Standard Entry Class (SEC) Codes: PPD, WEB, ARC, and CCD

ACH Standard Entry Class codes are the three-letter tags that every ACH payment carries to identify how the consumer or business authorized it and what kind of accounts sit on each end of the transaction. The code you choose dictates the authorization you need to collect, the security controls you have to run, and whether the receiver gets the full set of consumer protections under Regulation E. Picking the wrong one is not a cosmetic error; it changes your legal obligations and can draw enforcement attention from Nacha, the organization that writes and enforces the ACH Operating Rules.

The quickest way to find your code is to ask two questions: who authorized the payment and how, and whose account is being debited or credited. A consumer typing bank details into a website is a WEB debit. The same consumer mailing a check to a lockbox is an ARC. A business paying another business is CCD or CTX. A payment touching a foreign bank is IAT. The rest of this guide walks through each code with the rules that actually matter when you originate one.

Consumer Codes: PPD, WEB, and TEL

PPD: Prearranged Payment and Deposit

PPD is the workhorse of consumer ACH. It covers both credits and debits authorized in writing: direct deposit of wages on the credit side, and recurring bill payments like mortgage, utility, or insurance premiums on the debit side. PPD entries can be one-time or recurring, but the consumer must provide a signed or electronically authenticated authorization before the first debit. Electronic signatures are valid under the Nacha Operating Rules as long as they conform to the E-Sign Act.¹

Because PPD entries hit consumer accounts, they carry the full weight of Regulation E protections, including the provisional-credit mechanism described later in this article.

WEB: Internet-Initiated Entries

The WEB code applies when a consumer authorizes a debit through an online portal or wireless network. Any time someone enters bank account information on a website to pay a bill, set up a subscription, or fund an account, the resulting ACH debit should carry the WEB designation.²

WEB entries face stricter security requirements than most other SEC codes. Originators must use a commercially reasonable fraudulent transaction detection system to screen every entry, and since March 2021 that system must include account validation on the first use of any account number. Acceptable validation methods include prenotification entries, micro-deposit verification, third-party validation services, or API-based account checks.³ A fraud detection system that lacks account validation does not satisfy the rule, even if it catches fraud through other means.

All WEB transactions that travel over an unsecured electronic network also require encryption using commercially reasonable technology. Nacha defines “unsecured electronic network” broadly enough to include the internet itself.⁴ If consumer banking data touches the internet at any point in the transmission chain, it must be encrypted.

TEL: Telephone-Initiated Entries

TEL covers single ACH debits authorized verbally over the phone. It is not a catch-all for any phone-based payment. TEL can only be used when there is an existing relationship between the business and the consumer, or when the consumer initiates the call. An existing relationship means a written agreement is already in place or the consumer purchased something from the business within the previous two years.⁵

With no written signature, the authorization has to be captured carefully. The originator must either tape-record the oral authorization or have previously provided a written notice that the consumer then confirms verbally. The recording or documentation must include the debit date, the amount, the consumer’s name, a daytime phone number, and a statement that the authorization will be used to create an ACH debit. TEL is not appropriate for recurring payments; if a consumer authorizes ongoing debits during a phone call, the proper code is typically PPD with a written or electronically signed authorization.

Check Conversion Codes: ARC, BOC, and POP

Paper checks still circulate, and the ACH system provides three paths to convert them into electronic entries. Each code corresponds to a different scenario for where and how the check is received.

ARC: Accounts Receivable Conversion

ARC applies when a consumer mails a paper check to pay a bill, or when a check arrives at a lockbox or manned payment location. The biller captures the routing and account numbers from the check and originates a one-time ACH debit instead of depositing the paper.² The key compliance requirement is advance notice: the consumer must receive a clear and conspicuous disclosure, typically printed on the bill itself, stating that their check may be converted to an electronic fund transfer. The notice must also give the consumer a way to opt out. After the entry clears, the original paper check must be destroyed.

BOC: Back Office Conversion

BOC handles a different scenario: a consumer hands a check to a cashier at a retail location or manned bill-payment counter, and the business converts it to an ACH entry later in a back-office setting rather than at the register. The store must post a notice at the point of sale informing customers that checks may be converted electronically and will not be returned. After the check data is captured and the ACH entry is originated, the physical check must be securely destroyed.

