The ACH payment system works by grouping electronic transfers between U.S. bank accounts into batches, routing them through a shared national network, and settling them between banks in one or two business days under rules written and enforced by NACHA. In 2025 the network moved 35.19 billion payments worth $93 trillion, which is why nearly every paycheck direct deposit, utility autopay, mortgage draft, and vendor payment you encounter runs through it.1Nacha. ACH Network Volume and Value Statistics Batching is the trick that keeps the cost low: instead of processing each transaction individually, banks collect them into files and hand them off at scheduled times, which is why ACH is cheap enough for a $20 bill payment and wire transfers are not.
Who Is Involved in an ACH Payment
Five parties touch every ACH transaction.2Nacha. How ACH Payments Work The Originator starts the payment, which could be your employer sending payroll or a utility pulling your monthly bill. The Receiver is the account owner on the other side. In between sit three financial players: the Originating Depository Financial Institution (ODFI) is the Originator’s bank and carries liability for the entries it releases; the Receiving Depository Financial Institution (RDFI) is the Receiver’s bank and posts the entry to the account; and the ACH Operator sorts and routes the batches between them.
Only two operators run nationally. The Federal Reserve runs FedACH, and The Clearing House runs the Electronic Payments Network. When the two banks on either end of a payment use different operators, the Federal Reserve settles between them.3Federal Reserve Board. Automated Clearinghouse Services NACHA sits above all of this. It doesn’t move money. It writes the operating rules, audits participants, and fines them when the rules are broken.4Nacha. Compliance
Many businesses never connect to a bank directly. They work through a Third-Party Sender, a company that handles the formatting and transmission of entries on their behalf. Payroll processors and payment platforms are the usual examples. Every Third-Party Sender in the chain must be registered with NACHA and must conduct its own risk assessment rather than relying on someone else’s.5Nacha. Third-Party Sender Roles and Responsibilities
Credits, Debits, and Why the Transaction Code Matters
ACH entries come in two directions. An ACH credit pushes money from the Originator to the Receiver, which is how direct deposit and government benefit payments arrive. An ACH debit pulls money from the Receiver’s account to the Originator, which is how your gym membership or mortgage autopay gets collected.
Every entry also carries a Standard Entry Class (SEC) code identifying what type of payment it is and which rules apply. Two codes cover most of what consumers and small businesses see:
- PPD (Prearranged Payment and Deposit) handles consumer transactions like payroll deposits and recurring bill payments. PPD entries carry the full Regulation E consumer protections, including the right to dispute unauthorized debits.
- CCD (Corporate Credit or Debit) handles business-to-business payments and carries far fewer dispute protections, because businesses are expected to resolve payment disputes through their commercial relationships.
The gap shows up when something goes wrong. A consumer who spots an unauthorized PPD debit has 60 calendar days from the settlement date to report it and get it returned. A business dealing with an unauthorized CCD debit has only two banking days. Small business owners who assume their business accounts enjoy the same protections as their personal ones often learn the difference the hard way. Other codes handle narrower cases: WEB for internet-initiated consumer debits, TEL for payments authorized by phone, and ARC and POP for check conversions.
How a Transfer Moves Through the Network
When an Originator submits payment instructions to its ODFI, the ODFI doesn’t fire them off one at a time. It gathers entries throughout the day and bundles them into batch files, each containing dollar amounts, settlement dates, SEC codes, and routing information for every payment inside.
At scheduled cutoff times, the ODFI transmits those batches to its ACH Operator. The Operator breaks the incoming batches apart and regroups the entries by destination bank. Every entry headed for the same RDFI gets packaged into a single delivery. The RDFI then matches each entry to the correct account and posts the credit or debit.
This batch-and-sort design is why the per-item cost is tiny. The FedACH fee schedule for 2026 charges $0.0035 per standard item, with a $0.0010 surcharge for Same-Day entries.6Federal Reserve Financial Services. FedACH Services 2026 Fee Schedule Your bank marks that up when it charges you, but the underlying network cost is close to nothing, which is the reason ACH dominates high-volume payments while wires at $15 to $30 do not.
Settlement Timing and Same-Day ACH
Clearing (the exchange of payment data) and settlement (the actual movement of money between the banks’ reserve accounts at the Federal Reserve) happen in quick succession. Standard ACH entries settle the next business day after the Operator processes the batch.
Same-Day ACH compresses that into a single business day. FedACH offers three windows:7Federal Reserve Financial Services. FedACH Processing Schedule
- Files submitted by 10:30 a.m. ET settle at 1:00 p.m. ET.
- Files submitted by 2:45 p.m. ET settle at 5:00 p.m. ET.
- Files submitted by 4:45 p.m. ET settle at 6:00 p.m. ET.
