An ACH authorization form is a written or electronic agreement that lets a specific company or person move money into or out of your bank account through the Automated Clearing House network. You sign one when you set up direct deposit with an employer, turn on autopay for a bill, or approve a one-time electronic withdrawal. The form is a legally binding record of who can touch your account, for how much, and how often, and federal law gives you the right to cancel that access and to dispute charges you never approved.
What You’re Authorizing When You Sign
The form is an agreement between you (the account holder) and the originator (the company or person on the other end) that spells out when transfers can happen, the dollar amount, and whether the arrangement is a single event or an ongoing series.1Nacha. The Importance of Compliant ACH Authorizations A credit entry pushes money into your account, like a paycheck or refund. A debit entry pulls money out, like a mortgage payment or a gym membership.
The one-time versus recurring distinction is the one to pay closest attention to. Your cancellation rights and the paperwork the originator has to keep both depend on it, so the form has to state which type of arrangement you’re agreeing to.1Nacha. The Importance of Compliant ACH Authorizations
Information the Form Has to Contain
A compliant consumer debit authorization has to include specific items so the transaction routes correctly and so you have a clear record of what you agreed to.1Nacha. The Importance of Compliant ACH Authorizations Expect fields for:
- Your legal name as it appears on the bank’s records
- The name of your bank
- The nine-digit routing number that identifies your bank
- The account number for the specific checking or savings account
- Whether the account is checking or savings
- The dollar amount, frequency (one-time or recurring), and scheduled date
- Your signature and the date, handwritten or electronic
Accuracy is worth slowing down for. A single wrong digit in the routing or account number can send money to the wrong account or cause the transfer to bounce, and either outcome can bring fees from your bank or from the company. Paper forms often ask you to attach a voided check to confirm the numbers. On a digital form, check every field against what your bank’s app or online portal actually shows.
Signing and Submitting the Form
You’ll run into these forms in a few places: your employer’s HR portal for direct deposit, a service provider’s billing page for autopay, or a standalone document from a bank or landlord. The form itself may be paper, a fillable PDF, or an online screen.
Paper forms take a physical signature. Digital forms use electronic signatures that carry the same legal weight under the federal Electronic Signatures in Global and National Commerce Act (ESIGN Act), which says a contract cannot be denied legal effect solely because it was signed electronically.2Office of the Law Revision Counsel. 15 USC 7001 – General Rule of Validity Many electronic systems also log the date, time, and IP address of your signature as an audit trail.
Submit the completed form through the secure channel the recipient specifies, such as an encrypted portal, a secure email system, or certified mail for paper. Don’t send your routing and account numbers over ordinary email. After submission, the originator must keep your authorization on file for at least two years after the last transfer occurs or the authorization is revoked, whichever comes later.
Micro-Deposit Verification Before the First Real Transfer
Before actual money moves, many originators verify that your account information is correct by sending micro-deposits. Under Nacha rules these are small credit entries of less than $1.00 each, paired with an offsetting debit, used only to confirm the account exists and that you control it.3Nacha. Micro-Entries The credits must be equal to or greater than the debits, and they settle at the same time.4Nacha. Nacha Micro-Entry Rule
To finish verification, you check your statement or transaction history for the tiny deposits and report the exact amounts back. That step proves you actually have access to the account. It typically takes one to three business days. Once you confirm the amounts, the originator activates your authorization and the scheduled transfers begin.
When the Money Actually Moves
Standard ACH transfers can settle in one to two business days from the date the originator submits the transaction. Same Day ACH, available for individual payments up to $1 million, can process within hours on the same business day.5Nacha. Same Day ACH Not every originator offers same-day processing, so if you’re relying on ACH to hit a hard deadline, confirm the expected settlement window first.
ACH only processes on business days. A transfer scheduled for a Saturday, Sunday, or federal holiday won’t settle until the next business day, which matters if you’re planning around due dates or trying to avoid an overdraft.
