To accept ACH payments from your customers, you need a business bank account, a payment processor (or a direct connection to the ACH network through your bank), and an authorization process that meets federal law. Most companies can have the pieces in place within a few weeks. The Automated Clearing House network moves money in batches between banks, letting you pull funds directly from a customer’s checking or savings account with no card swipe and no paper check. It has more moving parts than card processing, and federal rules on authorization, advance notice, and record keeping carry real consequences if you skip them.
What You Need to Get Started
Three things have to be in place before you can originate an ACH debit: a commercial bank account, a relationship with an Originating Depository Financial Institution (usually your bank), and either a direct connection to the ACH network or a third-party payment processor that handles the connection for you. Personal bank accounts generally lack the permissions needed for ACH origination, so a dedicated business account is the starting point.
Most small and mid-sized businesses go through a third-party processor rather than connecting to the network directly. The processor gives you a software interface or virtual terminal where you enter transaction data, and it handles file formatting and transmission to the clearing house. Monthly platform fees typically run $20 to $50, with per-transaction costs of $0.25 to $1.50 depending on volume and risk profile.
The National Automated Clearing House Association (Nacha) governs the network through its Operating Rules, which set security and data-handling standards for everyone in the chain.1Nacha. Supplementing Data Security Requirements Nacha enforces those rules through its National System of Fines, and violations get assessed against the originating bank, which will pass the cost back to you. Whatever platform you use should support modern encryption (TLS, not the outdated SSL protocol) to protect account data in transit.
Getting Customer Authorization
Authorization is the non-negotiable foundation of every ACH debit. The Electronic Fund Transfer Act and its implementing regulation, Regulation E, require that a consumer authorize any preauthorized transfer from their account in writing, and that the consumer receive a copy of that authorization.2GovInfo. 15 USC 1693e – Preauthorized Transfers Without proper authorization, you have no legal right to pull the funds, and you will lose every dispute.
Information to Collect
Every authorization needs the customer’s full legal name, the name of their bank, their account number, and their bank’s nine-digit routing number.3American Bankers Association. Routing Number Policy and Procedures The customer also needs to specify whether the account is checking or savings, since the network processes those differently. A wrong account or routing number triggers a return, and depending on your processor, you may pay a fee each time.
Written and Electronic Forms
An ACH authorization agreement spells out the payment amount, frequency, and duration. A one-time form covers a single pull on a specific date. A recurring authorization allows withdrawals on a schedule until the customer revokes it. Most payment processors supply template forms that meet the legal requirements.
For payments authorized online, Nacha’s rules require what’s called “similarly authenticated” authorization rather than a wet signature. You need a process that ties the specific customer to the specific authorization, typically through a login, email verification, or another identity-confirmation step. Your processor should provide the workflow, but the compliance obligation sits with you as the originator.
Validating Accounts Before the First Debit
If you collect authorizations through a website or mobile app, Nacha requires you to validate the customer’s account number before originating the first debit. At minimum, you must use a commercially reasonable method to confirm that the account is a legitimate, open account that can receive ACH entries.4Nacha. Account Validation Frequently Asked Questions Sending a debit to an unvalidated account number violates the Operating Rules, even if the customer typed it in themselves.
Commercial services handle validation through micro-deposits (sending a few cents and having the customer confirm the amounts), real-time bank verification APIs, or database lookups. The step catches typos and reduces returns, which protects your revenue and your standing with your processor. High return rates can get your ACH privileges suspended.
Choosing the Right SEC Code
Every ACH entry carries a Standard Entry Class code that tells the network what kind of transaction it is. Three codes cover most business use:
- PPD (Prearranged Payment and Deposit) is used for payments from individual consumers where authorization was obtained in writing. It is the standard code for recurring bills, membership dues, and loan payments.5ACH Guide for Developers. Standard Entry Class Codes
- WEB (Internet-Initiated Entry) is used when a consumer authorizes a payment through a website or mobile device. It triggers the account validation requirement above.5ACH Guide for Developers. Standard Entry Class Codes
- CCD (Corporate Credit or Debit) is used for business-to-business payments, including vendor payments, cash concentration, and funding disbursement accounts.5ACH Guide for Developers. Standard Entry Class Codes
Most processors pick the SEC code automatically based on the transaction type you choose, but verify this during setup. Applying a PPD code to an internet-authorized debit, for example, means you are not subject to the WEB validation rules on paper, but you are also not in compliance if your authorization was electronic rather than written.
