ACH Origination Authorization Form: Sign, Submit, and Revoke

An ACH origination authorization form is the written permission you give a company to electronically debit or credit your bank account through the Automated Clearing House network. You fill one out to set up direct deposit, agree to recurring bill payments, or approve a one-time electronic withdrawal. To complete it correctly, you enter your exact bank details, choose the account type, specify the amount and frequency, read the revocation clause, and sign. Then you send it to the company, not to your bank.

Getting the details right the first time matters. A single wrong digit can bounce the transaction or, worse, send money to someone else’s account, and unwinding that through ACH reclamation takes days.

Information to Gather Before You Start

Nacha, which governs the ACH network, publishes a sample authorization form that most businesses model theirs after. Layouts vary, but every compliant consumer debit authorization asks for the same core details.¹ Have these ready:

Your full legal name, printed exactly as it appears on the bank account. A mismatch can trigger a return.
Account type. Check either checking or savings. Processing rules differ, and the wrong box will cause the transaction to bounce.
The official name of your bank or credit union.
Your nine-digit routing number. On a paper check, it is the first set of numbers along the bottom-left edge.
Your account number, printed to the right of the routing number on a check.
The amount. This is either a fixed dollar figure, a range of acceptable amounts, or a description of how a variable amount (a utility bill, for example) will be calculated.²
The start date and frequency: weekly, biweekly, monthly, or a single date for one-time payments.
Your signature and the date you signed. This is the legal act of consent that activates the authorization.

If you don’t have a paper check on hand, log into your bank’s online portal or mobile app and look under account details for the routing and account numbers. Read every digit back twice before you write it down.

Attaching a Voided Check

Many companies ask you to attach a voided check as a backup verification of your account numbers. Write “VOID” in large letters across the front so it cannot be cashed or deposited. The company uses the printed MICR line at the bottom of the check to confirm the numbers on your form match your actual account. If you don’t have checks, most banks will print a counter check or a direct deposit verification letter that does the same job.

Read the Legal Language Before You Sign

An ACH authorization isn’t just a data-collection form; it’s a legal agreement. Nacha rules don’t dictate exact wording, but every consumer debit authorization has to include a few specific elements.³ Knowing what to look for helps you spot a badly drafted form before you commit.

The Amount Disclosure

The form must clearly state that you are authorizing the named company to electronically debit your account. For fixed payments, the specific dollar amount appears on the form. For variable amounts, the form should describe how the amount will be determined and how you’ll be notified before each charge posts.¹ A form that asks you to authorize debits of unspecified amounts with no notification procedure is a red flag.

The Revocation Clause

Every recurring debit authorization has to tell you how to cancel it. The clause names the method (written notice, phone call, email, or a combination) and where to send your cancellation. It also states how much advance notice the company needs to stop the next scheduled debit; that timeline varies by company.¹ Read this section carefully so you know exactly what to do later if you need to end the arrangement. If a form gives you no path to cancel, don’t sign it.

Electronic Signatures

You don’t need to sign a paper copy. Electronic signatures carry the same legal weight as ink under the Electronic Signatures in Global and National Commerce Act, which provides that a signature cannot be denied enforceability solely because it is in electronic form.⁴ Online signups usually use a checkbox or an “Authorize” button as your signature. What matters is that your consent is clear and affirmative; a pre-checked box buried in terms of service is not the same thing.

Submitting the Form and What Happens Next

Once signed, the form goes to the company initiating the transfers (the “originator” in ACH terminology), not to your bank. Most organizations accept submissions through a secure online portal. If you have to send a paper copy, use certified mail or a secure fax line. Never send an unencrypted email with your routing and account numbers on it.

After the originator receives your form, it passes your account information to its bank, which runs a verification step before any real money moves. This usually takes one of two forms:

Prenotification, or prenote: a zero-dollar test transaction sent through the ACH network to your bank. If your bank doesn’t return an error within a few business days, the details are confirmed and live debits can begin.
Micro-deposits: two small deposits, usually under a dollar each, appear in your account. You report the exact amounts back to the originator to prove you own the account. The originator then withdraws the deposits.