Miss the last cutoff and the file rolls to the next business day. Same-Day ACH is capped at $1 million per transaction as of 2026. NACHA has approved raising that to $10 million, but the change doesn’t take effect until September 2027.8Nacha. Increasing the Same Day ACH Dollar Limit to $10 Million Anything over the cap has to use standard next-day settlement or a wire.
Once an ACH credit settles, NACHA rules require the RDFI to make the funds available for withdrawal no later than 9:00 a.m. local time on the settlement date.9Nacha. Funds Availability Requirements for Non-Same Day Credit Entries That is a NACHA rule rather than a federal regulation, but for incoming payroll it’s firm. Banks may still place holds on debits if they suspect fraud or the account has a history of overdrafts.
Authorizing (and Stopping) an ACH Debit
No ACH debit should leave your account without authorization, and the rules are specific about what counts. The authorization has to be clear and readily identifiable, not buried in fine print. For consumer transactions, Regulation E requires preauthorized transfers to be authorized by a writing signed or similarly authenticated by the consumer, with a copy given to them.10eCFR. 12 CFR 1005.10 – Preauthorized Transfers
Written and electronic signatures handle most recurring payments. For a single entry, NACHA also allows an oral authorization if the Originator records the call or sends written confirmation before the entry settles.11Nacha. Meaningful Modernization Either way, the Originator needs your full legal name, bank account number, the nine-digit ABA routing number, and whether the account is checking or savings, which is why forms ask for a voided check. Businesses have to retain authorization records for at least two years after the authorization is revoked or terminated. If a dispute lands and the Originator can’t produce the authorization, the Originator loses.
Stopping a Recurring Debit
You can stop a preauthorized recurring ACH debit by notifying your bank at least three business days before the next scheduled transfer.12eCFR. 12 CFR Part 205 – Electronic Fund Transfers, Regulation E The notice can be oral or written. If you call, the bank can require you to follow up in writing within 14 days, and an oral stop-payment order expires after that window if you don’t confirm. Tell the company that’s been debiting you as well, though legally your bank must honor the stop order even if you don’t.
When Something Goes Wrong: Returns, Reversals, and Deadlines
If an entry can’t be processed or is disputed, the RDFI sends it back with a standardized return reason code. The ones you’ll run into most:
- R01, insufficient funds in the account.
- R02, account closed.
- R03, no account or unable to locate the account at that routing number.
- R04, invalid account number structure.
- R08, payment stopped by the Receiver.
- R10, consumer tells the RDFI the debit was never authorized.
- R29, the business version of R10, with a much shorter window.
For ordinary returns like R01 through R04, the RDFI has two banking days from the original settlement date to send the entry back. The timeline that matters most to you is for unauthorized entries. A consumer disputing a PPD debit under R10 has 60 calendar days from settlement. A business disputing a CCD debit under R29 has two banking days. If a corporate SEC code gets used by mistake on a consumer account, the consumer still gets the full 60-day window under return code R05.
Missing these deadlines is one of the most common ACH failures. An RDFI that returns a consumer entry on day 61 is outside the window, and a business that waits a week on an unauthorized CCD debit has already lost its chance through the ACH return process.
A reversal is a separate tool. The Originator uses it to fix its own mistake, such as a duplicate batch, the wrong receiver, or the wrong dollar amount. The reversing entry has to reach the RDFI within five banking days of the original settlement date, must carry “REVERSAL” in all caps in the description field, and must match the original entry’s SEC code, company ID, and amount.13Nacha. Reversals and Enforcement Using a reversal for anything else violates NACHA rules.
Protecting an Account From Unauthorized Debits
Banks offer tools you can turn on before anything goes wrong. ACH Positive Pay lets an account holder review every incoming debit and approve or reject it before it posts. Debit blocks reject all incoming ACH debits unless specific originators have been pre-approved. Debit filters sit between the two, letting an approved list through automatically and flagging the rest. These are most useful for business operating accounts that shouldn’t be receiving many debits in the first place.
Some protections run on the Originator’s side. For internet-initiated (WEB) debits, NACHA requires the Originator to validate the account number before the first entry and after any account change, using a method that is commercially reasonable for its risk profile.14Nacha. Supplementing Fraud Detection Standards for WEB Debits The small test deposits a new app makes when you link a bank account are called micro-entries, and NACHA requires them to be labeled “ACCTVERIFY” and monitored for signs of fraud.15Nacha. Micro-Entries One Pager
A Note on International Payments
The ACH system described here is domestic. International ACH Transactions (IATs) carry a separate set of compliance obligations, including Bank Secrecy Act Travel Rule requirements and OFAC sanctions screening by every party in the chain.16Nacha. International ACH Transactions FAQs – Corporate Customers If a payment you’re sending or receiving crosses a U.S. border, don’t assume the timelines and dispute rights covered above apply the same way.