A vendor ACH authorization form is the document a business uses to collect a supplier’s banking details and written permission before sending payments through the Automated Clearing House network. It serves two jobs at once: it tells your accounts payable team exactly where to route money, and it gives you proof that the vendor consented to the transfers if a dispute ever surfaces. Get the fields right, verify the account, store the form safely, and the rest of the payment relationship runs on autopilot.
Information the Form Must Capture
The vendor’s full legal business name has to match what’s on file at their bank. Even a small variation, like an ampersand swapped for the word “and,” can trigger a return or a fraud flag. Collect the vendor’s mailing address and a named contact as well, so you have someone to call when a payment doesn’t go through.
The banking fields are where precision matters most:
- Bank name — the institution holding the receiving account.
- ABA routing number — the nine-digit code that identifies the vendor’s bank in the national payment system.
- Account number — the specific account for deposits. The routing number gets money to the right bank; the account number gets it to the right ledger.
- Account type — checking or savings. Banks process these differently, and the wrong selection causes returns.
The form should also state whether the authorization covers a single payment or an ongoing series of recurring transfers. That one line defines the scope of permission the vendor is granting and protects both sides later.
Signatures and Legal Validity
Nacha, the organization that writes the operating rules for the ACH network, requires every transaction to begin with proper authorization from the receiver. The rules don’t dictate one specific template. They do require that the authorization clearly identify the parties, the account, and whether the payment is one-time or recurring. For consumer accounts the authorization must be signed or “similarly authenticated.” Business-account authorizations have more flexibility, but a written, signed form is still standard practice and gives you the strongest footing in a dispute.
The signature doesn’t have to be on paper. Under the federal E-SIGN Act, an electronic signature carries the same legal weight as a handwritten one, as long as the signer intended to sign and the system preserves a record that can be reproduced later. Typed names in signature fields, digital signatures, and security codes all qualify. Whatever platform you use needs to tie the signature to the specific document.
One boundary worth knowing: Regulation E, the federal rule implementing the Electronic Fund Transfer Act, requires written or similarly authenticated authorization for preauthorized debits from consumer accounts. Payments where your company credits a vendor’s business account fall under Nacha’s rules, not Regulation E. That matters because Regulation E gives consumers specific protections, including the right to stop a preauthorized transfer with three business days’ notice, that don’t automatically extend to business accounts.
Verifying the Account Before the First Payment
Before releasing a real payment, most businesses validate the account using micro-deposits: small test credits of less than $1.00 sent to the vendor’s account. The vendor confirms the exact amounts, which proves they actually control the account. Under Nacha’s micro-entry rules, these verification credits must carry the description “ACCTVERIFY” in the company entry field so the vendor’s bank recognizes them as test transactions rather than real payments.
If you pair those credits with offsetting debits, the debits cannot exceed the total credits, and both have to settle simultaneously. The net effect on the vendor’s account should be zero or a small positive balance. Once the vendor reports the correct amounts back, the account is validated and full-value payments can begin.
Micro-deposits aren’t the only option. Nacha requires originators of WEB debit entries to use a “commercially reasonable” method to confirm an account is legitimate and open before the first transaction. Pre-notification entries (zero-dollar test transactions), third-party account validation services, and API-based verification tools also qualify.
A voided check attached to the form gives you a second layer of verification. The magnetic ink line at the bottom encodes the routing and account numbers, so you can cross-check what the vendor wrote. Not every vendor still has paper checks; a bank verification letter on institutional letterhead or a screenshot from the vendor’s online banking portal showing the account and routing numbers serves the same purpose.
Pairing the Form with a W-9
Onboarding is the natural moment to collect an IRS Form W-9 alongside the ACH authorization. The W-9 captures the vendor’s taxpayer identification number, which you need for year-end information reporting. For tax years beginning after 2025, businesses that pay a vendor $2,000 or more in a calendar year for services must report those payments on Form 1099-NEC. The threshold was previously $600 and will adjust for inflation starting in calendar year 2027.
If a vendor refuses to provide a W-9 or supplies an incorrect taxpayer identification number, you’re required to withhold 24% of every payment and remit it to the IRS as backup withholding. Failing to withhold when required makes your business liable for the uncollected amount. Collecting the W-9 at the same time as the ACH form avoids chasing paperwork months later.
Handling the Form Securely
The form contains enough information to initiate transfers from the vendor’s account, so treat it with the same care you’d give a blank check. Submit and receive completed forms through encrypted email or a secure upload portal rather than standard email. If a physical copy is mailed, send it to a designated billing or accounts payable contact rather than a general mailbox.
Most banks and corporate treasury departments offer pre-formatted ACH authorization templates to their business clients at no cost. Free templates are also available through accounting software platforms and business document libraries. The layout is less important than the substance: every field listed above, plus a signature line and date.
Fraud Controls, Especially on Change Requests
Initial setup carries some risk, but the real danger point is when an existing vendor asks to change banking details. Business email compromise schemes routinely target accounts payable with spoofed emails requesting new routing and account numbers. Process the change without verification, and the next payment goes to the fraudster.
Build these controls into the process:
- Callback verification. When a vendor requests a change, call them at a phone number already on file, not a number provided in the request. Confirm the new details on that call.
- Dual authorization. Require two people to approve any change to vendor banking information. One receives the request; a different person verifies and processes it.
- ACH debit blocks and filters. Work with your bank to flag unexpected ACH activity on your accounts so unauthorized debits can be caught before they settle.
- Access limits. Restrict who can modify vendor master files in your accounting system. Fewer editors means a smaller attack surface.
These controls cost nothing and prevent the kind of six-figure loss that happens when one employee processes a fraudulent banking change from an email alone.
Fixing Payment Errors
If a payment goes out to the wrong vendor, for the wrong amount, or as a duplicate, Nacha’s rules allow a reversing entry transmitted within five banking days after the settlement date of the original transaction. Reversals are only permitted for specific errors: duplicate payment, wrong recipient, wrong dollar amount, or settlement on the wrong date. You cannot reverse a payment because the vendor failed to deliver or because your company is short on cash.
Transmitting an improper reversal, or one filed outside the five-day window, violates Nacha rules and can result in fines. Miss the window and your recourse is to work directly with the vendor or their bank to recover the funds.
Keeping and Revoking Authorizations
Nacha’s rules require that you keep the original authorization, or an accurate reproduction, for at least two years after the authorization is revoked or the business relationship ends. If a vendor later disputes a payment and claims they never authorized it, the form is your proof. Without it, you absorb the loss.
Store authorizations in a format that can be reproduced accurately: a scanned PDF, an electronic record from your e-signature platform, or a secured physical file. If the authorization was collected electronically, the E-SIGN Act requires the record to remain accessible and reproducible for the full retention period. Many businesses keep these records well beyond two years because vendor relationships, audits, and tax disputes can surface long after the minimum period expires.
Either side can end an authorization. The vendor typically submits a written revocation notice to the paying company, which then stops initiating transfers. Because business accounts don’t carry Regulation E’s statutory right to stop a preauthorized transfer, the revocation process for vendor payments depends on whatever terms the original form spells out. Include a revocation section in the form: who to notify, how much advance notice is required, and whether notice must be in writing. Once an authorization is revoked, mark it clearly in your records and keep it for the required two years.