The Nacha operating rules for direct deposit are the private-sector rulebook every U.S. bank and credit union follows when moving payroll and other credits through the ACH Network. They control four things that matter to you as an account holder: how your authorization has to be set up, when the money must be in your account, when an employer or other originator can pull a deposit back, and how errors and unauthorized transfers get resolved. In 2025, the ACH Network processed over 35 billion payments worth roughly $93 trillion, with payroll direct deposit a large share of that volume.1Nacha. ACH Network Volume and Value Statistics
What Your Authorization Has to Look Like
Before an employer or other originator can send money to your account, you have to give explicit permission. Under Article Two of the Nacha Operating Rules, that authorization must be in writing or an equivalent electronic format that clearly shows you agreed, and it has to include your bank routing number, account number, and whether the account is checking or savings.2Nacha. About Us
After you sign, the originator must give you a copy and keep the original (or an accurate reproduction) for at least two years after the authorization is terminated or revoked.3Nacha. WEB Proof of Authorization Industry Practices That two-year clock starts when the direct deposit relationship ends, not when it begins. If a dispute arises and the originator’s bank cannot produce proof of authorization, liability shifts to the originator.
Test Deposits Before the First Real One
Many originators verify your account information first by sending micro-entries, small test credits of less than $1.00 each. Under the rules, these must carry the description “ACCTVERIFY” so you can recognize them on your statement. If offsetting debits are used, the credits and debits must be sent at the same time, and the net result can never leave your account with less than it started with.4Nacha. Micro-Entries The originator cannot send a real deposit until you confirm the micro-entry amounts.
When the Money Must Be in Your Account
For a standard, non-same-day direct deposit, your bank must make the funds available for withdrawal no later than 9:00 a.m. local time on the settlement date.5Nacha. Funds Availability Requirements for Non-Same Day Credit Entries Many banks receive payroll files a day or two before payday and choose to post the credit early as a competitive perk. Early access is a bank policy, not a Nacha requirement, so it can change without notice.
Same Day ACH
Same Day ACH lets originators push funds through the network on the same business day. The Federal Reserve operates three processing windows:6Federal Reserve Financial Services. FedACH Processing Schedule
- First window: files submitted by 10:30 a.m. ET, settlement at 1:00 p.m. ET
- Second window: files submitted by 2:45 p.m. ET, settlement at 5:00 p.m. ET
- Third window: files submitted by 4:45 p.m. ET, settlement at 6:00 p.m. ET
Each same-day payment is currently capped at $1 million per transaction, a limit scheduled to rise to $10 million on September 17, 2027.7Nacha. Same Day ACH Per Payment Limit to Increase to $10 Million Most regular payroll still runs on standard overnight settlement; Same Day ACH shows up more often for off-cycle payments, final paychecks, and bonus runs.
Weekends and Federal Holidays
ACH payments settle only when the Federal Reserve’s National Settlement Service is open, which rules out weekends and federal holidays.8Nacha. ACH Payments Fact Sheet If your regular payday falls on a Friday, your employer typically submits the file so funds hit by 9:00 a.m. that Friday. When payday lands on a Monday holiday, many employers settle on the preceding Friday, though the rules do not require it. Check with payroll if a holiday sits on your usual pay date.
When an Employer Can Pull a Deposit Back
When an originator sends a deposit by mistake, the rules give them a narrow window to fix it. The originator has five banking days after the settlement date to transmit a reversing entry.9Nacha. ACH Network Rules – Reversals and Enforcement Reversals are only allowed for specific reasons: a duplicate payment, a wrong dollar amount, a deposit sent to the wrong person, or a payment processed on the wrong date. An originator cannot reverse a deposit because they changed their mind or because of a business dispute.
