What Is an ACH File? Layout, Codes, and Settlement

An ACH file is a fixed-width ASCII text document that carries batched payment instructions between US banks, with every line exactly 94 characters long.¹ It’s the format that moves payroll direct deposits, utility debits, tax refunds, and vendor payments across the Automated Clearing House network governed by NACHA. The rigid 94-character line width is what lets completely different banking systems read the same file without compatibility errors, because every character position has a predefined meaning.

What’s Inside the File

An ACH file is plain text. Open one in a text editor and you’ll see rows of digits, names, and padded spaces, each row (called a “record”) identified by the number in its first position. Unused fields are filled with blank spaces so the line stays exactly 94 characters wide.¹

The records follow a strict hierarchy:

File Header (Type 1) is always the first line. It identifies the originating bank by routing number, carries a date-time stamp, and names both the originating bank and the company sending the file.
Batch Header (Type 5) opens a group of related transactions and describes the type of entries in the batch and their purpose.
Entry Detail (Type 6) is one line per payment, carrying the receiver’s name, account number, dollar amount, and whether the entry is a debit or credit.
Addenda (Type 7) are optional lines attached to an Entry Detail record for remittance information or additional context. Some transaction types require them.
Batch Control (Type 8) closes a batch by summing the count and dollar totals of all entries inside it.
File Control (Type 9) is always the last line. It totals the batches and entries across the file, sums all debits and credits, and includes a hash total calculated from the receiving banks’ routing numbers so the receiving system can confirm nothing was altered or lost in transmission.¹

One file can hold many batches, and each batch can hold hundreds of entries. A payroll processor running checks for ten employers would create a single file with ten batches inside it.

What Data Each Payment Carries

Building an ACH file means populating those 94-character lines with the right data in the right positions. For each payment entry, you need:

Originator identification, usually a tax ID (EIN or SSN), placed in the Company Identification field of the Batch Header.
The 9-digit ABA routing transit number of the receiver’s bank.
The receiver’s account number, which fits a field up to 17 characters long for standard domestic entries.²
A two-digit transaction code indicating debit or credit and checking or savings.
The dollar amount for the entry.
The receiver’s legal name.
The effective entry date on which the originator wants the transaction to settle.
A three-character Standard Entry Class (SEC) code in the Batch Header that tells the network what kind of transaction this is and what authorization rules apply.

Originators typically pull routing and account numbers from a voided check or the receiver’s online banking portal. A single wrong digit will cause the payment to fail and come back as a return.

Standard Entry Class Codes

The SEC code governs the entire batch and dictates what authorization the originator must hold on file. The common codes include:

PPD (Prearranged Payment and Deposit) for payments to or from consumer accounts, such as payroll direct deposit or recurring bills. Requires written authorization from the consumer.³
CCD (Corporate Credit or Debit) for business-to-business transactions like vendor payments or cash concentration.³
WEB (Internet-Initiated Entry) for debits authorized through a website or mobile device. The authorization must be “similarly authenticated,” meaning the consumer sees a clear on-screen authorization and confirms it electronically.³
TEL (Telephone-Initiated Entry) for debits authorized orally. Single entries require either a recorded oral authorization or written confirmation sent to the consumer afterward.³
ARC (Accounts Receivable Entry) lets a business convert a paper check received by mail, at a lockbox, or in person into an electronic debit. The consumer must be notified before the check is accepted.³
IAT (International ACH Transaction) is required whenever the payment involves a financial agency outside the United States. The IAT format differs significantly and requires additional addenda for sanctions screening.⁴

Using the wrong SEC code is one of the fastest ways to trigger a return or a NACHA rules violation. A debit authorized over the phone but submitted as PPD, for example, wouldn’t have the right form of authorization behind it.

How the File Moves Through the Network

Once assembled, the file follows a defined path. The originator sends it to their bank, called the Originating Depository Financial Institution (ODFI). The ODFI reviews the file for NACHA compliance and forwards it to an ACH Operator for sorting and distribution.⁵

The two operators in the United States are the Federal Reserve (FedACH) and The Clearing House (EPN). The operator sorts the individual entries by destination and routes them to each Receiving Depository Financial Institution (RDFI), which posts the funds to the receiver’s account or sends the entry back as a return.