How to Cancel an ACH Authorization
You have the legal right to stop any preauthorized recurring ACH payment. Federal law says you notify your bank, orally or in writing, at least three business days before the next scheduled transfer.6GovInfo. 15 USC 1693e – Preauthorized Transfers Your bank may ask you to follow up an oral request with written confirmation within 14 days. If you don’t send that written confirmation, the oral stop-payment expires after 14 days and the bank may let future debits go through.7Consumer Financial Protection Bureau. Preauthorized Transfers
Stopping payment at the bank is only half the job. Also write to the company debiting your account and tell them you’re revoking the authorization. Include your name, address, the date, and any account or reference number tied to the recurring payment, and send it in a way that gives you proof of delivery. Once your bank has notice that the authorization is no longer valid, it must block all future payments from that originator.7Consumer Financial Protection Bureau. Preauthorized Transfers
Your Rights If a Charge Wasn’t Authorized
The Electronic Fund Transfer Act (EFTA) protects consumers from unauthorized electronic transfers, including ACH debits you never approved.8Legal Information Institute (LII) / Cornell Law School. Electronic Funds Transfer Act An unauthorized transfer is one initiated by someone other than you, without your permission, from which you received no benefit.9Office of the Law Revision Counsel. 15 USC 1693a – Definitions
How quickly you report the problem is what drives your liability. For unauthorized ACH debits that don’t involve a lost or stolen debit card, which covers most authorization-form disputes, the rules are simple:
- Reported within 60 days of the statement that shows the charge: zero liability. The bank must restore the full amount.
- Reported after 60 days: you may be liable for unauthorized transfers that happen after the 60-day window closes and before you notify the bank, but only if the bank can show those later transfers wouldn’t have occurred had you reported on time.
These timelines come from Regulation E. The $50 and $500 liability tiers you may have read about apply to unauthorized transfers involving a lost or stolen access device like a debit card, not to unauthorized ACH debits where no such device was used.10Consumer Financial Protection Bureau. Liability of Consumer for Unauthorized Transfers Your protection against rogue ACH debits is stronger than many people assume, provided you review your statements.
Business Accounts Are Not Covered
Regulation E applies only to accounts held primarily for personal, family, or household purposes. If the account is a business account, the consumer protections above (including the liability limits and stop-payment rights) generally do not apply.11Consumer Financial Protection Bureau. Electronic Fund Transfers FAQs Business account holders should ask their bank about ACH filters or positive pay to control which debits are allowed to post.
What a Failed Transfer Means
Not every ACH transaction clears. When one fails, the receiving bank sends it back with a return code identifying the reason. The codes you’re most likely to see:
- R01, insufficient funds in your account
- R02, the account is closed
- R03, no account matches the numbers on the entry
- R04, the account number format is invalid
- R07, you revoked the authorization
- R08, you placed a stop payment
- R10, the originator wasn’t authorized to debit the account
A returned entry can bring fees from your bank and from the company that initiated it. An R01 return functions much like a bounced check: your bank may charge a nonsufficient funds fee, and the company may add a returned-payment fee. If a transfer failed because of wrong account details (R03 or R04), contact the originator to correct the information and resubmit. If it failed because you revoked or stopped it (R07 or R08), no further action is needed unless you want to restart the arrangement.
Protecting the Account on the Form
An ACH form carries your routing and account numbers, so the form itself is worth protecting. A few habits reduce your exposure:
- Send routing and account numbers only through secure portals or hand-delivered paper. Skip regular email and text.
- Read statements promptly. The 60-day reporting window starts when the bank sends the statement, not when you open it. Transaction alerts in your bank’s app give you real-time visibility.
- Ask your bank about ACH filters or positive pay, which let you pre-approve which companies can debit the account and flag anyone else.
- Cancel authorizations you no longer use. Fewer active authorizations mean fewer companies with a standing door into your account.
If you spot a transfer you didn’t approve, tell your bank right away. Under federal law, how fast you report is the single biggest factor in what you’ll owe.