ACH Authorization Requirements: A Merchant Guide

ACH authorization requirements are the rules that say how you must get, store, and honor a customer’s permission before you pull money from their bank account. For consumer debits, the permission must be clear, readily identifiable as an authorization, and include a way to revoke it, and the customer gets a copy. This guide breaks down what Nacha and federal law require by payment type, what your authorization form should include, and how to keep records that hold up if a payment is ever disputed.

What is an ACH authorization?

An ACH authorization is the customer’s permission for your business (the “Originator”) to debit or credit their bank account through the ACH Network. It is the legal foundation for every bank-to-bank payment you collect, whether it is a one-time invoice payment or a monthly membership fee.

The authorization can be written, electronic, or oral, depending on how the payment is set up. What matters is that you can prove the customer agreed to the specific terms. If you are still deciding between payment types, our guide to e-check vs ACH payments explains how the two relate, since an e-check is simply an ACH debit started from check details.

Who sets ACH authorization requirements?

ACH authorization requirements come from three layers of rules for most U.S. merchants. Knowing which layer a rule comes from helps you understand why your processor asks for certain records.

• Nacha Operating Rules. Nacha governs the ACH Network. Its rules require debit authorizations to be readily identifiable, have clear and understandable terms, and explain how to revoke, as Nacha outlines in its article on the importance of compliant ACH authorizations.
• Federal law (Regulation E). For recurring debits from consumer accounts, the CFPB’s Regulation E, section 1005.10 requires a writing “signed or similarly authenticated by the consumer,” and the person who obtains it must give the consumer a copy.
• Your bank and processor agreement. Your Originating Depository Financial Institution (ODFI) and payment processor can add stricter terms, such as specific disclosure language or shorter record-request deadlines.

ACH authorization requirements by entry type

Each ACH debit carries a Standard Entry Class (SEC) code that tells the network how the payment was authorized. The code you use decides which authorization rules apply. The table below summarizes the four codes online and service businesses use most.

Consumer accounts get the most protection, so WEB, TEL, and PPD rules are stricter than CCD rules. If you sell to both consumers and companies, set up separate authorization flows for each.

What an ACH authorization form must include

Nacha does not prescribe a fixed format, so you can use a web form, a PDF, or a script. What it does require is that the authorization is easy to recognize as an authorization and its terms are clear. Use this checklist when you build or review your form.

• ☐ Clear authorization statement, labeled as an ACH or bank debit authorization (not buried in general terms of service).
• ☐ Customer name and, for business accounts, the company name.
• ☐ Bank routing number and account number, plus account type (checking or savings).
• ☐ Amount of the debit, or how the amount is calculated if it varies.
• ☐ Date or frequency of debits (one time, monthly on the 1st, and so on).
• ☐ Your business name as it will appear on the customer’s bank statement.
• ☐ How and when to revoke, including contact details and how much notice you need.
• ☐ Signature or similar authentication, such as an e-signature, checkbox plus click, or security code.
• ☐ Date of authorization and, for online forms, the timestamp and IP address.
• ☐ Customer service phone number for billing questions.

Example authorization language

Here is a plain-English example for a monthly WEB debit. Have your attorney or processor review final wording before you use it.

“I authorize [Business Name] to electronically debit my [checking/savings] account listed above for $49.00 on or about the 1st of each month, starting [date], for my [plan name] membership. This authorization stays in effect until I cancel it. I can cancel by calling [phone] or emailing [email] at least 3 business days before the next scheduled payment. I will receive a copy of this authorization by email.”

One-time, recurring, and standing authorizations

How often you plan to debit the account changes what your authorization must cover. Mixing these up is a common reason customers dispute charges.

Single-entry authorizations

A single-entry authorization covers one payment, such as paying an invoice online. It should name the exact amount and date. Once that debit settles, the authorization is used up, and you need new permission for any later charge.

