ACH Positive Pay

ACH positive pay is a treasury fraud service, offered by US banks to business customers, that compares every incoming ACH debit against a list of approved originators and limits supplied by the customer. Debits that match post normally. Debits that do not match are shown to the customer as exceptions, and the customer decides, usually by a cut-off time on the same day, whether each one should be paid or returned.

The service adapts the older idea of cheque positive pay, in which a company sends its bank a list of cheques it has issued so the bank can spot forged or altered items, to electronic payments. It sits alongside the simpler ACH debit block, which returns all debits, and the ACH filter, which returns non-approved debits automatically. Positive pay adds a human review step, giving businesses more control at the cost of daily work.

The process generally runs in four stages:

1. Setting rules. The business tells its bank which originators may debit the account, identified by their company ID, and may add maximum amounts, allowed Standard Entry Class codes or date ranges.
2. Matching. As the bank, acting as receiving depository financial institution, receives each ACH file, it checks incoming debits against the rules before posting.
3. Exception review. Unmatched debits appear in the bank's online portal, often with an email or text alert. Staff review each item and choose to pay it, return it or, in many systems, pay it and add the originator to the approved list.
4. Default action. If the customer does not decide by the bank's cut-off, a default chosen in advance applies, most often to return the item.

Returned items go back to the originator's bank as ACH returns. For business accounts, a debit the customer says was not authorized is normally returned with an ACH return code of R29, which has a short return deadline, so timely review matters.

A company's bank account number is printed on every cheque and often appears on invoices, so it is easy for criminals to obtain. Anyone with the routing and account numbers can try to set up an ACH pull, for example to pay their own bills. Positive pay stops such debits before they settle permanently. It also catches legitimate but unexpected debits, such as a vendor collecting the wrong amount or a duplicate charge, giving the finance team a chance to query them. Many auditors and insurers expect larger businesses to use positive pay as part of their internal controls, and some fraud insurance policies reward its use.

• Debit only or credit and debit. Most services cover debits, but some also let customers review unexpected incoming credits, which can help detect money mule activity or misdirected payments.
• Rules by amount. Customers can allow a known originator but cap each debit, so that an unusually large collection is flagged.
• Account-level settings. Firms often apply full blocks on some accounts, such as payroll funding accounts, and positive pay on operating accounts used for vendor debits.

ACH positive pay only protects against debits, where someone else pulls money from the account. It does not stop a company's own staff from sending fraudulent ACH credits, which is the main risk in business email compromise scams, where criminals trick employees into paying fake invoices. Protecting outgoing payments relies on other controls such as dual approval, callback verification of supplier bank details and payee checks.

The service also depends on discipline. If staff approve exceptions without checking, or rules are too broad, fraud can still pass. If rules are too narrow, the review queue becomes long and genuine debits, such as tax payments, may be returned in error, causing penalties or strained supplier relationships. Banks charge monthly and per-item fees, which can make the service less attractive for very small businesses.

ACH positive pay is usually sold as part of a bank's treasury services package, alongside cheque positive pay, payee name verification and account reconciliation. For a corporate treasury team it is one layer in a wider approach to payment fraud, which also includes segregated accounts, limited user permissions and regular review of approved originators. The rules of the ACH network do not require banks to offer positive pay, but they make it workable by allowing receiving banks to return unauthorized business debits within set deadlines.