Bacs payment security can feel opaque, full of technical terms like HSMs, digital certificates, and encryption protocols that seem to require a computer science degree to understand.
This guide cuts through the jargon, explaining what’s protecting your payment data behind the scenes and why the security infrastructure around Bacs should give you confidence, not cause concern.
Payment systems handle some of the most sensitive data an organisation holds: bank account details, payroll information, customer records, and high-value transactions. That makes them a significant target.
Without robust controls in place, the risks are real. Data breaches, fraudulent payment submissions, regulatory penalties, and the kind of reputational damage that’s hard to recover from. In Bacs environments, security isn’t optional or bolt-on. It’s a core operational requirement, built into the scheme’s rules and enforced at every layer.
The good news? That enforcement means the protections around your payments are far stronger than most people realise.
The term “HSM” comes up a lot in payment security, and it’s worth understanding what it actually means.
A Hardware Security Module is a dedicated device, either physical or cloud-based, designed specifically to generate, store, and manage the cryptographic keys that protect your payment files. Think of it as a highly secure vault that never lets the keys leave the building.
An HSM certificate is a digital certificate stored within that device. It’s used to apply a secure digital signature to your payment files before they’re submitted, essentially a tamper-evident seal that proves the file came from an authorised source and hasn’t been altered.
Why does this matter for Bacs? Because Bacs requires secure file signing, and HSMs are the widely accepted method for achieving it. When a payment file is signed using an HSM, it cannot be spoofed or modified without that being detected. The file either passes validation, meaning it’s authentic, or it doesn’t get processed at all.
For organisations worried about fraudulent submissions or unauthorised access to payment systems, this is precisely the control that prevents it.
Alongside HSMs, encryption forms the backbone of payment data security. It works at every stage of the payment journey:
Different types of encryption are used at different points:
Together, they create a layered defence against interception, tampering, and replay attacks, where an attacker tries to re-submit a legitimate payment file fraudulently.
You don’t need to manage this yourself. A good Bacs provider builds all of this into their infrastructure, so you benefit from it automatically.
Digital certificates do more than secure individual payments, they also underpin your compliance posture. For organisations handling Bacs payments, the relevant frameworks include Bacs scheme rules, UK GDPR, payment services regulations, and internal audit requirements.
Certificates contribute to compliance in several specific ways:
This last point is worth emphasising. Certificate-based access control means that even if someone gained access to your payment software, they couldn’t submit files without also having a valid certificate. It’s a meaningful additional layer of protection.
Certificates have expiry dates. If a payment certificate lapses, the consequences are immediate and operational. Payment files are rejected, submissions are blocked, and your next payroll run or Direct Debit collection is at risk.
Managing certificates properly means:
A reputable Bacs provider will manage certificate renewals on your behalf and alert you well in advance of any action required. If your current provider isn’t doing this proactively, it’s worth asking the question.
If the idea of physical security hardware feels complex or expensive, it’s worth knowing that HSM-as-a-Service (HSMaaS) is now widely available and equally secure.
Cloud-based HSMs offer the same cryptographic protections as on-premise devices, without the overhead of managing physical hardware. They’re designed for high availability, scale easily as your payment volumes grow, and are managed by specialists whose sole focus is keeping the infrastructure secure and compliant.
Security depends, as always, on choosing a provider that meets recognised standards and implements strong access controls. But for most organisations, HSMaaS is a practical and robust option that removes complexity rather than adding it.
Payment security in Bacs environments is built on multiple layers working together — HSM certificates, encryption, digital signatures, compliance frameworks, and careful lifecycle management. None of these are optional extras; they’re the architecture that keeps your payments trustworthy and your organisation protected.
Understanding how they work isn’t just useful for IT teams. It’s reassuring for anyone responsible for financial operations, because it confirms that the system handling your most sensitive transactions is designed, from the ground up, to be secure.
Here at paygate, we have a long heritage of helping businesses achieve Bacs payment efficiency. Our payment platform is one of the longest established Bacs approved software solutions available on the market. To our customers, we’re trusted experts.
