An ACH application is the formal request a business submits to a bank or credit union to become an “Originator” on the Automated Clearing House network, which is what lets you send and receive electronic payments like direct deposits, vendor payments, and recurring customer debits. The application combines identity verification, financial underwriting, and a binding contract, and everything you do afterward runs under the NACHA Operating Rules that govern every participant on the network.1Nacha. 2026 Nacha Operating Rules and Guidelines The bank you apply through becomes your Originating Depository Financial Institution, or ODFI, and it carries the financial exposure if your transactions go wrong. That single fact shapes almost everything about how the application is reviewed.
Documents to Gather Before You Apply
Banks collect this information in part to meet their federal obligations under the Bank Secrecy Act, which requires financial institutions to keep records and report certain activity to help detect illicit transactions.2Financial Crimes Enforcement Network. The Bank Secrecy Act Specific requirements vary by institution, but most ask for the same core items.
- Your legal business name as it appears on government filings, your federal Employer Identification Number, and your physical business address.
- Social Security Numbers for each principal owning 25% or more of the business, consistent with federal customer due diligence requirements.
- A voided check or official bank letter confirming an active commercial account that can handle ACH settlement.
- Two years of federal tax returns, current balance sheets, or both, so the underwriter can judge your financial stability.
- Three to six months of prior processing statements, if you have already been running electronic payments elsewhere.
The application form itself will ask for your bank’s nine-digit routing number and the specific account number you want to use for settlement. Check these against your source documents. A transposed digit sends funds to the wrong place, and unwinding that is slow. You will also be asked for projected monthly processing volume and your maximum single-transaction amount. Give honest numbers. The bank uses them to set your exposure limits, and a wide gap between what you project and what you actually process will trigger a review later.
Picking the Right SEC Codes
One of the choices on the application that trips people up is which Standard Entry Class (SEC) codes you want authorization for. An SEC code tells the network three things: whether the transaction involves a consumer or a business, whether it is one-time or recurring, and what record format carries the payment data.3Nacha. ACH File Details This is not a cosmetic choice. Return code R05 flags a transaction where a corporate SEC code was used against a consumer account, and a pattern of those returns can jeopardize your ACH access.
The codes most businesses encounter:
- PPD (Prearranged Payment and Deposit) for consumer transactions like payroll direct deposit or recurring bill payments from a personal account.
- CCD (Corporate Credit or Debit) for business-to-business payments such as vendor invoices or corporate payroll funding.
- WEB for consumer debits authorized through a website or mobile app, which carries extra authentication requirements.
- TEL for consumer debits authorized over the phone.
- CTX, similar to CCD but supporting up to 9,999 addenda records for detailed remittance information.
Your ODFI will only approve the codes relevant to your business model. Request every code you realistically expect to use at the start, because adding one later means another round of underwriting.
How Banks Evaluate the Application
The underwriting team is answering one question: how likely is this business to generate losses that the bank has to absorb? Because the ODFI carries the exposure when a transaction is returned or disputed, that risk calculation drives every other part of the review.
Credit history matters for both the business entity and its principal owners. Underwriters look for a track record of meeting obligations and few payment defaults. If you have processed ACH before, your historical return rates carry significant weight. A pattern of returns, particularly unauthorized ones, is often enough on its own to get an application denied.
Certain industries face tougher scrutiny. Businesses in online gaming, telemarketing, debt collection, and similar sectors trigger enhanced due diligence under the Bank Secrecy Act’s anti-money-laundering framework.2Financial Crimes Enforcement Network. The Bank Secrecy Act If your industry is considered higher-risk, expect to provide additional compliance documentation and possibly to face higher reserve requirements or lower initial processing limits.
What You Sign: the ACH Origination Agreement
Approval does not come with a handshake. You will sign an ACH Origination Agreement, a binding contract with your ODFI that governs the entire relationship. Read it carefully rather than treating it as boilerplate. A typical agreement covers:
- The specific SEC codes you are authorized to use and the types of credits or debits you can initiate.
- Exposure limits capping the dollar amount of files you can send without further approval.