The originator must notify you about the reversal no later than the settlement date of the reversing entry. The reversing entry itself must include the word “REVERSAL” in the description field, and the entry class code, company identification, and amount must match the original so your bank can identify it.9Nacha. ACH Network Rules – Reversals and Enforcement
If you believe a reversal was improper, your bank can return it using specific return reason codes. For consumer accounts, code R11 (“Entry Not in Accordance with the Terms of Authorization”) applies. For business accounts, code R17 applies. After the five-day window closes, the originator loses the right to reverse unilaterally and would need to work with you directly or pursue other remedies to recover funds.
Your Protections When Something Goes Wrong
The Nacha rules govern the relationship between banks and originators. Your individual consumer protections come primarily from Regulation E, the federal rule implementing the Electronic Fund Transfers Act, which covers ACH transactions and gives you specific rights when a direct deposit or other electronic transfer goes sideways.
Liability for Unauthorized Transfers
If an unauthorized electronic transfer hits your account, how quickly you report it decides how much you could lose:
- Reported within two business days: your maximum liability is $50 or the actual unauthorized amount, whichever is less.
- Reported after two business days but within 60 days of your statement: maximum liability rises to $500.
- Reported after 60 days from your statement: you could be responsible for the full amount of unauthorized transfers that occurred after the 60-day window, with no cap.
These limits assume you had a fair chance to catch the problem on your periodic statement.10eCFR. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers If extenuating circumstances kept you from reviewing statements on time, such as a hospitalization, your bank must extend the reporting deadlines to a reasonable period.
How Error Disputes Work
When you spot a problem, you have up to 60 days after your bank sends the statement containing the error to report it. You can report by phone or in writing, though your bank may ask you to follow up in writing within 10 business days if you called. Your notice should include your name, account number, and a description of what you believe went wrong, with the date and amount if you have them.11Consumer Financial Protection Bureau. Procedures for Resolving Errors – 12 CFR 1005.11
Once the bank receives your report, it has 10 business days to investigate and resolve the issue. It can extend the investigation to 45 days, but only if it provisionally credits your account for the disputed amount (plus any interest) within those initial 10 business days. After the investigation, the bank must tell you the results within three business days, and if it confirms an error, it must correct the account within one business day of that determination.11Consumer Financial Protection Bureau. Procedures for Resolving Errors – 12 CFR 1005.11
Which Bank Is Responsible for What
Every direct deposit involves two financial institutions with distinct roles under the rules.
The Originating Depository Financial Institution (ODFI) is the sending bank. It is responsible for the validity of every entry that enters the network, which means confirming each transaction has proper authorization and accurate data before submitting it.2Nacha. About Us If an employer submits a payroll file with a bad account number or without proper authorization, the ODFI bears the initial liability, which is why originating banks vet their clients closely.
The Receiving Depository Financial Institution (RDFI) accepts incoming entries and posts them to the correct accounts. One detail catches people off guard: the RDFI can rely solely on the account number to post the entry, even if the name on the deposit does not match the name on the account.12Nacha. ACH Operations Bulletin 2-2024 – Voluntary Formatting Standard for Individual Name Field If your employer transposes two digits and the resulting account number belongs to someone else, the money goes there. Double-check the account number on your authorization form.
Both institutions coordinate on returns, disputes, and reversals under standardized timelines. The RDFI must also honor stop payment orders from account holders on incoming ACH entries, provided the order arrives with enough time to act before the entry processes.13Nacha. Minor Rules Topics
Changing or Canceling Your Direct Deposit
You can revoke a direct deposit authorization at any time by notifying the originator. Your authorization form should describe how to do this, including any required timing. Give your employer or benefits provider enough lead time before your next scheduled pay date to process the change, since payroll files are typically submitted days ahead of the actual deposit.
To stop a single incoming entry rather than cancel the whole arrangement, place a stop payment order with your bank. The bank must honor the order if it receives the request with enough time to act before the entry settles.13Nacha. Minor Rules Topics Banks commonly charge between $25 and $35 for processing a stop payment. If you’re switching bank accounts, coordinate with your employer first. Otherwise the deposit can land at a closed account, bounce back as a return, and delay your pay by several days while the entry is re-sent to the new account.