ACH Authorization

An ACH authorization is the agreement by which an account holder, called the receiver, allows a company or person, called the originator, to send entries to their bank account through the Automated Clearing House (ACH) network in the United States. It is most important for debits, such as a utility pulling a monthly bill or a lender collecting loan repayments, but it is also needed for credits such as payroll direct deposits.

The requirement comes from the Nacha Operating Rules, which govern the ACH network, and for consumer accounts also from federal law, namely the Electronic Fund Transfer Act and Regulation E. The authorization plays a role similar to a direct debit mandate in Europe or the UK: it is the evidence that the payment was permitted, and the absence of a valid authorization is the basis for many returns.

Under the Nacha Rules, an originator must obtain authorization from the receiver before initiating an entry, and the originating depository financial institution (ODFI) warrants to the rest of the network that each entry it sends is authorized. For debits to consumer accounts, the rules require an authorization that is in writing and signed or similarly authenticated, readily identifiable as an authorization, and clear about its terms. Regulation E sets a parallel rule for preauthorized electronic fund transfers from a consumer's account and requires that the consumer receive a copy. Electronic signatures are acceptable where they meet the federal E-SIGN Act.

For business accounts, the rules are lighter. Corporate entries rely on an agreement between originator and receiver, often a trading partner agreement, which sets out how entries will be sent and authorized.

A valid consumer debit authorization normally includes:

• The amount or how it is calculated. A fixed sum, a variable bill amount or a stated range.
• The timing. A single date or the frequency of recurring debits.
• The account. The receiver's bank routing number and account number, and whether it is a checking or savings account.
• Identification. The originator's name and the receiver's name.
• Revocation terms. How the receiver can cancel the authorization and how much notice is needed.

The form of capture depends on the Standard Entry Class code. Internet-initiated debits (WEB) are authorized online, telephone-initiated debits (TEL) require either a recorded oral authorization or written notice to the consumer, and debits converted from paper checks rely on notices given at the point of purchase or in the bill. Originators must retain authorizations, generally for two years after the authorization ends, and provide a copy to the RDFI on request.

A consumer may revoke an authorization by telling the originator. Separately, the consumer may tell their own bank, the receiving depository financial institution (RDFI), to block future debits from that originator, a request handled as an ACH stop payment. Businesses can go further and ask their bank to apply an ACH debit block or filter so that only approved originators may debit the account. Once an authorization is revoked, further debits are unauthorized even if the original form is valid.

When a receiver says a debit was not authorized, the RDFI can send it back as an ACH return using a specific ACH return code. The main codes are R05 for an unauthorized debit to a consumer account using a corporate entry class, R07 for an authorization revoked by the customer, R10 where the customer says the originator is unknown or not authorized, R11 where the debit does not follow the terms of the authorization, and R29 where a business customer says the entry was not authorized. For consumer accounts, unauthorized returns can be made up to 60 calendar days after settlement, supported by the consumer's written statement, which is much longer than the standard two-banking-day window.

Nacha monitors originators whose unauthorized return rate exceeds 0.5 percent, and ODFIs can face rules enforcement and fines if their originators exceed the threshold. High rates often point to poor authorization practices, unclear billing names or fraud.

Firms that collect by ACH pull usually build authorization into onboarding screens, keep timestamps and IP addresses as evidence, send confirmations by email, and give advance notice when a variable amount changes. Weak authorization records are a common finding in ODFI audits and leave the originator unable to defend disputed entries. For subscription and recurring payments, clear cancellation routes reduce both unauthorized returns and consumer complaints.

• Nacha