For a business, ACH works like this: you (or your payment processor) send a batched electronic instruction through your bank into the Automated Clearing House network, and the network routes each entry to the recipient’s bank for posting. Payroll, vendor payments, tax remittances, and recurring customer billing all move this way. Settlement typically takes one to two banking days, and roughly 80% of ACH payments settle within a single business day.1Nacha. The Significant Majority of ACH Payments Settle in One Business Day – or Less Costs run far below card processing, which is why so many businesses use ACH for anything predictable or recurring.
Who Handles Your Payment
Every ACH transaction runs through the same chain of participants, and knowing who does what helps when something breaks. Your business is the Originator. Your bank or credit union is the Originating Depository Financial Institution (ODFI), and it is the entry point into the network. The ODFI reviews your file and forwards it to a central operator.2Federal Reserve Board. Automated Clearinghouse Services
Two operators run the national network: the Federal Reserve and the Electronic Payments Network, owned by The Clearing House. They receive batched files, sort each entry, and route it to the Receiving Depository Financial Institution (RDFI), which posts the credit or debit to the recipient’s account. When the originating and receiving banks use different operators, the operators coordinate to complete the transfer.2Federal Reserve Board. Automated Clearinghouse Services
Many businesses never connect to their ODFI directly. Instead they use a payment processor or payroll provider that acts as a Third-Party Sender, handling file creation and submission. Nacha rules require each Third-Party Sender to conduct its own risk assessment and compliance audit rather than lean on another party’s work.3Nacha. Third-Party Sender Roles and Responsibilities If your processor mishandles a transaction, your bank still answers to the network, which is why ODFIs vet those relationships carefully.
Credits, Debits, and the Codes That Govern Them
Business ACH transactions split into two directions. An ACH credit pushes money out of your account to a recipient. Payroll is the classic example, and vendor and tax payments work the same way. An ACH debit pulls money from someone else’s account into yours. Subscription billing, rent collection, and insurance premiums all use debits. Because a debit reaches into another party’s account, authorization requirements are stricter and the receiving bank has stronger return rights.
Standard Entry Class Codes
Every ACH file carries a three-letter Standard Entry Class (SEC) code telling the network what kind of transaction it is and which authorization rules apply. Wrong code, wrong rules, and the receiving bank has grounds to return the entry.
- CCD (Corporate Credit or Debit) covers business-to-business payments such as vendor invoices, cash concentration between company accounts, and payroll account funding. Authorization is usually a standing agreement between the two companies.4Nacha. ACH File Details
- PPD (Prearranged Payment and Deposit) covers money moving between a business and a consumer’s personal account. Direct deposit of paychecks and automatic mortgage debits both use PPD, and written consumer authorization is required.4Nacha. ACH File Details
- WEB covers consumer payments authorized over the internet, such as online bill pay or e-commerce checkout. Nacha requires originators to validate the account number before the first WEB debit as part of a fraud-detection program.5Nacha. Account Validation Frequently Asked Questions
- TEL covers one-time or recurring payments a consumer authorizes over the phone.
Authorization and Recordkeeping for Debits
Before you pull money from any account by ACH debit, you need the account holder’s authorization. These rules aren’t optional, and Nacha enforces them through a compliance program that can impose fines and suspension from the network.6Nacha. Compliance
A valid authorization captures the account holder’s name, bank name, account type (checking or savings), the nine-digit routing number, and the full account number. For recurring debits, the authorization must also spell out how the consumer can revoke it, including the method of notification and the advance notice you require.7Nacha. WEB Proof of Authorization Industry Practices
You must keep the original authorization, or an accurate copy, for at least two years after it ends or is revoked.7Nacha. WEB Proof of Authorization Industry Practices That record is your only defense if a customer disputes a debit with their bank. Without it, the funds come back, and repeated failures draw escalating Nacha fines. Unauthorized entry complaints are among the most common issues Nacha’s compliance program handles.6Nacha. Compliance
Authorizations don’t have to be on paper. Under the federal E-SIGN Act, an electronic signature meets Nacha’s requirements as long as it proves both identity and agreement. A recorded phone call, a clicked checkbox paired with logged IP and timestamp data, or a digital signature service can all work, so long as the record is reproducible as evidence.
When a customer revokes authorization, you must stop initiating debits within the notice period stated in the original agreement. Keep pulling after a revocation and the customer’s bank will return every entry as unauthorized, and a pattern of unauthorized returns puts your account under Nacha scrutiny fast.
How a Transaction Moves Through the Network
Once you have authorization and the account details, the payment follows a predictable path. Your business or your processor compiles the transaction details into a standardized file containing the SEC code, dollar amount, account numbers, and settlement date. That file goes to your ODFI at set intervals during the business day.
The ODFI batches your file with others and transmits the batch to one of the two ACH operators. The operator sorts every entry by destination and forwards each batch to the appropriate RDFI. The receiving bank verifies the account exists, checks its status, and either posts the entry or returns it.2Federal Reserve Board. Automated Clearinghouse Services Everything moves in batches rather than one transaction at a time, which is what keeps ACH cheap. Settlement happens when the Federal Reserve credits and debits the participating banks’ reserve accounts.
Standard Settlement Windows
ACH debits must settle either the same day or the next banking day. ACH credits give the sender more flexibility and can settle same-day, next-day, or in two banking days. Only the U.S. Treasury can schedule credit settlements further out than that.1Nacha. The Significant Majority of ACH Payments Settle in One Business Day – or Less
The network settles four times each business day. The Federal Reserve’s settlement system is closed on federal holidays and weekends, and from 6:30 p.m. to 7:30 a.m. ET on business days.8Nacha. The ABCs of ACH Files submitted late Friday or before a holiday can produce a three- or four-calendar-day gap even though the actual processing takes hours. If Thursday is a holiday and you run a Friday payroll, submit at least a day earlier than usual. Thanksgiving week and late December stack holidays and weekends together and cause the most trouble.