Once authorization and account data are in your processor’s portal, you select debit (pulling funds) or credit (sending funds), confirm the dollar amount matches the authorization, and submit. The system bundles the entry into a batch file that transmits to the clearing house at the next processing window.
Processing Times
Standard ACH takes one to two business days. The network runs on a batch cycle with several processing windows through the day, and entries submitted after the last cutoff roll to the next business day. Cutoff times vary by processor and by the Federal Reserve Bank handling the file.
Same-Day ACH is available for transactions up to $1 million per payment, with additional processing windows and same-day settlement.6Federal Reserve Financial Services. Same Day ACH Resource Center Your processor will charge an added per-transaction fee for it. Whether the speed is worth the cost depends on your cash flow needs; for most recurring customer billing, standard timing is fine.
The 10-Day Notice Rule for Variable Payments
This is where many businesses trip. If you pull varying amounts from a customer’s account under a recurring authorization, federal law requires written notice of the amount and scheduled date at least 10 days before each transfer.7Consumer Financial Protection Bureau. Regulation E – 1005.10 Preauthorized Transfers A gym membership at a flat $49 per month does not trigger the requirement. A utility bill, a usage-based service, or any payment that fluctuates does.
You can simplify things by giving customers the option to receive notice only when a payment falls outside a specified range or differs from the previous transfer by more than an agreed-upon amount.7Consumer Financial Protection Bureau. Regulation E – 1005.10 Preauthorized Transfers Build either option into your authorization form so customers choose their preference upfront. Skipping the notice gives the customer grounds to dispute the charge, and you will lose that dispute.
Returns, Disputes, and What Customers Can Do
When a transaction fails, your processor’s portal displays a return reason code. The two you will see most often are R01, insufficient funds, and R03, account could not be located (usually a closed account or a data-entry error). For an R01, the customer may simply have been short that day, and a second attempt after a few days often succeeds. For an R03, contact the customer for updated account information because the account on file is no longer valid.
Keep a log of returns with codes and dates. Nacha monitors return rates at the originator level, and consistently high rates signal poor authorization practices or bad account data. Your bank may restrict or terminate your ACH access if the rates climb. State laws generally allow businesses to charge a fee for returned payments, with caps typically between $25 and $50, and you must disclose the fee in your service agreement or at the point of sale to collect it.
Regulation E gives consumers three protections that shape your risk. A customer can stop any single preauthorized transfer by notifying their bank at least three business days before the scheduled date; the notice can be oral or written, and an oral notice is effective immediately, though the bank can require written confirmation within 14 days.7Consumer Financial Protection Bureau. Regulation E – 1005.10 Preauthorized Transfers2GovInfo. 15 USC 1693e – Preauthorized Transfers Nothing you do can prevent a stop payment order.
Customers can also revoke a recurring authorization at any time, cutting off all future debits under that agreement. Your form can (and should) ask customers to notify you directly, but the customer’s bank will honor a revocation whether you were told or not. Build your billing workflow to handle revocation cleanly rather than treating it as an error.
When a consumer tells their bank that a debit was unauthorized, the bank can return the entry and pull the money back out of your account. For consumer accounts, the receiving bank can file an unauthorized entry warranty claim against your bank within 95 calendar days of settlement. Beyond that initial window, claims can still be filed up to two years from the settlement date.8Nacha. Limitation of Warranty Claims Your bank passes the chargeback to you. The only defense is producing the authorization.
Record Keeping
Nacha’s Operating Rules require you to keep the original or a copy of each authorization for two years from the date the authorization is terminated or revoked.9Nacha. Proof of Authorization Industry Practices Regulation E separately requires anyone subject to the Electronic Fund Transfer Act to retain evidence of compliance for at least two years from the date action was required.10eCFR. 12 CFR Part 1005 – Electronic Fund Transfers (Regulation E) In practice, hold authorizations for at least two years after the last transaction under them, since unauthorized entry claims can arrive up to two years after settlement.
Store authorizations digitally in a format you can retrieve fast. When your bank asks for proof of authorization in response to a dispute, the request usually carries a tight deadline, and failing to produce the document promptly loses the dispute by default. Every field on the form should be legible and match the bank’s records exactly; a name mismatch or an illegible account number weakens your position even when the authorization is genuine.
Beyond authorizations, keep a transaction log with confirmation receipts, trace numbers, return codes, and dates for every entry you originate. That log is your primary tool for reconciliation and your first line of evidence if any payment is questioned later.