Recurring authorizations

Recurring entries run automatically on a schedule with no further action from the customer. For consumer accounts, Regulation E requires the authorization in writing, signed or similarly authenticated, and the customer must get a copy. E-signatures that meet the federal E-Sign Act qualify. If the amount varies, Regulation E requires you to send written notice of the amount and date at least 10 days before the transfer, unless the customer has chosen to be notified only when the amount falls outside an agreed range.

This is especially important for subscription businesses and SaaS companies that bill usage-based or tiered amounts. For the wider billing setup, see our guide on how to accept recurring payments.

Standing authorizations

A standing authorization lets the customer pre-approve future debits that they trigger with some further action, like tapping “Pay now” in your app. Nacha added this option in its Meaningful Modernization rules, effective September 17, 2021. It sits between one-time and recurring payments and works well for wallets, top-ups, and pay-as-you-go services.

Extra requirements for online (WEB) ACH debits

WEB entries add ACH authorization requirements beyond the basics. Online debits carry higher fraud risk because you never see a signature or a check. Nacha addresses that with two added layers.

Account validation before first use

Under Nacha’s WEB debit account validation rule, effective March 19, 2021, your fraud detection system must, at minimum, validate the account before its first use and whenever the account number changes. Validation confirms the account is open and can accept ACH entries. It does not require proving the customer owns the account.

Nacha is method-neutral. Common options include a prenotification entry, micro-deposits, a third-party validation service, or an API check built into your payment gateway.

Fraud monitoring for businesses that originate ACH

Nacha’s newer fraud monitoring rules require non-consumer Originators to have risk-based processes meant to catch entries that are unauthorized or authorized under “False Pretenses,” and to review them at least once a year. Phase 1 took effect March 20, 2026 for the largest originators. Phase 2, covering all remaining non-consumer originators regardless of volume, took effect in June 2026.

The rules do not require you to screen every entry before sending it. In practice, monitoring often means watching for sudden spikes, many accounts tied to one customer, and repeated failed validations.

ACH authorization requirements for phone payments (TEL)

Phone payments are common for professional and high-ticket service businesses that close deals by call. TEL entries can only be used when you have an existing relationship with the customer or the customer called you. Cold-call debits are not allowed under the TEL code.

For a TEL debit, you must either record the customer’s oral authorization or send them written confirmation of it before the debit settles. The authorization should state the amount, date, your business name, a phone number for questions, and how to revoke. Nacha’s Meaningful Modernization rules also allow oral authorizations through other voice channels, such as video calls, and require you to keep the recording or written copy for two years.

Teams that key in phone payments usually do it through a virtual terminal. Make sure your script and recording process match your entry type before you go live.

Record-keeping, proof, and revocation

Meeting ACH authorization requirements at signup is only half the job. You also need to prove it later and stop debiting when a customer cancels.

• Retain records. Keep the authorization (or recording) for two years after it is terminated or revoked, and store it so you can find it fast.
• Produce proof on request. Nacha requires Originators to provide proof of authorization to their ODFI when asked. Store the form, timestamp, IP address, and any confirmation email together.
• Honor revocations promptly. Once a customer revokes, stop future debits. Consumers can also ask their bank to stop a preauthorized transfer by giving notice at least three business days before the scheduled date under Regulation E.
• Watch your returns. Debits without valid authorization come back as unauthorized returns. Our guide to ACH return codes explains what codes like R10 mean and how to respond.

How to set up compliant ACH authorizations: step by step

Use these eight steps to turn ACH authorization requirements into a repeatable process your team can follow.

