An ACH authorization form is the written permission you give a company to move money into or out of your bank account through the Automated Clearing House network. To complete one, you provide your bank’s nine-digit routing number, your account number, the account type, the payment amount and schedule, and a signature — on paper, online, or by recorded phone consent. You then submit it through whatever secure channel the company provides, keep a copy, and watch the first few billing cycles to confirm the debits match what you agreed to.
Federal rules and Nacha’s Operating Rules set specific requirements for what the form has to say, how you can cancel it, and what happens if a debit is wrong or unauthorized. Knowing those rules before you sign puts you in a much better position than learning them after a problem shows up on your statement.
What a Compliant Form Must Contain
Under Nacha Operating Rules, a debit authorization to a consumer account must include six core elements.1Nacha. WEB Proof of Authorization Industry Practices If any are missing, the authorization is not compliant and transactions can be returned:
- Express authorization language, such as “I authorize Company A to debit my account.” Vague or buried consent doesn’t count.
- The transaction amount. For recurring payments where the amount varies, the form can state a range or explain how the amount is calculated.
- The date of the first transfer and how often it repeats.
- Your bank account number.
- Your bank’s nine-digit routing number.2Wikipedia. Routing Transit Number
- Instructions for revoking the authorization and how much notice you need to give.
Beyond those six items, the authorization must be “readily identifiable as an authorization” and written in “clear and understandable terms.”3Nacha. The Importance of Compliant ACH Authorizations A consent clause buried inside a long terms-of-service document can create compliance problems. The form should also state whether the account is checking or savings, because the bank needs that designation to route the transfer.
Filling In Your Information
Start with the routing and account numbers. Both appear at the bottom of a personal check: the routing number is the first nine digits on the left, followed by your account number. If you don’t have paper checks, your bank’s app or online portal will display both under account details. Getting either one wrong is the single most common reason ACH transactions fail. A voided check attached to the form works as a backup verification because the numbers are printed in machine-readable form. Write “VOID” in large letters across the front so no one can cash it. Banks that don’t issue paper checks will usually generate a direct-deposit authorization letter through online banking on request.
Enter your full legal name and mailing address exactly as they appear on the bank account. Some forms ask for a phone number or email so the company can reach you about payment issues. Select checking or savings. Then fill in the amount and confirm the schedule.
For fixed payments like a mortgage or insurance premium, the amount is a single figure. For variable payments like utility bills, the form may authorize debits “up to” a ceiling or for whatever the balance is each cycle. Read that language carefully so you know the maximum the company can pull in any one transfer.
Signing the Form
Regulation E requires that preauthorized electronic fund transfers from a consumer account be authorized “by a writing signed or similarly authenticated by the consumer.”4eCFR. 12 CFR 1005.10 – Preauthorized Transfers A wet-ink signature on paper satisfies this. For online or phone-based authorizations, the federal E-SIGN Act lets electronic records and signatures substitute for paper and ink, so clicking “I agree” on a secure webpage or giving verbal consent on a recorded call also counts.
Whichever method you use, the company must give you a copy.5Consumer Financial Protection Bureau. 1005.10 Preauthorized Transfers For paper forms, that’s a duplicate at signing. For online authorizations, it’s usually a confirmation email or downloadable PDF. Keep it. You’ll need it if you ever dispute a charge or have to prove what you actually agreed to.
Companies collecting authorizations online (Nacha calls these “WEB entries”) must use commercially reasonable authentication to verify your identity and keep a record linking the authorization to you.1Nacha. WEB Proof of Authorization Industry Practices
Submitting the Form Safely
How you deliver the form depends on the company. Encrypted online portals are the most common method and the safest, because the data is protected in transit. Some businesses still accept forms by mail or fax. If you mail a paper form, use certified mail or a courier with tracking so you can confirm delivery.
Never send bank account details through regular unencrypted email or text. Nacha rules prohibit transmitting banking information through unsecured channels. If a company asks you to submit the form through a method that doesn’t feel secure, push back and ask for a secure alternative. A legitimate business will have one.