Same-Day ACH
For faster settlement, Nacha offers same-day processing through three submission windows during the business day, with cut-off times generally at 10:30 a.m., 2:45 p.m., and 4:45 p.m. Eastern Time. Files received by the ODFI before each window settle that same day. Anything submitted after the final window settles the next business day. Individual same-day ACH payments are capped at $1 million per transaction.9Federal Reserve Services. Same Day ACH Resource Center Larger single payments need a wire transfer. Same-day ACH typically carries a small additional fee that gets passed through to the originator.
Notifications of Change
Sometimes the receiving bank accepts a transaction but flags that the account information is slightly off. The account number is valid but the name doesn’t match, or the account type is checking when it should be savings. In those cases the RDFI sends back a Notification of Change (NOC) rather than returning the payment. You must correct the data before submitting the next transaction to that account.10Treasury Financial Experience. Notification of Change Ignore the NOC and future entries will bounce. Most processors automate the correction, but if you manage ACH files directly, build a process to review and apply NOCs promptly.
When Payments Come Back
Not every ACH transaction completes. Failed payments return with a reason code that tells you what went wrong. Common codes include R01 (insufficient funds), R02 (account closed), R03 (no account found), and R08 (payment stopped by the account holder). For business accounts, the receiving bank generally has two banking days from the settlement date to return a transaction. Consumer accounts get more protection, and unauthorized debits to a consumer account can be returned up to 60 calendar days after settlement.11Nacha. Reversals and Enforcement
Elevated return rates get noticed. Your ODFI monitors them, and Nacha’s compliance program may step in. If you regularly debit consumer accounts, watch your return rates and investigate any R10 (unauthorized) or R07 (authorization revoked) codes right away.
Reversing Your Own Mistake
If you send a duplicate payment, transmit the wrong amount, or debit the wrong account, you can initiate a reversal. Nacha limits reversals to four specific situations: duplicate entries, wrong account, wrong amount, and payments processed on the wrong date.12Nacha. Reversals The reversal must be transmitted within five banking days of the original settlement date.11Nacha. Reversals and Enforcement
A reversal is not a guaranteed recall. The receiving bank can return an improper reversal, and the account holder may have already spent the funds. Reversals aren’t meant to serve as a general undo button for business disputes, and misusing the process is itself a compliance violation.
What ACH Costs
ACH is one of the cheapest ways to move money electronically. Most payment processors charge somewhere between 0.2% and 1.25% per transaction, and many add a flat fee of $0.25 to $0.60 on top. Some skip the percentage and charge only a flat per-transaction fee. Card processing at 2% to 3.5% costs several times more, and the savings compound quickly on high volume or large invoices.
Pricing structures vary. Some processors charge a low per-transaction fee but require a monthly subscription; others bundle ACH into a broader payments platform. For recurring collections, the combination of low fees and automated scheduling makes ACH debits particularly cost-effective compared to card-on-file billing.
Returns and reversals carry their own fees. Most processors charge $2 to $5 per returned item, and those costs multiply quickly if authorization or customer data is sloppy.
Protecting a Business Account From ACH Fraud
Because ACH debits let outside parties pull money from your account, businesses face a different risk profile than consumers. Under Regulation E, consumers who report unauthorized ACH debits within 60 days of their bank statement are generally protected, with liability capped at $50 if reported within two business days.13Consumer Financial Protection Bureau. Regulation 1005.6 – Liability of Consumer for Unauthorized Transfers Business accounts do not receive Regulation E protection. If an unauthorized debit hits your business checking account and you miss the RDFI’s narrow return window, recovery gets much harder.
The most effective tool for preventing unauthorized debits is ACH Positive Pay, which most commercial banks offer. The service lets you set filters specifying which companies may debit your account, for what amounts, and on what schedule. Any debit that doesn’t match your filters gets flagged for review before it posts. Some businesses go further and place a blanket block on all incoming ACH debits, adding exceptions only for known payees.
On the origination side, Nacha requires businesses initiating WEB debits to validate the account number before the first transaction, using a commercially reasonable method to confirm the account is legitimate and open.5Nacha. Account Validation Frequently Asked Questions Several vendors offer real-time verification through bank-connected APIs, which cuts down on R03 (account not found) and R04 (invalid account number) returns.
Paying Overseas Through ACH
The ACH network can carry cross-border payments, but the rules shift substantially. Any transaction involving a financial account outside the United States must use the International ACH Transaction (IAT) entry code. IAT requires significantly more data than a domestic entry, including both parties’ full street addresses, the destination country, and a reason-for-payment code.14Nacha. International ACH Transactions Frequently Asked Questions – Corporate Customers
Every IAT entry is screened against the Office of Foreign Assets Control (OFAC) sanctions list by the originator, by the banks in the chain, and by the ACH operator, regardless of the dollar amount. Nacha also requires Travel Rule information for all IAT entries, even though federal Bank Secrecy Act rules only mandate it for transfers above $3,000.14Nacha. International ACH Transactions Frequently Asked Questions – Corporate Customers If your business regularly pays overseas suppliers or takes payments from international customers, confirm with your ODFI early that they support IAT origination and understand the extra data fields. A missing field on an IAT entry can trigger a compliance inquiry, not just a return.