Proper ACH authorization1 is one of the most important responsibilities for organizations that initiate ACH transactions.
What authorization is required?
The Nacha Operating Rules require ACH transactions to be authorized before they are initiated. Authorization requirements vary depending on the type of transaction, but the organizations should ensure they obtain and retain appropriate evidence of authorization before transmitting entries.
| ACH debits: pulling funds from someone else’s account | The authorization must be in writing or similarly authenticated, clearly describe the terms of the payment, identify your organization by name, and include any required information about how the authorization may be revoked. |
| ACH credits: pushing funds, such as payroll direct deposit | A signed authorization form (paper or electronic) is the recommended approach. It should identify the recipient, their account information, and the nature of the payment. Organizations should retain appropriate records of the recipient’s authorization. |
Reminder: Requests to change direct deposit or payment account information should be independently verified before being processed, especially when received by email. Don’t rely on the contact information provided in the change request.
How long to keep authorization records
Nacha requires authorization records be retained for two years from the date the authorization is terminated or revoked. For ongoing payment arrangements, such as recurring ACH debits or active direct deposit instructions, authorization should be retained for the duration of the relationship and for two years after the final transaction.
Records may be kept in paper or electronic form. What matters most is that they’re organized, accessible, and can be produced quickly if your financial institution asks for them.
When payment is disputed
If an account holder claims a debit was unauthorized, we may receive a return request and ask you to provide a copy of the authorization. If you cannot produce it, or if the transaction doesn’t match the authorization’s terms, you may be required to accept the return. The simplest way to protect your organization is to receive authorization before initiating any transaction, keep it on file, and make sure the payment matches what was agreed to.
