Pre-Authorized Debits (PAD): Setup and Compliance Guide

Pre-authorized debits (PADs) are one of Canada's most powerful and cost-effective payment collection tools, enabling businesses to pull funds directly from a customer's bank account on a scheduled basis. Subscription services, insurance companies, utilities, SaaS businesses, and lenders all rely on PADs. But unlike credit card processing, PAD collection comes with specific legal obligations under Payments Canada rules — and non-compliance can result in payment reversals, account termination, and regulatory penalties.

What Is a Pre-Authorized Debit?

A pre-authorized debit is an EFT debit transaction where the payor (your customer) gives written authorization for the payee (your business) to withdraw funds from their bank account on specified dates or when specific conditions are met. Unlike credit cards, which the customer uses to push payment to you, PADs allow you to pull payment from the customer's account — as long as you have their explicit authorization.

PADs are governed by Payments Canada's Rule H1, which sets out the requirements for obtaining, maintaining, and honouring PAD authorizations. Any business that initiates EFT debit transactions in Canada must comply with Rule H1, either directly or through a payment service provider that manages compliance on their behalf.

For a broader understanding of how EFT works in Canada before diving into PAD specifics, see our guide on ACH/EFT payments explained.

PAD Types: Personal vs Business

Payments Canada Rule H1

Rule H1 is the foundational rule governing pre-authorized debits in Canada. It is established by Payments Canada and is binding on all Direct Clearers (banks and financial institutions) and, by extension, all merchants who initiate PAD transactions through them.

The key obligations under Rule H1 can be grouped into four categories:

1. Authorization: You must obtain a written PAD agreement before initiating any debit.
2. Notification: You must provide advance notice before debiting.
3. Cancellation: You must honour cancellation requests and stop debiting when instructed.
4. Record retention: You must retain PAD authorization records for a prescribed period.

Consent Requirements

The PAD agreement (also called a PAD authorization or PAD mandate) is the legal document that authorizes your business to debit the customer's bank account. It must be obtained before the first debit is initiated and must include specific information required by Rule H1.

What Must Be in Every PAD Agreement

• Payor's name and bank account information (or a void cheque attached)
• Clear authorization statement granting the payee permission to debit
• Payor's signature (written or electronic) and date
• The amount of each PAD (or how variable amounts will be determined)
• The frequency or schedule of debits (e.g., monthly on the 1st)
• The purpose of the PADs (what the debits are for)
• The payee's name and contact information
• The payor's recourse rights (right to cancel, right to dispute)
• Information on how to contact Payments Canada if needed

Electronic Consent

Rule H1 allows for electronic PAD agreements, which is how most modern businesses collect authorization. An electronic PAD agreement is valid if:

• The payor actively checks a checkbox or types their name in an explicit consent field (passive acceptance such as clicking "I agree to terms" buried in a long document may not be sufficient)
• The full text of the PAD agreement is presented and accessible before consent is given
• A confirmation email or document is sent to the payor with the full PAD agreement details
• The business can demonstrate that consent was affirmatively given (audit trail)

Advance Notice Obligations

For most PAD types, you must provide advance notice before debiting. The specific requirement depends on the type of PAD:

• New PAD (first debit): Unless waived in writing by the payor, you must provide at least 10 calendar days' notice before the first debit.
• Fixed-amount recurring PADs: The PAD agreement itself typically serves as advance notice for subsequent fixed-amount debits on the agreed schedule. No separate notice is required for each debit if the amount and date are as agreed.
• Variable-amount PADs: You must provide advance notice of the specific amount before each variable debit. This is commonly done via email (e.g., "Your upcoming payment of $X will be withdrawn on [date]").
• Changes to amount or date: Any change to the agreed amount or debit date requires advance notice to the payor, typically at least 10 days before the changed debit.

Cancellation and Dispute Rights

Under Rule H1, payors have the right to cancel a PAD authorization at any time. Your obligations when a cancellation is received:

• Stop initiating new debits immediately upon receiving a cancellation notice
• A PAD submitted before you received the cancellation notice may still process, but you cannot initiate any new debits after cancellation
• Provide acknowledgement of the cancellation to the payor
• Retain the cancelled authorization record for your compliance documentation

Payors also have the right to dispute (charge back) a PAD that they believe was unauthorized or that does not match the agreed terms. The return windows are:

• Personal PAD — Unauthorized debit: 90 calendar days from the debit date
• Personal PAD — Amount or date dispute: 10 business days from when the payor became aware
• Business PAD: 10 business days from the debit date

Disputed PADs result in the amount being returned to the payor's account. Unlike credit card chargebacks, PAD disputes are handled through the banking system rather than through Visa/Mastercard, but the financial impact is similar — you lose the payment and may also pay a return fee.

Record-Keeping Obligations

You must retain PAD authorization records for a minimum period after the last debit under that authorization:

• Personal PAD authorizations: Retain for at least 7 years after the last debit
• Business PAD authorizations: Retain for the duration of the agreement plus a reasonable period

Records must be accessible so that you can produce them if a payor or their bank requests them in the context of a dispute. If you cannot produce a valid PAD authorization, the payor's bank will rule in favour of the payor and return the funds.

Electronic Consent Collection

Modern businesses collect PAD consent electronically through web forms, customer portals, or embedded checkout flows. Best practices for electronic consent collection include:

• Display the full PAD agreement text before requesting consent — do not hide it behind a link
• Use an explicit checkbox specifically for PAD authorization, separate from general terms of service acceptance
• Capture the IP address, timestamp, and browser fingerprint of the consent event
• Send a confirmation email immediately with the full PAD agreement attached as a PDF
• Store the consent record in a secure, auditable system with user account association
• Provide a clear process for customers to cancel their PAD authorization online

What a PAD Agreement Must Include

While the exact wording can vary, a compliant PAD agreement for a personal PAD must typically include language similar to the following sections:

1. Authorization Statement: "I/We authorize [Business Name] to debit my/our account at [Financial Institution] for payments related to [Purpose]."
2. Account Information: Transit number, institution number, and account number (or void cheque).
3. Debit Schedule: Specific dates or frequency (e.g., "on the 1st of each month").
4. Amount: Fixed amount or method for determining variable amounts.
5. Cancellation Rights: "I/We may cancel this authorization at any time by notifying [Business Name] in writing with 10 days' notice."
6. Recourse Statement: "I/We have certain recourse rights if a debit does not comply with this agreement. For more information on recourse rights, contact my/our financial institution or visit www.payments.ca."
7. Contact Information: Your business name, address, phone number, and email.

TIB Finance PAD Services

TIB Finance provides a complete pre-authorized debit solution that handles both the technical processing and compliance infrastructure:

• Compliant PAD agreement templates: Pre-approved agreement templates for personal and business PADs that meet Payments Canada Rule H1 requirements.
• Electronic consent collection: An embeddable consent widget that captures PAD authorization electronically with full audit trails — IP address, timestamp, and agreement version control.
• Automated record storage: Consent records are stored securely for the required retention period and are accessible through the merchant portal.
• Advance notice automation: For variable-amount PADs, our system can automatically send pre-debit notifications to your customers via email.
• Return management: NSF and dispute returns are reported promptly with detailed reason codes to support your follow-up process.

To set up PAD processing with TIB Finance, visit our merchant application or contact our team to discuss your specific use case. For businesses considering recurring payment setups, our article on recurring payments legal requirements in Canada provides additional compliance context.