GoCardless

Finance & Payments United Kingdom Website Reviewed Sept. 22, 2026

Bank payment platform specialising in Direct Debit and open banking collections for recurring payments, used by businesses worldwide.

Report an issue with this profile

Certifications & Accreditations

Certification Certifying Body Scope Achieved Expiry Status
ISO 27001 British Assessment Bureau Scope stated as "all GoCardless services and products", reassessed annually, held since September 2016. Version year not stated; no certificate number or dates published. Sept. 1, 2016 — Current

Compliance Frameworks

ISO/IEC 27001:2022
Partial
Certified by the British Assessment Bureau with a stated company-wide scope, but no version year, certificate number or dates published.
GDPR 2016/679
Full
ICO registration ZA024862; DPO formally appointed. Data protection terms are embedded in the online Merchant Agreement rather than a standalone DPA.

Contact & Responsible Disclosure

Regulatory status

**FCA-authorised as an Authorised Payment Institution**, registration number **597190**, under the Payment Services Regulations 2017. Legal entity GoCardless Ltd, company 07495895.

**No PCI DSS evidence found** for GoCardless itself. Its PCI DSS pages are general educational guides, not compliance statements — do not cite them. As a bank-debit and open-banking provider its card-data scope is plausibly limited, but that should not be inferred.

⚠️ The string `001b000000NMgMPAA1` appearing in their security FAQ is an **FCA Register internal record ID, not an FRN**.

GoCardless is one of only two payments firms here publishing a valid security.txt with a dedicated disclosure address.

Assess GoCardless in your own vendor risk programme

SnapGRC lets you send security questionnaires, track DPA status, manage sub-processors, and maintain a supplier risk register — all audit-ready.

Supplier Management Free Risk Register