An ACH agreement is the written authorization you give a company to move money into or out of your bank account through the Automated Clearing House network. It’s what makes autopay for a utility bill, a gym membership, a loan payment, or a payroll direct deposit legally binding. Signing one commits your account to the schedule and amounts described on the form, and federal law gives you specific ways to cancel it and dispute charges that shouldn’t have gone through.
What the Authorization Must Include
An ACH authorization collects the routing information a bank needs to send or pull funds. At a minimum, the form asks for your full legal name, your bank or credit union’s name, the nine-digit routing number, and your account number.1NACHA. Sample Authorization for Direct Payment via ACH On a paper check, the routing number sits at the far left and the account number is directly to its right. You also mark whether the account is checking or savings, because banks process the two differently.
For recurring payments, the form must state the amount of each transfer (or how it will be calculated) and the schedule on which debits will occur.1NACHA. Sample Authorization for Direct Payment via ACH The Consumer Financial Protection Bureau advises confirming exactly how much will be withdrawn and when before signing anything.2Consumer Financial Protection Bureau. I Was Asked to Sign an ACH Authorization to Allow Electronic Access to My Account to Repay a Payday Loan – What Is That? A signature is required, and an electronic signature counts. An incomplete or inaccurate form will be rejected, and that rejection can trigger returned-item fees from both the company and your bank.
The company holding your authorization must keep the signed copy on file for at least two years after you revoke or terminate it. If you dispute a charge later, that record is what the company has to produce to prove you agreed. If it can’t produce one, it bears the loss.
How the Payment Moves
Once you sign, the company sends your banking information to its own bank, the Originating Depository Financial Institution. That bank batches your transaction with others and passes the file to one of two national ACH Operators, the Federal Reserve or the Electronic Payments Network.3Federal Reserve Board. Automated Clearinghouse Services The operator routes each payment to your bank, the Receiving Depository Financial Institution, and settlement happens when the money actually moves between the two banks’ accounts at the Federal Reserve.
About 80% of ACH payments settle within one banking day or less.4Nacha. How ACH Payments Work ACH debits, where a company pulls money from your account, always settle by the next banking day at the latest. ACH credits, like a payroll deposit landing in your account, usually settle the same or next business day, though they can take up to two banking days.
How to Cancel an ACH Authorization
You can cancel a recurring ACH debit at any time. Federal law gives you two routes, and using both is the safest approach.
Start by telling the company that you’re revoking authorization. Put it in writing and keep a copy. The CFPB recommends notifying the company directly that you’re withdrawing permission for the automatic payments.5Consumer Financial Protection Bureau. How Can I Stop a Payday Lender From Electronically Taking Money Out of My Bank or Credit Union Account?
Then place a stop-payment order with your bank. Under the Electronic Fund Transfer Act, you can stop a preauthorized transfer by notifying your bank at least three business days before the scheduled payment. You can do it orally or in writing, though the bank may require written confirmation within 14 days of an oral request.6Office of the Law Revision Counsel. 15 USC 1693e – Preauthorized Transfers Banks generally charge a fee for stop-payment orders, and the amount varies by institution, so check your account agreement.
If money keeps coming out of your account after you’ve revoked authorization, those withdrawals are now unauthorized transfers, and a different set of protections applies.
Your Rights If a Debit Is Unauthorized
The Electronic Fund Transfer Act caps your liability for unauthorized ACH debits from a consumer account, but the cap depends on how quickly you report.
- Report before or shortly after the unauthorized transfer posts, and your maximum liability is $50, or the amount actually taken, whichever is less.7GovInfo. 15 USC 1693g – Consumer Liability
- Learn that your card or access information was lost or stolen and wait more than two business days to tell your bank, and your liability can rise to $500 for unauthorized transfers that happen after that two-day window.7GovInfo. 15 USC 1693g – Consumer Liability
- Let an unauthorized transfer sit on your bank statement for more than 60 days without reporting it, and the bank has no obligation to reimburse any losses that occur after that 60-day deadline.7GovInfo. 15 USC 1693g – Consumer Liability
The 60-day clock starts when your bank sends the statement, not when you open it. Skip a few months of statements and you can lose your right to recover the money entirely.
What the Bank Has to Do After You Report
Once you report an error or unauthorized transfer, your bank has to investigate. Under Regulation E, it has 10 business days to complete the investigation and tell you the result.8eCFR. 12 CFR 1005.11 – Procedures for Resolving Errors The bank can extend the investigation to 45 days, but only if it provisionally credits your account within those first 10 business days so you have use of the disputed funds while it finishes. If the bank ultimately finds no error, it can reverse the provisional credit after notifying you.
Returned Transactions and the Fees That Follow
An ACH debit can be returned for a range of reasons: not enough money in the account, a closed account, a revoked authorization, or an account number that doesn’t match the name on the file. When a debit bounces, both the company and the account holder can be hit with fees. Merchants commonly charge a returned-payment fee, and most states cap those fees by statute, with limits typically falling between $10 and $50. Your bank may also charge a separate nonsufficient-funds fee.
For unauthorized debits, your bank can return the transaction to the originating bank within 60 calendar days of the settlement date. After that, the ACH return window closes, though your rights under the Electronic Fund Transfer Act may still apply if you reported the problem within the statutory deadlines above.
If the Account Is a Business Account
The consumer liability caps under the EFTA generally cover personal accounts, not business accounts. Businesses face greater exposure to unauthorized ACH debits, which puts the emphasis on prevention rather than dispute rights.
Many banks offer ACH Positive Pay for business accounts. You give the bank an approved list of companies and dollar amounts allowed to debit the account, and any debit that doesn’t match gets flagged for review before it posts. Setting a maximum dollar threshold per approved vendor adds a second layer of protection if a vendor’s own systems are compromised. Access to the approval list should be limited to authorized staff, and the list should be audited on a regular schedule.
If your business is on the collecting side, NACHA rules make you responsible for the accuracy and authorization of every transaction you originate. That means holding signed authorizations, validating account numbers for online payments, and handling return entries. The compliance burden sits with the originator, not the customer’s bank.