PayShap Request^{[Stitch, checked 2026-11-05]}, and Ozow offers Capitec Pay VRP for subscription and recurring payments^{[Ozow, checked 2026-11-04]}, so there are two verified routes to integrate through today.

Why it matters: Capitec reported more than 26 million active clients in its FY2026 results^{[Capitec results, checked 2026-11-04]}, and cardless subscriptions already have a precedent, since Canva partnered with EBANX and Capitec Pay to offer cardless subscriptions to South Africans^{[EBANX press release, checked 2026-11-05]}. For a business whose bills vary, such as usage-based software, utilities or accounts with add-ons, VRP avoids both card expiry and the fixed terms of a debit order mandate.

Treat it as a pilot. An announcement is not the same as every customer having used it, and only one provider publishes a VRP price that we could verify: Ozow charges 1.5% with a minimum of R1^{[Ozow pricing page, checked 2026-11-04]} per Capitec Pay VRP transaction. For one-off Capitec Pay, Stitch Express lists 2% excluding VAT^{[Stitch Express pricing, checked 2026-11-05]}. Capitec Pay VRP explained covers the consent design, and the Capitec Pay integration tutorial covers the one-off payment build.

Three neighbouring options often come up in the same conversation.

Payment requests each cycle. Instead of collecting automatically, you send the customer a request each billing date and they approve it. PayShap Request went live in December 2024 with eight banks^{[PayInc Business Report 2025, checked 2026-11-04]}, and Stitch said in August 2026 that its PayShap Request runs on a multi-acquirer architecture with automated routing^{[Stitch blog, checked 2026-11-05]}. It suits customers who want control over every payment, at the risk of more missed payments than automatic collection.

Pay by bank for one-off payments. Useful for an annual plan paid upfront or a catch-up payment after a failed collection. See pay by bank in South Africa.

Buy now, pay later. BNPL splits one purchase into instalments the provider collects, so for the merchant it is a single payment, not a subscription. Stitch added buy now, pay later for South African merchants in May 2026^{[Stitch blog, checked 2026-11-05]}, and Payfast lists Payflex, MoreTyme and Mobicred among 18 or more payment methods^{[Payfast home page, checked 2026-11-05]}. See BNPL integration in South Africa.

Consumers are already trying these methods. In Stitch's 2026 Consumer Payments Report, BNPL had been tried by 39% of consumers in the past 12 months, Capitec Pay by 37% and PayShap by 35%^{[Stitch blog, checked 2026-11-05]}.

Two things, and both touch live systems.

The dispute window shrank. From 13 April 2026, customers have 60 calendar days rather than 365 to dispute a debit order, a DebiCheck collection or a Registered Mandate collection^{[PASA, checked 2026-11-05]}. Update dispute ageing, revenue recognition, refund rules and the wording in your terms and help pages.

The rule-maker changed. The SARB took over rule-related functions and the licensing and registration of payment institutions from 11 August 2026, and the functions moving to PayInc transferred on 2 September 2026^{[SARB, checked 2026-11-04]}. The SARB said clearing and settlement would continue as normal throughout^{[SARB, checked 2026-11-04]}, so collections kept running; what changed is who writes the rules and who registers providers. The PASA to PayInc transition guide lists what to update.

One change is still coming. The SARB published the draft directive for payment activities, the Authorisation Framework, in November 2025^{[SARB Annual Report 2025/26, checked 2026-11-05]}, and the May 2026 draft sets R2 million minimum capital for payment initiation^{[SARB, checked 2026-11-05]}. That matters to fintechs that want to initiate payments themselves, including VRP-style products and AI agents that pay. See also open banking in South Africa.

Keep the billing logic separate from the rails. The rails change; your plans, invoices and customer accounts should not have to.

1. A billing engine that does not know about rails. Plans, invoices, proration and credits live in your own system or a billing tool. It asks a payment layer to collect an amount from a customer, nothing more.
2. One record per authority to collect. A card token, a DebiCheck mandate and a VRP consent are different objects with different lifecycles. Store each as its own versioned record, with its references and status history.
3. A scheduler with rail-specific rules. Collection dates, retry timing and cut-offs differ by rail and by provider. Keep them as configuration, not constants.
4. Idempotent result handling. Results arrive asynchronously, sometimes twice, sometimes as files. Key every update on the collection's reference so repeats change nothing.
5. Recovery paths. A failed card charge, an unpaid debit order and a revoked consent each need their own next step: retry, ask for new details, or offer another method. Failed recurring payments covers dunning.
6. Daily reconciliation. Match every successful collection to an invoice and to the provider's settlement report, using the patterns in payment webhooks and reconciliation.

Recurring billing holds customers' bank and card details for years, and POPIA requires the responsible party to ensure its conditions for processing personal information are complied with^{[POPIA, checked 2026-11-05]}. Encrypt what you store, keep the gateway's token instead of card numbers, and limit who can see mandate records.

1. Segment your customers by how they pay today and how predictable their bills are.
2. Pick a default method for each segment from the verdicts at the top of this page.
3. Pick one fallback, so a failed card or a declined mandate has somewhere to go.
4. Model the costs: transaction fees, failed-payment recovery and the operations time each method needs.
5. Build the billing engine rail-agnostic, then add methods behind it.
6. Measure sign-up completion, failed collections and disputes per method, and move customers to whichever performs best.

For the regional view beyond South Africa, see payments in Southern Africa. When you want recurring billing built across cards, DebiCheck and VRP, Mctaba Labs payment integration works on these rails.