The ACH Network moves money through a defined chain of participants, and each link in that chain has a specific job. The parties to an ACH transaction are the Originator who starts the payment, the Receiver whose account is credited or debited, the Originating Depository Financial Institution (ODFI) that sends the file, the ACH Operator that clears and settles it, the Receiving Depository Financial Institution (RDFI) that posts it, and in many cases a Third-Party Sender acting between the Originator and the ODFI. In 2025, those participants collectively processed 35.19 billion transactions worth $93 trillion.1Nacha. ACH Network Volume and Value Statistics Each role carries its own obligations under the Nacha Operating Rules, and knowing which party owes what is the difference between a clean payment and a dispute no one can resolve.
Originator and Receiver
Every ACH transaction has two end parties. The Originator is the person, company, or government entity that initiates the payment, either as a credit (pushing money out) or a debit (pulling money in). An employer sending direct deposit is an Originator pushing a credit. A utility company collecting a monthly bill is an Originator pulling a debit. The Receiver is the person or entity whose bank account is credited or debited at the other end.
Authorization is the Originator’s foundational duty. Before any debit hits a Receiver’s account, the Originator needs the Receiver’s explicit permission. For internet-initiated payments, that authorization must include the dollar amount (or a range for recurring debits), the date or frequency, the account and routing numbers, and clear language that the Receiver is consenting to the transaction.2Nacha. WEB Proof of Authorization Industry Practices The Originator must also verify the Receiver’s identity through commercially reasonable authentication methods before a web-based debit qualifies as properly authorized.
Originators must keep a copy of each authorization for two years after it is terminated or revoked and produce it on request to their financial institution.2Nacha. WEB Proof of Authorization Industry Practices When a Receiver later disputes a debit as unauthorized, the Originator’s bank will ask for that proof. No proof, no defense.
The Originating Depository Financial Institution
The Originating Depository Financial Institution, or ODFI, is the bank or credit union that accepts payment files from an Originator and transmits them into the ACH Network. It is not a passive conduit. Under the Nacha Operating Rules, the ODFI warrants to the network that each entry it transmits has been properly authorized by the Receiver.3Nacha. Limitation on Warranty Claims If that warranty turns out to be false, the ODFI is on the hook.
That exposure drives the ODFI’s risk management duties. Each ODFI must perform customer due diligence on its Originators, set and enforce exposure limits, and monitor both forward and return transaction volumes, dollar amounts, and rates.4Nacha. Third-Party Sender Roles and Responsibilities An Originator with a sudden spike in returns or an unusual jump in volume will draw scrutiny. ODFIs that fail to catch problems can face enforcement through Nacha’s National System of Fines.
ACH Operators
Two national ACH Operators sit at the center of the network: the Federal Reserve Banks, through the FedACH service, and The Clearing House, which runs the Electronic Payments Network (EPN).5Federal Reserve Board. Automated Clearinghouse Services Every ACH entry passes through one of these operators on its way from the ODFI to the receiving bank.
Operators perform two distinct functions that people often conflate. Clearing is the process of receiving files from ODFIs, sorting individual entries out of those batches, and delivering each entry to the correct receiving institution. Settlement is the separate step of actually moving money between banks by crediting and debiting their accounts at the Federal Reserve.5Federal Reserve Board. Automated Clearinghouse Services A file can be cleared (delivered to the receiving bank) before settlement (the actual interbank money movement) occurs. When the ODFI and the receiving institution use different operators, the Federal Reserve handles the interoperator settlement.
The operators’ role is purely mechanical. They sort, route, and settle. They do not evaluate whether an individual transaction is authorized, and they do not make decisions about specific accounts. That responsibility stays with the financial institutions on either end.
The Receiving Depository Financial Institution
The Receiving Depository Financial Institution, or RDFI, is the bank or credit union on the other end. It receives sorted entries from the ACH Operator and posts them to the Receiver’s account. For non-same-day credit entries, the RDFI must make funds available for withdrawal no later than 9:00 a.m. local time on the settlement date.6Nacha. Funds Availability Requirements for Non-Same Day Credit Entries
Posting by Account Number
One point catches many businesses off guard: the RDFI can post a transaction based solely on the account number, even if the name on the entry does not match the name on the account. Nacha Operating Rule 3.1.2 expressly permits this.7Nacha. ACH Operations Bulletin 2-2024 – Voluntary Formatting Standard for Individual Name Field An Originator who mistypes an account number cannot rely on the receiving bank to catch the error through a name mismatch. The account number is what controls.
