This might be a cross-over between stackoverflow and money.stackexchange but I am wondering about the rules and regs of setting up a Pre-Authorized Direct Debit (PAD) through an online form.

Say I already have a payment processing provider that handles the actual transactions through a code library for me. (I'm a programmer so will be writing this myself)

What would be the minimum legally required information a form would have to support to authorize such a payment?

By this I mean for example: They fill out their banking information, name, address etc for the PAD, and then what else? Do they need specific terms & conditions, do I need disclaimer text? Does all the info need to be stored in the DB for Anti-Money Laundering purposes, and does it need to be authorized with an electronic signature (or just a checkbox)?

Please feel free to close as off-topic if it's too much of a cross-over with programming. However the topic should have some relevance as all PADs online or offline need regulatory oversight.

Many Thanks

  • Basically I don't want to build a form which hooks in to a users account an authorizes a direct debit with as little as a submit button. I feel there needs to be something else in place to make it viable. – simonw16 Mar 28 '19 at 19:50
  • Questions relating to law and regulation require a country tag. – Chris W. Rea Mar 28 '19 at 21:02
  • Done :) Of course it's country specific. Canada! – simonw16 Mar 28 '19 at 21:03
  • 1
    I'm voting to close this question as off-topic because this is about a business idea not personal finance – quid Apr 4 '19 at 17:13
  • Is there a channel for finance in general then? Because if not I can't think of anywhere else this question can go where there's a solid community who understand the legalities of financial transactions – simonw16 Apr 4 '19 at 22:32


Until you're 100% sure you know exactly what you're doing you shouldn't be doing this.

Things to consider:

  • Compliance: Do you adhere to all laws and regulations regarding transmission and storage of banking data.

  • Security: Do you have all the security under your control and are you an expert in security ?

  • Cost: If everything goes perfectly and you never have a problem. How much money do you save vs. buying a solution off the shelf ? (What happens if something does go wrong, despite the fact that you're an expert in security and do everything in compliance to all the laws and regulations ?)

To answer the question:

  • You don't need to agree to T&C. You do need to make it extremely obvious that they're about to give you money. You don't need a specific disclaimer.

  • You do not need to store this information. Please don't. Money goes from their bank account to your bank account. You can see it on your bank statements and everything is already documented.

  • If you need to draw recurring payments you likely need to store all the information you gathered. Would be good if you could just make the payment provider do this, but they likely won't. Make sure you use strong encryption on every field in the database that you store.

  • You don't need a signature.

| improve this answer | |
  • Its a fair point, and exactly why I'm questioning it because my company have tasked me with integrating this feature. We have our third party provider and access to their API. I simply need to send Institution/Transit/Account numbers to the API and it handles the set up for me. I am not a security expert, and I have a compliance guy helping me with that part. However, I do have to do it, regardless of how capable I am. No chance of getting another off the shelf solution for this one. It has to be done using the API I'm given. We have a contract with them. – simonw16 Apr 4 '19 at 0:05
  • @simonw16 edited. – xyious Apr 4 '19 at 15:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.