After the company receives your form, some originators send a prenote, a zero-dollar test transaction to verify that your routing and account numbers work before initiating a live payment. Prenotes are optional. The overall setup window from form submission to first live debit usually runs three to five business days.
Why New Authorizations Fail
When a transfer bounces, the receiving bank sends back a return code. The most common ones on newly submitted authorizations are:
- R01, insufficient funds. The account didn’t have enough to cover the debit. Both your bank and the billing company typically charge a fee in the $25 to $40 range.
- R02, account closed. You need to submit a new authorization with an active account.
- R03, no account or unable to locate. The account number structure looks valid but doesn’t match any open account at that bank. Usually a digit was entered wrong.
- R04, invalid account number. The number itself is structurally wrong. Check it against your bank statement.
- R07, authorization revoked. You canceled the authorization but the company sent a debit anyway.
- R10, customer advises not authorized. You told your bank you never authorized the transaction, which triggers a dispute investigation.
R03 and R04 errors are entirely preventable by checking your entries against a bank statement or your bank’s portal before submitting. Attaching a voided check helps because the numbers are pre-printed.
Canceling a Payment or the Whole Authorization
You can cancel a preauthorized ACH debit at any time. The process involves two notifications, one to the company pulling the money and one to your bank, and timing matters.
Stopping a Single Upcoming Payment
To block one scheduled transfer, notify your bank at least three business days before the payment date. You can do this orally or in writing.4eCFR. 12 CFR 1005.10 – Preauthorized Transfers If you call, the bank can require written confirmation within 14 days. If it required confirmation and you don’t send it, your oral stop-payment order expires after 14 days.5Consumer Financial Protection Bureau. 1005.10 Preauthorized Transfers Ask, on the call, whether confirmation is needed and where to send it. Banks commonly charge $15 to $35 to place a stop-payment order.
Revoking the Entire Authorization
Stopping one payment is different from ending the arrangement. To revoke the authorization entirely, notify both the billing company and your bank that you’re withdrawing permission for all future debits. Once your bank knows the authorization is no longer valid, it must block all future payments from that company; it can’t wait for the company to stop sending them.6Consumer Financial Protection Bureau. Comment for 1005.10 Preauthorized Transfers – Section: 10(c) Consumer’s Right to Stop Payment Your bank may ask for a copy of the revocation notice you sent to the company.
Send the revocation to the company in writing, by email or letter, and keep proof of delivery. If a transfer goes through after you properly revoked, your bank is liable for the amount.
Reporting an Unauthorized Debit
If a company debits your account without permission, or for an amount or date that doesn’t match what you agreed to, Regulation E gives you the right to dispute the transaction and recover the money. Speed is the deciding factor.
You have 60 days from the date your bank sends or makes available the statement showing the unauthorized transfer to notify the bank of the error.7eCFR. 12 CFR 1005.11 – Procedures for Resolving Errors Once you report it, your bank has 10 business days to investigate. It can extend the investigation to 45 days, but it must provisionally credit your account within those first 10 business days while it works through the claim.
Miss the 60-day window and you lose the right to recover unauthorized transfers that occur after that period. Your potential liability becomes unlimited for any debits happening between the end of the 60 days and the date you finally report the problem.8eCFR. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers Review every statement, and flag anything you don’t recognize right away.
Business Accounts Are Different
The stop-payment rights, three-business-day rule, and liability caps described above come from Regulation E, which covers consumer accounts, meaning personal checking and savings accounts held by individuals.5Consumer Financial Protection Bureau. 1005.10 Preauthorized Transfers Business and commercial accounts don’t get these protections. If a company account is debited without authorization, your recourse comes from Nacha’s Operating Rules and your depository agreement with the bank. Return windows are much shorter, often two banking days, and the bank has no obligation to provide provisional credit while it investigates. If you’re signing an ACH authorization tied to a business account, read the commercial account agreement first.
After You Submit
An ACH authorization contains enough information to drain the account, so treat the form and its data like a blank check. Watch the first few billing cycles closely to confirm that amounts and dates match what you authorized. Catching a discrepancy early, while you’re still well inside the 60-day reporting window, gives you the strongest position to dispute the charge and recover the money.