Returns
When an entry cannot be posted, the RDFI sends it back through the network using standardized return reason codes. Common examples include R01 for insufficient funds, R02 for a closed account, and R03 for an account that cannot be located. For most returns, the RDFI must transmit the return so it is available to the ODFI by the opening of business on the second banking day after the settlement date of the original entry.8Nacha. Risk Management Topics – October 1, 2024 That is two banking days, not 48 hours; weekends and holidays extend the clock.
Unauthorized entries get a much longer window. When a consumer reports that a debit was taken from their account without authorization, the RDFI can return the entry within an extended timeframe of up to 60 calendar days from the settlement date. This window exists so consumers who do not discover an unauthorized charge until their next statement arrives still have recourse.
Consumer Protections
Federal Regulation E, enforced by the Consumer Financial Protection Bureau, adds another layer of protection for consumers whose accounts are debited without authorization. Consumer liability depends on how quickly the problem is reported, with a $50 cap for reports made within two business days, up to $500 for reports made after two business days but within 60 days of a statement, and potentially unlimited liability for losses that occur after that 60-day window if the bank can show timely notice would have prevented them.9Consumer Financial Protection Bureau. 12 CFR Part 1005 (Regulation E) – 1005.6 Liability of Consumer for Unauthorized Transfers Extenuating circumstances like hospitalization or extended travel can extend these reporting windows to a reasonable period.
Third-Party Senders
A Third-Party Sender (TPS) sits between the Originator and the ODFI. Instead of connecting directly to a bank to send ACH files, a business contracts with a TPS, which handles file preparation, formatting, encryption, and transmission. Smaller companies that process payments but lack the infrastructure or banking relationships to go direct are the typical TPS customers.
The legal structure is layered. The TPS signs an agreement with an ODFI, then signs separate agreements with each Originator it serves. The ODFI bears warranty obligations to the network, the TPS bears obligations to the ODFI, and the Originator bears obligations to the TPS. If an Originator sends unauthorized entries, the ODFI can look to the TPS and the TPS can look to the Originator. But from the network’s perspective, the ODFI’s warranty is what matters.
Nacha requires Third-Party Senders to conduct annual Rules Compliance Audits and risk assessments.10Nacha. Third Parties in the ACH Network ODFIs must also register their Third-Party Senders in Nacha’s Risk Management Portal within 30 days of transmitting the first entry, or within 10 days of learning the TPS has nested relationships with other senders underneath it.4Nacha. Third-Party Sender Roles and Responsibilities Nested arrangements, where one TPS allows another TPS to originate through it, add another link in the chain and draw heightened regulatory attention.
Fraud Monitoring Across the Chain Starting in 2026
Beginning March 20, 2026, the Nacha Operating Rules expand fraud detection obligations across most of the parties above. Every ODFI, non-consumer Originator, Third-Party Sender, and Third-Party Service Provider involved in ACH processing must establish and implement risk-based processes designed to identify entries suspected of being unauthorized or authorized under false pretenses.11Nacha. Risk Management Topics: Fraud Monitoring (Phase 1) “False pretenses” covers situations where someone misrepresents their identity, claims authority they do not have, or lies about account ownership to induce a payment.
The rules deliberately avoid prescribing exactly how to do this. Each participant applies a risk-based approach, allocating resources based on its own assessment of which transaction types carry the highest fraud risk. Screening every individual entry before processing is not required, though pre-processing monitoring gives the best shot at catching problems before money moves.11Nacha. Risk Management Topics: Fraud Monitoring (Phase 1) Previously, only web-based debit entries and micro-entries required a commercially reasonable fraud detection system. The 2026 expansion applies to all entry types, and it reaches every party in the chain except the ACH Operators and the RDFI on the receiving side.
For a business evaluating its own ACH role, the practical takeaway is to know which seat you occupy. An Originator owes authorization and recordkeeping. An ODFI owes warranties and due diligence on its Originators. A Third-Party Sender owes audits, risk assessments, and the same fraud monitoring that applies to banks. Each party’s duties stack on top of the one below, and when a dispute hits, the question is not what the network did but what your role required of you.