POP: Point of Purchase

POP is the real-time version of check conversion. The consumer presents a check at a register, the cashier scans the MICR line with a check reader and keys in the amount, and the voided check is handed back immediately. The consumer walks away with their check as a receipt while the merchant processes the payment as an ACH debit. POP entries are limited to checks drawn on consumer accounts and exclude corporate checks, third-party checks, credit card convenience checks, money orders, and traveler’s checks.²

RCK: Re-Presented Check Entries

When a paper check bounces for insufficient or uncollected funds, the RCK code lets the merchant convert that returned check into an electronic ACH debit for another collection attempt. This is often faster and cheaper than routing the physical paper back through check clearing a second time.²

RCK has hard limits. The electronic re-presentment can only be used twice, meaning the check gets a maximum of three total attempts (the original paper presentment plus two RCK entries). The original check amount must also be $2,500 or less. The RCK entry is limited to the face value of the check only; any returned-check fees or NSF penalties the business wants to collect must go through a separate transaction. Consumers keep their Regulation E dispute rights for RCK entries.

Corporate Codes: CCD and CTX

Business-to-business ACH payments use different codes with different rules, reflecting the assumption that companies have more sophisticated controls than individual consumers.

CCD: Corporate Credit or Debit

CCD handles single or recurring credits and debits between corporate accounts. Common uses include paying vendors, concentrating funds from satellite accounts into a central treasury account, and funding payroll or petty-cash accounts.² CCD entries can carry one addenda record with a short message or invoice reference. The authorization requirements are less prescriptive than consumer codes; businesses negotiate the terms in their trading-partner agreements rather than following a mandated authorization format.

CTX: Corporate Trade Exchange

CTX is the data-heavy sibling of CCD. A single CTX entry can carry up to 9,999 addenda records, making it the right choice when a payment needs to include full remittance detail like invoice numbers, line-item descriptions, or adjustment codes.² Companies in established trading-partner relationships use CTX to send complete ANSI ASC X12 or UN/EDIFACT payment messages alongside the funds, which allows the receiver’s accounts-payable system to auto-match payments to open invoices.

The most practical distinction for both corporate codes: CCD and CTX entries do not fall under Regulation E. That regulation defines a protected account as one established primarily for personal, family, or household purposes and limits its protections to natural persons.⁶ Businesses disputing a CCD or CTX entry cannot rely on the 60-day error-reporting window or the provisional-credit requirement that consumers enjoy. Disputes between businesses are governed by the Nacha Operating Rules and whatever contract exists between the parties.

IAT: International ACH Transactions

Any ACH entry where either the originator or the receiver is located outside the United States, or where funds pass through a non-U.S. financial institution, must be coded as an IAT. This code exists primarily to facilitate compliance screening, particularly by the Office of Foreign Assets Control. Every party in the chain must screen IAT entries against OFAC sanctions lists before allowing them to proceed.⁷

IAT entries carry significantly more data than domestic codes. Each entry requires a minimum of seven mandatory addenda records containing the originator’s full name and street address, the receiver’s name and address, and identifying information for both the originating and receiving banks, including country codes.⁸ The batch header must also include ISO currency codes for both the originating and destination currencies, plus a foreign exchange indicator showing whether the conversion rate is fixed or variable.

OFAC penalties for processing prohibited transactions are severe: fines can reach $10 million per count for the company and $10,000 per count for individuals, with potential imprisonment of 10 to 30 years depending on the sanctions program involved.⁷ Companies that process payments offshore but fund them from U.S. bank accounts are still subject to OFAC requirements, even if those payments are not formatted as IAT entries.

MTE and SHR: ATM and Debit Card Codes

Two specialized SEC codes handle transactions initiated through hardware. MTE identifies transactions performed at automated teller machines, such as cash withdrawals or deposits. SHR covers point-of-sale debit card transactions where a consumer uses a plastic access card at a merchant terminal connected to a shared network.⁵ Both carry Regulation E consumer protections since they involve individual consumer accounts.