1. Map your payment flows. List every way customers pay you (website, app, phone, signed forms, B2B invoices) and assign the right SEC code to each.
2. Write authorization language for each flow. Use the checklist above. Keep it short, specific, and separate from your general terms.
3. Capture authentication. Use an e-signature, an unchecked consent box plus a submit click, or a recorded call. Log the date, time, and IP address.
4. Validate accounts. Add account validation for first-time WEB debits and any time a customer changes bank details.
5. Send the customer a copy. Email or mail a copy of the authorization right after it is captured.
6. Set up notices for variable amounts. If recurring amounts change, schedule written notice at least 10 days before each debit.
7. Build a revocation process. Train staff, publish a cancellation method, and make sure cancellations stop the next scheduled debit.
8. Store and review. Keep records for at least two years after termination and review your fraud monitoring at least once a year.

Common ACH authorization mistakes to avoid

Most problems with ACH authorization requirements come from small gaps in process, not bad intent. Watch for these.

• Hiding the authorization in terms of service. Customers must be able to tell they are approving bank debits.
• Reusing a one-time authorization for later charges. A new charge needs new permission unless the original covered recurring or standing debits.
• Changing amounts without notice. Price increases on recurring consumer debits need advance written notice.
• Using a statement descriptor customers don’t recognize. Unfamiliar names lead straight to “I didn’t authorize this” returns.
• Not saving the evidence. A checkbox with no timestamp, IP, or copy sent is hard to defend.
• Using the wrong SEC code. Coding a phone payment as WEB, or a consumer payment as CCD, puts you outside the rules for that entry.

Clean authorization practices also help when you apply for processing. Underwriters look at how you collect and document payments, so it is worth reviewing our merchant account approval checklist before you submit an application.

Related guides and next steps

• Want to add bank payments to your checkout? See how ACH payment processing works with Payment Circle.
• Accepting checks online or by phone? Learn about e-check processing for online and service businesses.
• Comparing ACH with cards? Read ACH vs credit card processing to weigh cost, speed, and dispute risk.
• Selling courses or coaching? Explore payment processing for online education.
• Curious about cost? Review our interchange-plus pricing tiers.

Frequently asked questions

Is an ACH authorization form legally required?

You need a valid authorization for every ACH debit, but it does not have to be a paper form. Nacha accepts written, electronic, and oral authorizations as long as they meet the rules for the entry type. For recurring consumer debits, Regulation E requires a writing signed or similarly authenticated, which can be electronic.

How long do I need to keep ACH authorizations?

Keep each authorization for two years after it is terminated or revoked. That includes recordings of oral authorizations and written confirmations. Your bank or processor may ask you to produce it during that time.

Does a checkbox count as an ACH authorization?

It can, if the checkbox sits next to clear authorization language, the customer actively checks it, and you capture the date, time, and IP address. Regulation E’s official interpretation says the “similarly authenticated” standard is met by complying with the E-Sign Act. A pre-checked box or language hidden in general terms is much weaker evidence.

Can a customer cancel an ACH authorization?

Yes. Your authorization must tell customers how to revoke it with you. Consumers can also tell their bank to stop a preauthorized debit at least three business days before the scheduled date. Stop all future debits once you receive a valid revocation.

What is the difference between WEB and PPD authorizations?

WEB entries are authorized online or through a mobile device, and they require account validation before first use. PPD entries are authorized with a signed or similarly authenticated form, often for recurring billing. Use the code that matches how the customer actually gave permission.

Sources and further reading

• Nacha: The Importance of Compliant ACH Authorizations
• Nacha: Supplementing Fraud Detection Standards for WEB Debits
• Nacha: Meaningful Modernization
• Nacha: Risk Management Topics: Fraud Monitoring Phase 2
• Consumer Financial Protection Bureau: Regulation E, 1005.10 Preauthorized Transfers

This article is general information, not legal advice. Confirm your specific obligations with your bank, processor, or attorney.

Set up ACH payments the right way

Payment Circle helps new U.S. online businesses, software companies, and agencies add ACH and e-check processing with clear contract terms and interchange-plus pricing. Ready to get started? Apply for a merchant account, or call us at (571) 274-7950, 9:00 AM to 6:00 PM Eastern. You can also contact our team with questions.