- Indemnification language making you responsible for the bank’s losses, legal fees, and liabilities tied to your ACH activity, including returned entries and unauthorized transactions.
- Pre-funding or reserve requirements that some originators must meet before transactions settle.
- Monitoring rights letting the bank watch your daily deposit, chargeback, and settlement activity, and hold funds if it sees something suspicious.
- Termination terms. Either side can usually terminate with written notice, but the bank can terminate immediately for suspected fraud, rule violations, or regulatory action.
The indemnification clause is where most of the financial risk sits. If a batch of debits is returned and your account cannot cover them, the ODFI can pursue you for the shortfall plus attorney fees. If you plan on high volumes, pay close attention to any pre-funding requirement, because that reshapes your cash flow.
From Submission to Going Live
After you submit the application and supporting documents through the bank’s secure portal or encrypted channel, the file enters the underwriting queue. Review timelines vary widely. A straightforward application from an established business with a clean history might clear in a few business days. Higher-risk industries or large projected volumes can take several weeks.
Once approved, you receive an Originator ID that identifies your transactions on the network, plus login credentials for the processing gateway or software you will use to create and submit NACHA-formatted files. Before you go live, some institutions send a pre-notification entry, called a “prenote,” to verify the connection between your account and the network. NACHA rules allow originators to transmit prenotes for account validation.4Nacha. Minor Rules Topics Once the prenote clears or the bank confirms your live status, you can start initiating transfers within your approved limits.
Approval Is Not the End: Authorization and Return Rates
An approved application does not let you debit anyone’s account whenever you want. NACHA rules require proper authorization from every person or business whose account you debit, and the requirements differ by transaction type.
Consumer debits using PPD need a signed or similarly authenticated written authorization. WEB debits initiated through a website require commercially reasonable methods to verify the consumer’s identity and evidence linking the authorization to that consumer.5Nacha. WEB Proof of Authorization Industry Practices TEL authorizations need either a recorded oral authorization for single entries or a written confirmation for recurring ones. For business-to-business CCD and CTX entries, an agreement between the companies is enough.3Nacha. ACH File Details Any consumer authorization should include the express language authorizing the debit, the amount or amount range, the date or frequency, the account and routing numbers, and how to revoke.6Nacha. Meaningful Modernization You must retain each authorization, or a reproducible record of it, for two years after it is terminated or revoked. If a consumer disputes a debit, the ODFI will ask for the authorization, and if you cannot produce it, you lose.
NACHA also monitors return rates across the network and enforces them through warnings and fines.7Nacha. Compliance Two thresholds matter most. The unauthorized return rate threshold is 0.5% for debit entries returned under codes R05, R07, R10, R29, and R51, all of which involve transactions the receiver says they did not authorize or where authorization was revoked. The administrative return rate threshold is 3.0% for codes R02, R03, and R04, which cover account data errors like closed accounts, invalid account numbers, and wrong account numbers.8Nacha. ACH Network Risk and Enforcement Topics Crossing the administrative threshold is not automatically a rule violation, but it triggers an inquiry into your origination practices. Your ODFI has its own exposure limits as well, and it may terminate your origination agreement well before NACHA takes formal action if your returns create unacceptable risk.
What ACH Processing Costs
ACH processing is significantly cheaper than card processing, but it is not free. Per-transaction fees for most businesses run roughly $0.20 to $1.50 per item, and high-volume originators can negotiate well below that. Some processors charge a small percentage of the transaction amount instead of or on top of the flat fee. Initial setup fees are common but usually modest.
Beyond the per-item cost, watch for monthly minimum fees charged when your volume falls below a threshold, batch processing fees charged each time you submit a file, and return or chargeback fees charged when a transaction comes back. Return fees compound the cost of weak authorization practices: every unauthorized return costs you the fee on top of losing the payment itself.
Your ODFI or third-party processor sets these fees, and they are negotiable, especially as your volume grows. Compare pricing structures before you commit, because the gap between a flat-fee model and a percentage model can be large depending on your average transaction size.