If something is wrong with the data you provided (say your routing number is outdated because your bank merged with another), your bank sends back a Notification of Change. The originator has to correct the information within six banking days before initiating another entry. That can push your first scheduled transfer back a week or more, which is another reason to verify your numbers before you submit.

How to Cancel Later

There are two distinct ways to stop a company from debiting your account, and they work differently. Most people only think of one and get tripped up by the other.

Revoking the Authorization

Revocation means you take back the permission you gave the company. You notify the company directly, using the method described in the revocation clause you signed, that you no longer authorize debits. Also notify your bank that the authorization has been revoked.⁵ Once your bank knows the authorization is revoked, it must block future debits from that originator; it cannot wait for the company to stop sending them.⁶ Put your revocation in writing even if you also call. The paper trail matters if there’s a dispute later.

Stop Payment Order

A stop payment order is an instruction to your bank to block a specific upcoming debit, whether or not you’ve revoked the authorization with the company. Under Regulation E, your bank must honor a stop payment order if you give notice at least three business days before the scheduled transfer.⁷ You can do this orally or in writing, but if you call, the bank can require written confirmation within 14 days, and the oral order expires if you don’t follow up in writing. Banks commonly charge a fee.

One thing to keep in mind: canceling the debits doesn’t cancel any underlying contract you have with the company. If you owe money on a loan and revoke the ACH authorization, you still owe the balance. You’ve changed the payment method, not the debt.

Your Protections Under Regulation E

Federal law gives you a safety net if something goes wrong. Regulation E, which implements the Electronic Fund Transfer Act, caps your liability for unauthorized transfers and sets timelines for reporting problems.

If someone debits your account without a valid authorization, your liability depends on how quickly you report it:⁸

Report within 2 business days of learning about the unauthorized transfer, and your liability is capped at $50.
Report after 2 business days but within 60 days of receiving the statement showing the transfer, and your liability can reach $500.
Report after 60 days, and you could be on the hook for the full amount of any unauthorized transfers that occur after that 60-day window.

For any error, whether an unauthorized transfer, a wrong amount, or a missing deposit, you have 60 days from the date your bank sends the statement reflecting the problem to file a notice of error with your bank.⁹ Review your bank statements every month. Catching an unauthorized debit early is the difference between a $50 problem and a much bigger one.

If You Are the One Collecting the Form

If you run a business with recurring billing and you’re on the receiving end, Nacha rules require you to retain the original or a reproducible copy of each authorization for two years after it is terminated or revoked, and to produce it if your bank asks.² The two-year clock starts when the last debit occurs or when the customer revokes, whichever comes later. Keep paper forms locked up and digital copies encrypted. Transmitting account details over unencrypted email or unsecured web forms is prohibited under Nacha’s operating rules, and larger non-bank originators are required to render stored account numbers unreadable through encryption, tokenization, or truncation.¹⁰

1
Nacha. Sample Authorization for Direct Payment via ACH
2
Nacha. WEB Proof of Authorization Industry Practices
3
Nacha. The Importance of Compliant ACH Authorizations
4
Office of the Law Revision Counsel. 15 USC Chapter 96 – Electronic Signatures in Global and National Commerce
5
Consumer Financial Protection Bureau. How Can I Stop a Payday Lender From Electronically Taking Money Out of My Bank or Credit Union Account
6
Consumer Financial Protection Bureau. Comment for 1005.10 Preauthorized Transfers
7
eCFR. 12 CFR 1005.10 – Preauthorized Transfers
8
Consumer Financial Protection Bureau. Liability of Consumer for Unauthorized Transfers
9
Consumer Financial Protection Bureau. Procedures for Resolving Errors – 1005.11
10
Nacha. Supplementing Data Security Requirements