Micro-Entries and Same Day ACH

Two concepts often confused for SEC codes are not codes at all; they are processing choices layered on top of whichever code you select.

Micro-entries are the small test deposits businesses use to verify a consumer’s bank account before originating recurring debits. A credit micro-entry must be less than $1.00, and any offsetting debits to reclaim those test deposits cannot exceed the total credits, so the net effect on the consumer’s account can never be a debit. The originator uses whichever SEC code matches the authorization method, such as WEB for an internet-authorized verification. However, the Company Entry Description field must read “ACCTVERIFY” so that the consumer and their bank can distinguish the test deposit from a real payment. Real payment entries cannot be sent to the account until verification is complete, and payment entries cannot be batched together with the micro-entries themselves.⁹

Same Day ACH is a settlement option, not a code. Standard ACH entries settle on the next business day, but Same Day ACH allows credits and debits to clear within the same calendar day, up to a per-transaction limit of $1 million set in March 2022.¹⁰ The originator still uses the appropriate SEC code for the transaction type. The faster settlement window means less time to catch errors or fraud before money moves, which makes accurate code selection and strong authorization practices more important, not less.

What Happens If You Pick the Wrong Code or Your Returns Climb

Nacha monitors three return-rate metrics that apply to any entity originating ACH debits. Exceeding these thresholds does not automatically result in a fine, but it does trigger a review process that can escalate.

Unauthorized return rate: 0.5%, calculated using return reason codes R05, R07, R10, R29, and R51, measured over the preceding 60 days or two calendar months.¹¹
Administrative return rate: 3.0%, covering returns for account-data errors like closed accounts or invalid account numbers (return codes R02, R03, and R04).¹²
Overall return rate: 15.0%, covering all debit returns for any reason (excluding RCK entries).¹²

Breaching the administrative or overall thresholds triggers a preliminary inquiry where Nacha and an industry review panel examine the originator’s ACH activity. The inquiry might end with no action, or it might lead to a directive requiring the originating bank to reduce the originator’s return rate. Fines only enter the picture at the conclusion of a formal enforcement proceeding.¹² The 0.5% unauthorized rate is the one that most frequently trips up subscription-based businesses and payment processors, because even a small number of “I didn’t authorize this” returns can push a high-volume originator over the line, and that is exactly where mismatched SEC codes and weak authorization practices surface.

Consumer Dispute Rights by Code

Regulation E, codified at 12 CFR Part 1005, applies to accounts held by natural persons for personal, family, or household purposes.⁶ In SEC code terms, PPD, WEB, TEL, ARC, BOC, POP, RCK, MTE, and SHR entries to consumer accounts are all covered. CCD and CTX entries to corporate accounts are not.

The core protection is a 60-day window to report errors. A consumer who spots an unauthorized debit or an incorrect amount on a bank statement has 60 days from the date the statement was sent to notify their bank. The bank then has 10 business days to investigate and resolve the claim. If it needs more time, it can extend the investigation to 45 days, but only if it provisionally credits the consumer’s account within those first 10 business days.¹³ That provisional-credit mechanism is the reason consumers have more leverage in ACH disputes than businesses do. Missing the 60-day window can significantly reduce or eliminate the bank’s obligation to investigate, so reviewing statements promptly is one of the simplest ways to protect yourself.

1
Nacha. Meaningful Modernization
2
Nacha. ACH Guide for Developers – ACH File Details
3
Nacha. Supplementing Fraud Detection Standards for WEB Debits
4
Nacha. Understanding the Value of Encryption in the ACH Network
5
National Credit Union Administration. Examiner’s Guide – ACH Applications Codes and Uses
6
eCFR. 12 CFR 1005.2
7
Nacha. IAT FAQs for Corporate Practitioners
8
Nacha. IAT Specific Data Elements
9
Nacha. Micro-Entries
10
Federal Reserve Financial Services. Same Day ACH Resource Center
11
Nacha. How to Calculate Unauthorized Return Rate
12
Nacha. ACH Network Risk and Enforcement Topics
13
eCFR. 12 CFR 1005.11 – Procedures for Resolving Errors