What compliance means for ACH payments

ACH compliance is not optional—it is a set of rules your business must follow every time you move money through the ACH network. The National Automated Clearing House Association (NACHA) sets these rules, and your bank enforces them. Break them and you face fines, transaction reversals, account restrictions, or loss of ACH privileges entirely.

Compliance covers three main areas: how you collect permission from customers or employees before moving their money, how you handle the data itself, and what you do when something goes wrong. Each area has specific steps, timelines, and documentation requirements. A business that skips even one step—say, failing to keep a signed authorization on file—can lose the right to process ACH payments.

The stakes are real because ACH moves actual money. Unlike a credit card, where the cardholder can dispute a charge within 120 days, an ACH transaction can be reversed only under narrow circumstances. That means the compliance rules exist to protect both the business and the person whose account is being debited.

Key Takeaways

  • You must have a signed written authorization from the person whose account you are debiting before you process any ACH payment, and you must keep that authorization on file for at least three years.
  • NACHA rules require you to notify customers of the amount and timing of ACH debits at least 10 calendar days before the first debit, and to provide a way for them to revoke permission at any time.
  • If a customer disputes an ACH debit, you have 10 business days to investigate and either refund the money or explain why the debit was correct.
  • Your business must use a Third-Party Service Provider (TPSP) or bank that is registered with NACHA and follows the Operating Rules, which means regular audits and security checks.
  • Violations can result in fines per transaction, account suspension, or permanent loss of ACH processing rights.

Getting written authorization before the first debit

The foundation of ACH compliance is a signed authorization. This is not a verbal agreement or an email—it must be a document the customer or employee signs, either on paper or electronically. The authorization must state the amount (or that amounts may vary), how often the debits will occur, and which account will be debited.

For consumer payments, the authorization must also include your business name, the customer's right to revoke permission at any time, and how they can revoke it (usually a phone number or mailing address). For employee payroll, the authorization is typically part of the payroll setup form or a separate direct deposit authorization card.

You must keep this signed authorization on file for at least three years from the date of the last transaction. If a customer disputes a debit and you cannot produce the authorization, you lose the dispute automatically and must refund the money plus any fees the customer incurred. Many businesses scan authorizations and store them digitally, but the digital copy must be legible and complete.

Notifying customers before debits begin

NACHA rules require you to give advance notice before the first ACH debit. The notice must arrive at least 10 calendar days before the debit hits the account. This is not a reminder—it is a formal notification that tells the customer exactly when the debit will occur and how much it will be.

The notice can be sent by email, text, mail, or any method the customer agreed to. It must include your business name, the amount, the date the debit will occur, and the account that will be debited. If the amount varies (for example, a utility bill that changes each month), you can notify the customer of the range or the method used to calculate it.

Many businesses combine this notification with an invoice or billing statement. The key is that the customer receives it 10 days before the debit, not on the day of the debit. If you miss this window, you cannot process the ACH transaction until you send the notice and wait another 10 days.

Handling disputes and reversals correctly

When a customer disputes an ACH debit, your bank will notify you within one to two business days. You then have 10 business days to investigate. During this time, you must review the authorization, the notification you sent, and any communication with the customer about the transaction.

If the authorization is valid, the notification was sent on time, and the amount matches what you agreed to, you can defend the debit. Send your findings to your bank with copies of the authorization and notification. If the authorization is missing, incomplete, or the notification was not sent 10 days in advance, you must refund the money when ready.

Even if you win the dispute, the customer can file a second dispute for the same transaction. You have the same 10 business days to respond again. After two disputes on the same transaction, NACHA rules limit how many more times the customer can dispute it, but your bank may restrict your account if disputes become frequent.

Registering with NACHA and using approved processors

You cannot process ACH payments on your own. You must work through a bank or a Third-Party Service Provider (TPSP) that is registered with NACHA. Your bank or processor is responsible for following the NACHA Operating Rules, which include security standards, audit requirements, and reporting obligations.

When you choose a processor, ask whether they are NACHA-registered and what compliance support they provide. Many processors offer templates for authorizations, pre-notification letters, and dispute response forms. Some will flag transactions that violate rules before they are sent to the ACH network, which prevents fines.

Your bank or processor must also maintain Originating Depository Financial Institution (ODFI) status, which means they have passed NACHA audits and carry insurance. If your processor loses this status, you cannot process ACH payments through them until they regain it.

Record-keeping and audit readiness

Compliance requires you to keep records of every ACH transaction for at least three years. This includes the signed authorization, the pre-notification letter, the transaction confirmation from your bank, and any dispute correspondence. If you are audited by NACHA or your bank, you must be able to produce these documents within days.

Many businesses use accounting software or payment platforms that store records automatically. If you process ACH manually or through a spreadsheet, create a folder for each customer with their authorization and all related documents. Label files by date so you can find them quickly.

Your bank will conduct periodic audits of your ACH activity. They will pull a sample of transactions and verify that each one has a valid authorization and proper notification. If they find violations, they will issue a warning and may require you to correct the problem within 30 days or face fines.

Common violations and how to avoid them

The most frequent violation is processing an ACH debit without a signed authorization on file. This happens when a customer gives verbal permission or when a business assumes permission from a previous transaction. NACHA rules require a separate authorization for each type of payment (payroll, bill payment, loan repayment) even if the customer has authorized one type already.

The second most common violation is failing to send the 10-day pre-notification. Many businesses send the notification on the same day as the debit or skip it entirely if the customer is a repeat customer. NACHA does not allow exceptions—every first debit requires 10 days' notice, and every debit to a new account requires notice even if the customer has been with you for years.

A third violation is processing variable-amount debits without explaining how the amount is calculated. If you debit a customer's account for different amounts each month, your authorization and notification must state that amounts will vary and how you will determine each amount. Debiting without this explanation is treated as an unauthorized transaction.

Frequently Asked Questions

What happens if I process an ACH debit without a signed authorization?

The customer can dispute the debit, and you will lose automatically because you cannot produce the authorization. You must refund the full amount plus any overdraft fees the customer incurred. Your bank may also fine you per violation and restrict your ACH privileges if this happens repeatedly.

Can I use an email as a signed authorization?

Yes, if the email contains the customer's explicit consent to the debit, includes all required information (amount, frequency, account number, your business name), and is signed with the customer's name or digital signature. The email must be stored and retrievable for three years.

Do I have to send a pre-notification letter every time I debit a customer?

No. The 10-day pre-notification is required only before the first debit to an account. After that, you can debit on the agreed schedule without sending a notification each time, unless the amount or timing changes significantly.

What is the difference between a dispute and a reversal?

A reversal is initiated by the customer's bank if the transaction violates NACHA rules (for example, no authorization on file). A dispute is initiated by the customer claiming the transaction was unauthorized or incorrect. Both give you 10 business days to respond, but reversals are harder to defend because they are based on rule violations, not the merits of the transaction.

How often will my bank audit my ACH activity?

Most banks conduct audits annually or when they detect a pattern of disputes or violations. The audit may be a full review of all transactions or a sample of 20 to 50 transactions. You should keep records organized so you can respond within the timeframe your bank provides, usually 10 to 15 business days.