Tenancy deposit protection rules explained

If your website takes a deposit from a tenant before they move in, whether through a booking widget, a payment link, or a simple bank transfer request, you need to follow the tenancy deposit protection rules that apply in England and Wales. Get this wrong and the penalties are steep: up to three times the deposit amount, on top of having to return it.

This isn't a niche technicality. Most assured shorthold tenancies fall under these rules, and the obligations kick in the moment money changes hands, not when the tenant signs anything.

🔑 What the tenancy deposit protection rules actually require

If you take a security deposit for an assured shorthold tenancy, you must put it into one of the three government-approved schemes (mydeposits, the Deposit Protection Service, or Tenancy Deposit Scheme) within 30 days of receiving it. There's no way round this by calling it something else. Whether the deposit lands in your account via a bank transfer, a card payment through a widget on your site, or cash handed over at the property, the clock starts the same way.

Alongside protecting the money, you must give the tenant the "prescribed information" within that same 30-day window. This includes:

• Which scheme is protecting the deposit and its contact details
• The amount taken and what it covers
• The address of the tenancy
• The circumstances in which some or all of the deposit could be withheld
• How the tenant can apply to have the deposit returned, and what happens if there's a dispute

Missing this step is one of the most common ways landlords end up in front of a tribunal, even when the deposit itself was protected correctly.

💻 What this means if you take deposits through your website

A lot of small landlords and serviced accommodation operators now collect deposits online rather than by cheque or bank transfer arranged over email. That's sensible: it speeds up move-in and gives you a paper trail. But a payment widget that just takes the money and says "thanks" isn't doing the job on its own.

The page collecting the deposit should make clear, before payment, what the money is for and how it's protected. That doesn't mean a wall of legal text on the booking form. It means:

• A short line stating which scheme protects the deposit
• A link through to your full terms or a dedicated deposits page with the prescribed information
• Clarity on whether the amount shown is a holding deposit (capped at one week's rent under the Tenant Fees Act) or the full security deposit (capped at five weeks' rent for most tenancies)

Landlords sometimes blur holding deposits and security deposits into one payment. They're legally different things with different caps and different rules, and a tenant who's overpaid because your form conflated the two has a straightforward complaint.

📋 The disclosure checklist before you take a payment

Before any deposit-taking widget goes live on your site, check it can support:

1. A clear statement of the deposit amount and what it's for, shown before the tenant pays
2. A link to (or download of) the prescribed information, not just a promise to email it later
3. Confirmation of which scheme is used, matching what actually gets set up within the 30 days
4. Separate treatment of holding deposits and security deposits, if you take both
5. A record of when payment was received, since that date starts your 30-day clock

None of this needs to be complicated. It needs to exist somewhere a tenant can find it, and it needs to match what you actually do once the money arrives.

🛠️ Where the website needs to carry its weight

The legal obligation sits with you as the landlord, not with your website. But a site that only handles the payment and skips the disclosure puts you one missed email away from a breach. A deposits page that states the scheme, links to the prescribed information template, and separates holding from security deposits in plain terms takes the guesswork out of it, and gives you something to point to if a tenant ever queries what they were told.

If you're adding or reviewing a deposit-taking widget, this is usually a small job: a dedicated page (from £25), a short block of text next to the payment form, and a link to your existing tenancy paperwork. It's cheaper to build properly the first time than to explain to a scheme adjudicator why it was missing.

The practical takeaway: protecting the deposit within 30 days is only half the job. The other half is making sure your website tells the tenant what's happening to their money before they hand it over, in writing, in a place they can find again later.