A recurring payment authorization form gives a company written permission to pull a set amount from your bank account or card on a regular schedule, and filling it out is a matter of completing three sections accurately: who you are, how you’re paying, and what the payment terms are. Federal law requires that written consent before any business can set up preauthorized debits, so the form is also your proof of what you agreed to.1Consumer Financial Protection Bureau. 12 CFR 1005.10 – Preauthorized Transfers
Get the details right the first time. A wrong digit in an account number bounces the first payment, and a missing field can make the whole authorization non-compliant under the rules that govern it.
What the Form Has to Contain
Two sets of rules shape every recurring payment authorization form. Regulation E, which implements the Electronic Fund Transfer Act, requires that preauthorized electronic transfers from a consumer account be authorized “by a writing signed or similarly authenticated by the consumer,” and that the company give you a copy.1Consumer Financial Protection Bureau. 12 CFR 1005.10 – Preauthorized Transfers The Nacha Operating Rules, which govern the ACH network used for bank-to-bank transfers, add that a debit authorization to a consumer account must include seven specific pieces of information and be “readily identifiable as an authorization” with “clear and understandable terms.”2Nacha. The Importance of Compliant ACH Authorizations
The layout differs from one company to the next, but the fields you’ll see all trace back to those requirements.
Your Personal Information
The top of the form asks for your full legal name as it appears on the bank account or card you’re using, your billing address, phone number, and usually an email. Use the name that matches the account being charged. If the two don’t match, some processors reject the transaction.
On a paper form, print. An illegible account number is one of the fastest ways to trigger a failed first payment.
Your Payment Details
This is the most sensitive section and the one that needs the most care.
For a bank account (ACH) payment, you’ll enter two numbers: the nine-digit routing number that identifies your bank, and your checking or savings account number. Both appear at the bottom of a check. If you don’t use paper checks, your bank’s app or online portal will show them, or customer service can read them to you. Mark whether the account is checking or savings, because the routing number alone doesn’t tell the processor which type to debit.3Cooperative Federal. Recurring Payment Authorization Form
For a credit or debit card, the form asks for the card number (15 or 16 digits depending on the network), the expiration date, and the three- or four-digit security code on the card.4Chase. What Is a Credit Card Number and What Does It Mean? One point worth knowing: PCI security standards prohibit merchants from storing the security code after the initial authorization is processed. The code verifies the card is in your hand at signup, but the merchant cannot keep it on file for future charges.5PCI Security Standards Council. FAQ: Can CVC Be Stored for Card-on-File or Recurring Transactions?
Amount, Frequency, and Dates
The transaction section tells the company how much to charge and when. You’ll set three things:
- Amount, as either a fixed dollar figure per cycle or a description of how a variable amount is calculated (utility usage, an outstanding loan balance, and the like).
- Frequency: weekly, biweekly, monthly, or another interval.
- Dates: when the first withdrawal happens, and, if the arrangement has a defined endpoint, the end date or total number of payments.
If the amount will vary from cycle to cycle, a separate rule applies. The company or your bank has to send you written notice of the amount and date at least 10 days before any transfer that differs from the previous one. You can also set a range and ask for notice only when a charge exceeds a certain dollar threshold above the last payment.6eCFR. 12 CFR 1005.10 – Preauthorized Transfers
Signing and the Revocation Language
Your signature makes the authorization legally binding. Regulation E allows the form to be “signed or similarly authenticated,” so an electronic signature carries the same weight as ink on paper.1Consumer Financial Protection Bureau. 12 CFR 1005.10 – Preauthorized Transfers The federal E-SIGN Act backs this up by prohibiting courts from throwing out a contract solely because it was signed electronically.7Office of the Law Revision Counsel. 15 USC Chapter 96 – Electronic Signatures in Global and National Commerce
Before you sign, read the revocation language. Nacha’s rules require recurring payment authorizations to state, on the form itself, how you can cancel and how much advance notice the company needs.8Nacha. WEB Proof of Authorization Industry Practices If you don’t see that language, ask for it before you sign. You want to know how to get out before you’re in.
Then keep a copy. The company is required to give you one, but save your own regardless. It’s the reference document if a charge later shows up that doesn’t match what you agreed to.
Submitting the Form
How you send the form back depends on the company. Many businesses provide an encrypted online portal for uploading it. Others accept it through secure email, over the phone, or by mail to their billing department. Protect the account numbers in transit: don’t send them through unencrypted email or standard text message.
After the merchant receives your form, expect a verification phase before real charges begin. For ACH, the merchant may run a prenote, which is a zero-dollar test transaction sent through the banking system to confirm your routing and account numbers are valid. Prenotes typically take about three business days to clear. If one fails because of a typo or a closed account, the merchant will get in touch to fix the information before attempting a live charge.
The full setup, including any test transactions, usually takes three to ten business days. Most companies confirm by email or letter once automated billing is active. You may see a small pending transaction or the prenote itself appear briefly on your bank statement. Check your account around the first scheduled payment to confirm the amount and date processed correctly.
If You Need to Update or Cancel Later
When your card expires or you switch banks, most companies treat the change as a fresh setup: a new form with the updated details, a new signature, and another verification period before the new method goes live. Revoke the old authorization at the same time so charges don’t overlap.
To cancel, use the method the form’s revocation language describes. Send the request in writing when you can, through certified mail or another channel that creates a record. If the merchant later claims they never received your cancellation, that paper trail is what protects you. You can also notify your financial institution to stop a preauthorized transfer directly under Regulation E, which is a separate track from revoking with the merchant and worth knowing about if a company won’t stop charging you.6eCFR. 12 CFR 1005.10 – Preauthorized Transfers
If a Charge Doesn’t Match What You Authorized
Report it to your bank quickly. Under Regulation E, your liability for unauthorized electronic transfers is capped at $50 if you notify your financial institution within two business days of discovering the problem. Between two and 60 days after the statement showing the transfer is sent, the cap rises to $500. Wait more than 60 days after the statement is sent, and there is no cap on the unauthorized transfers that occur after that point.9Consumer Financial Protection Bureau. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers
The 60-day clock runs from when the statement is sent, not when you open it. Which is why the last step of setting up any recurring payment is a habit rather than a task: look at your statements each month, and compare what cleared against the form you signed.