BECS NZ custom payment pages

The following is a guide to building custom payment pages for merchants using GoCardless Pro or GoCardless Custom, and for partners.

 

What are payment pages?

Payers in New Zealand need to complete a Direct Debit Instruction (DDI) to authorise merchants to take payments from them via BECS NZ, the local Direct Debit payment scheme. A DDI is also known as a Direct Debit Authority (DDA).

With GoCardless Pro and GoCardless Custom, you may offer payers the option to complete the DDI online, on paper, or over the phone. Payers use payment pages to complete DDIs online.

Merchants using GoCardless Pro or GoCardless Custom have the option to use GoCardless’ own payment pages, or to build their own custom payment pages. 

Partners can opt to build and use custom payment pages as well. This will enable merchants who are using GoCardless through their app to offer their customers (payers) a consistent branding experience. 

You may also build your own payment notifications to further customise your payers’ experience.

Custom payment pages will need to be approved by GoCardless before being implemented.

 

How to build custom payment pages

There are 5 steps to ensure compliance with the BECS NZ scheme rules and GoCardless processes:

1. HTTPS hosted payment pages
2. Information entry page
3. Summary and confirmation page
4. Setup success page
5. Submit payment pages to GoCardless for approval

The details for each are below, and there’s a summary table here.

 

1. Host your payment pages with HTTPS

To ensure payers’ details are safely transmitted, your website must be configured to only accept secure (SSL - minimum of SHA-256 SSL support TLS.1 or TLS1.2) connections.

 

2. Information entry page

This is the sign-up page for your product / services, which is used to capture the payer information necessary to set up a DDI.

There are 3 compulsory elements and 2 recommended elements.

Compulsory:

1. Page heading that is identifiable to payers. Title it ‘Set up a Direct Debit Instruction with [merchant name]’. 
• For partners - make a GET request to the creditors endpoint, and pull the ‘name’ field to populate the merchant name
2. Entry points to collect payer details
• Account holder name
• Email address
• Bank account number
3. Page footer to let payers know about 3rd party data controllers that power your website. Text to read ‘Payments by GoCardless. Read the GoCardless privacy notice.’

Recommended:

1. Format of bank account number entry field. Split this field into 4 sections: 2-digit bank code; 4-digit bank branch code; 7-digit account number; and 2-digit account suffix.
2. Include the wording “Please ensure that this account is able to process direct debits. Some account types are not able to do so e.g., savings or term investments."

Why is the page footer a requirement?

This upfront notice ensures compliance with data protection law. GoCardless, our merchants, and our partners could be in violation of this law if the notice is not included. You can read more here. 

What if I can’t include the footer?

If the suggested footer isn’t technically possible, at a minimum you must include the following reference to GoCardless in your website privacy notice:

We use GoCardless to process your Direct Debit payments. More information on how GoCardless processes your personal data and your data protection rights, including your right to object, is available at gocardless.com/legal/privacy/

What if I’m a partner?

If you’re a partner, you must include the above ‘Payments by’ notice on your payment pages, or at a minimum, enable the merchant to provide a link to their privacy notice at the information entry page.

 

3. Summary and confirmation page

This page is to allow payers to view and verify their details before submitting them. 

There are 7 compulsory elements and 1 recommended element.

Compulsory:

1. Page heading that is identifiable to payers. Title it ‘Direct Debit Instruction’. 
2. Date of DDI set up i.e., today’s date
3. Payer details as collected in the information entry page
4. Payer bank name, which can be retrieved via the bank details lookup endpoint here
5. DDI consent and electronic signature wording:
   • “By signing and/or providing us with a valid instruction in respect to your Direct Debit Instruction, you have understood and agreed to the terms and conditions governing the debit arrangements between you and [Merchant Name] as set out in this Instruction. You agree to execute this document by electronic signature and you are aware that by electronically signing this document you are executing a legally binding document.”
6. Creditor / merchant information
   • Merchant name
   • Direct Debit authorisation code. Pro or Custom merchants - your GoCardless contact will provide you with this.
   • Name that will appear on payers’ bank statements
7. PDF link to the DDI and Direct Debit terms and conditions. This information can be retrieved via the mandate pdf endpoint here.

Recommended:

Include an ‘edit’ button, allowing payers to amend any incorrect information.

Why are the terms and conditions a requirement at this point in the process?

It’s a BECS NZ scheme rule that payers must be shown the T&Cs twice, to ensure they’re fully aware of the agreement they’re entering into. They must be shown once in the summary and confirmation page, and again via email notification once the DDI has been set up.

What if I'm a partner?

Partners can make a GET request to the creditors endpoint to pull the creditor/merchant information cited in points 5 and 6.

Query the API to retrieve the following:

• Merchant name - [name]
• Direct Debit authorisation code - [scheme_identifiers: reference]
• Name that will appear on payers’ bank statements - [scheme_identifiers: name]

 

4. Setup success page

This page is to confirm that the DDI has been set up.

It is best practice, although not a scheme requirement, to include the below:

1. Page heading that is identifiable to payers, i.e., message to confirm DD setup, such as “Direct Debit set up successfully”
2. Reminder of what payers will see on their bank statements

 

5. GoCardless approval of payment pages

Mock ups of your payment pages must be sent to GoCardless for approval prior to your go-live date. Once you have written approval from GoCardless, you may implement the payment pages. 

To test your payment pages, you can sign up here for a sandbox account.

What if I’m a partner?

When creating a new partner app and going through our technical certification process, you’ll be able to submit custom payment pages for approval through our partner portal.

 

Summary table

The below shows a summary of the relevant information at each stage of the payment pages.

All information is required unless specified otherwise.

	Information entry page	Summary & confirmation page	Setup success page
Page heading that is identifiable to payers	Displayed	Displayed	Displayed  Recommended
Account holder name	Captured	Displayed
Email address	Captured	Displayed
Bank account number	Captured Recommended to split into 4 entry fields	Displayed
Wording advising payers to ensure the account is able to process DDs	Displayed Recommended
Page footer to let payers know about 3rd party data controllers that power your website	Displayed
Date of DDI set up		Displayed
Bank name		Displayed
DDI consent and electronic signature wording		Displayed
Edit button allowing payers to amend their details		Recommended
Merchant name		Displayed
Authorisation code		Displayed
Name that will appear on payers’ bank statements		Displayed	Displayed  Recommended
PDF link to DDI and Direct Debit T&Cs		Displayed