We’d love to speak to you about your payment challenge, answer any questions or offer advice. Complete the form below to reach out.
If you’d like to discuss your business requirements and how paygate can help, get in touch.
"*" indicates required fields
Not necessarily. A reputable Bacs provider will handle certificate storage, renewals, and monitoring on your behalf, meaning you benefit from the security automatically without needing specialist technical knowledge in-house.
Yes. Cloud-based HSMs (HSMaaS) offer the same cryptographic protections as on-premise hardware, without the complexity and cost of managing physical devices. The key is choosing a provider that meets recognised security standards.
If a payment certificate lapses, your payment files will be immediately rejected and submissions blocked, putting payroll runs or Direct Debit collections at risk. A good Bacs provider will manage renewals proactively and alert you well before expiry.
Digital signatures applied via HSM certificates act as a tamper-evident seal. If a file is altered after signing, it will fail validation and simply won’t be processed — making unauthorised modifications detectable every time.
Not without also holding a valid certificate. Certificate-based access control means that software access alone isn’t enough, any submission attempt without an approved certificate will be blocked by the Bacs system.
✓
| paygate on prem | paygate v2 | paygate v3 | |
|---|---|---|---|
Security policy manager * Includes: password complexity manager, inactive timeout, time restrictions, IP address restrictions | ✓ | ✓ | ✓ |
AWS ISO27001 hosted * Primary fail over and back up UK data centres | ✓ | ✓ | |
SFTP file uploads/downloads *Secure way to move files across the internet, customers can use their own certificates | ✓ | ✓ | ✓ |
| Gemalto security tokens MFA | ✓ | ✓ | ✓ |
| Email MFA | ✓ | ||
| SMS MFA | ✓ | ✓ | ✓ |
APP MFA * Works with common auth apps such as Google Authenticator, Authy. Works on Android or iOS. | ✓ | ||
| PG Platform ISO27001 | ✓ | ||
Fraud tool *Currently support Blacklists and Whitelists. In a blacklist you add various sortcodes / account numbers and the system will prevent any payment to those accounts. In a whitelist you add sortcodes and account numbers and the system will ONLY allow payments to accounts on the whitelist. We include various tools to help build and maintain the lists. | ✓ | ||
GDPR subject access request * Search tools to help perform a GDRP lookup. Then can optionally ‘sanitise’ personal data from the system. | ✓ | ✓ | ✓ |
GDPR Data cleansing *Remove historical data by bulk or individual. | ✓ | ||
Browser compatbility * We maintain support for Chrome, Edge and Firefox. | ✓ | ||
Built for performance * Version 3 runs on super modern, high-end infrastructure | ✓ | ||
Single Platform * Customers have a single user account that they can use across all services (Enterprise, Online, Validate, etc). | ✓ | ||
Agent rebuilt key management system * Very secure way to get files to and from the Paygate cloud. Supports ways to automate files being sent into the paygate cloud and retrieving reports from the cloud. Key management was rebuilt for V3 to further increase security. | ✓ | ||
HTTPS uploads/downloads * paygate v3 supports both SFTP and HTTPS. | ✓ | ||
In browser File and Folder handling * Allows customers to securely organise their files and folders that are stored on paygate | ✓ |
| PG on prem | PG Ev2 | PGv3 | |
|---|---|---|---|
| Logging tickets by email | ✓ | ✓ | ✓ |
| Logging tickets by portal | ✓ | ||
| Logging tickets by phone | ✓ | ✓ | ✓ |
| Dedicated account management | ✓ | ✓ | ✓ |
| Uptime improvements | ✓ | ||
| Ongoing development | ✓ | ||
| Bug fixing | ✓ | ||
|
Auto File Import *Automatically imports a payment file and validates it. Users no longer need to manually browse for and import a file, paygate will do this in the background and present the validation results to the user. |
✓ |
| PG on prem | PG Ev2 | PGv3 | |
|---|---|---|---|
|
Designer in browser * In V2 Workflows use an older style desktop app. In V3 workflows are built and managed in the Paygate Browser app. It’s much easier to deploy and manage. |
✓ | ||
| Designer 3rd party app | ✓ | ✓ | |
|
Improved logging * A feature mainly for PS/CS to help them diagnose problems with workflows. Problems can be diagnosed and fixed faster. |
✓ | ||
|
New scheduler triggers * A new trigger type that allows the user to set up a workflow like you set up a meeting in Outlook. For some, this is more flexible and easier to understand than using CRON. |
✓ | ||
|
Triggers for multiple workflows * You can use a single trigger to start multiple workflows. It’s a simple feature that will make things easier to manage if you have a lot of workflows. |
✓ | ||
|
Workflow validation * Troubleshoots new workflows, validation |
✓ | ||
|
Workflow chaining * Allows a workflow to call another workflow. Using this you can simplify large complicated workflows in smaller separate ones. Easier to manage and diagnose issues. |
✓ | ||
|
New nodes * Various new nodes that help to build new types of workflows or help manage existing workflows. |
✓ | ||
|
Full documentation V3 will be fully documented with help guides and tutorials.