Standard and Same-Day Settlement

Most ACH payments settle on the next business day.⁶ Files submitted before the daily cutoff are processed overnight and settled the following morning. Same-day ACH compresses that timeline into three processing windows each business day:

First window: ODFI deadline 10:30 AM ET, settlement the same day.
Second window: ODFI deadline 1:00 PM ET, settlement the same day.
Third window: ODFI deadline 4:45 PM ET, settlement the same day.⁷

Same-day ACH carries a per-transaction limit of $1 million.⁸ Entries above that amount flow through standard next-day processing.

Credits, Debits, and Prenotes

Every entry is either a credit or a debit, described from the originator’s perspective. An ACH credit is a “push”: the originator sends money out to the receiver, as with a payroll direct deposit or a tax refund. An ACH debit is a “pull”: the originator withdraws money from the receiver’s account with prior authorization, as with a utility or mortgage payment. For debits, the originator must retain the receiver’s authorization for two years after it’s terminated or revoked.

Before sending a live payment, an originator can submit a pre-notification entry (prenote) to verify that the receiving account exists and accepts the right type of transaction. A prenote is a zero-dollar entry in the normal format. If the account number or routing number is wrong, the receiving bank sends back a return or a Notification of Change within about three business days. It’s a common step when setting up new payroll recipients or vendor accounts.

When Entries Come Back: Returns and Reversals

When the RDFI can’t process an entry, it sends it back as a return with a standardized reason code. The most common include:

R01 (Insufficient Funds): the account doesn’t have enough money to cover the debit.
R02 (Account Closed): the account has been closed.
R03 (No Account/Unable to Locate Account): the account number doesn’t match any account at the receiving bank.
R04 (Invalid Account Number): the account number structure is wrong.

For most return codes the RDFI has two banking days from settlement to send the entry back. Same-day entries follow the same framework, but because settlement happens a day sooner, the return deadline shifts forward with it.⁶

A reversal is different. It’s initiated by the originator after discovering a payment was sent in error, such as a duplicate, a wrong amount, or a wrong account. The reversal must reach the RDFI within five banking days after the settlement date of the original entry. The word “REVERSAL” must appear in all caps in the Company Entry Description field, and the SEC code, company identification, and amount must match the original entry exactly.⁹

Improper reversals are an enforcement trigger. Egregious violations involving willful or reckless conduct with at least 500 entries, or entries totaling at least $500,000, can draw fines up to $500,000 per occurrence.⁹

Security Rules for Anyone Holding the File

Because the file carries bank account numbers in plain text, NACHA requires account numbers to be rendered unreadable when stored electronically. The rule applies to non-bank originators, third-party service providers, and third-party senders whose annual ACH volume exceeds 2 million entries. Acceptable methods include encryption, tokenization, truncation, or destruction after processing. Password-protected access alone doesn’t satisfy the requirement; the stored data itself must be unreadable.¹⁰

NACHA doesn’t mandate a specific technology. Full compliance with PCI DSS data-at-rest requirements is considered commercially reasonable, but PCI DSS certification itself is not required.¹⁰ Originators below the 2-million threshold aren’t bound by this specific rule, though the general obligation to protect sensitive information still applies.

When the File Crosses a Border

Standard ACH formatting assumes every bank in the chain is in the United States. The moment a payment touches a financial institution outside the US, the SEC code switches to IAT and the file structure changes. Each IAT entry requires a minimum of seven mandatory addenda records carrying the information needed for sanctions screening under the Bank Secrecy Act and OFAC compliance.²

Those seven addenda identify the originator’s full name and address, the receiver’s full name and address, and the names, identification, and country codes of both the originating and receiving banks. Up to five additional addenda can be required if a foreign correspondent bank is involved. The Batch Header picks up fields not found in domestic entries, including foreign exchange indicators, ISO currency codes, and a reason-for-payment code. The receiver’s account number field also expands from 17 characters to 35 characters to accommodate international numbering formats like IBAN.² Every party in the chain shares the screening obligation: the originator screens before sending, the ODFI screens before forwarding, and the ACH operator screens during processing.¹¹

1
Nacha. ACH File Overview
2
Nacha. IAT Specific Data Elements
3
Nacha. ACH File Details
4
Fiscal.Treasury.gov. Standard Entry Class Code (SEC)
5
Fiscal.Treasury.gov. Automated Clearing House (ACH)
6
Nacha. Same Day ACH Moving Payments Faster (Phase 1)
7
Nacha. SDA Schedules and Funds Availability
8
Federal Reserve Financial Services. Same Day ACH Resource Center
9
Nacha. ACH Network Rules Reversals and Enforcement
10
Nacha. Supplementing Data Security Requirements
11
Nacha. International ACH Transactions (IAT) Frequently Asked Questions – Corporate Customers