and tutorials * |
✓ | ||
|
Multiple filename variables * Supporting multiple filename variables should make designing complex workflows a bit easier. |
✓ | ||
|
Future developments * Pure Excel Importer – XLSX; BACS Calendar Widget; Workflow Timeline; Workflow / Mobile App notification / management; S3 Connector |
✓ | ||
|
Download and distribute A Reports * When you have workflow and HSM you can automate the entire BACS report download process. They can automatically be converted to other formats for integration into finance apps. They can be emailed to customers as html, pdf or zips. They can be made available for collection via SFTP. Or, if you use Agent, they can be security delivered to the customer’s private network. |
✓ | ✓ | ✓ |
| Partial submission | ✓ | ✓ | ✓ |
|
Lightsout submission * No signing |
✓ | ✓ | ✓ |
| Standard nodes for initiation | ✓ | ✓ | ✓ |
| PG on prem | PG Ev2 | PGv3 | |
|---|---|---|---|
| Batched bureau submissions | ✓ | ✓ | ✓ |
| Manual & Automated submission builder | ✓ | ✓ | ✓ |
| Customer import | ✓ | ✓ | ✓ |
| Bacs reporting tools | ✓ | ✓ | ✓ |
| Recall Bureau Customers by ID | ✓ | ||
|
Submission Re-entry * Complete your submissions over any amount of time
|
✓ | ||
|
Familiar workflow throughout *It will be familiar to V2 customer but they will notice improvements. |
✓ | ||
| Revamped manual submission mode *This is completely new in V3 Bureau.
Those customers wanting a more manual way of building their submission (Rather than using Jobs) will find a new, efficient way of working.
|
✓ | ||
|
Drag and drop files from anywhere *Like in other areas of V3. User can just drag and drop file in Bureau for processing. They can also use the Restricted File Browser and Server file browser – that add more security – if they wish. |
✓ | ||
|
Support for multiple file formats per submission * No longer limited to single Standard 18 submission for example
|
✓ | ||
|
Better default filename support *Makes working with files easier. |
✓ | ||
|
Usage Reporting over data range *Small but useful improvement to reporting. User can set a date range on the usage report. |
✓ |
| PG on prem | PG Ev2 | PGv3 | |
|---|---|---|---|
|
Validate *Validate is integrated in V3 and so customers that have both products can access them from the same client with the same account. |
✓ | ||
|
API Access *Validate API and the Payment API.
|
✓ | ||
| 4x Faster | ✓ | ||
|
Save Submissions *Save an ‘in-progress’ submission and return to it later. Build up a submission during the day |
✓ | ||
| Improved payment and submission searching | ✓ | ||
|
Customisable dashboard *Many useful, module specific, dashboard widgets, e.g. Payments, collections, workflow, etc. |
✓ |
| PG on prem | PG Ev2 | PGv3 | |
|---|---|---|---|
| Enhanced reporting including real-time usage | ✓ |
