ACH authorization form: what it must say and how to keep it

An ACH authorization form is the record of a customer's permission for your business to pull money from their bank account through the ACH network. It identifies the account holder and the account, states the amount (or how you'll work it out) and the schedule, explains how to cancel, and carries the customer's signature or electronic acceptance. Without that permission you have no right to the debit, and the customer's bank can send it straight back.

People search for it under a handful of names: ACH form, ACH debit authorization, ACH payment form. They all point at the same document when the goal is collecting money from a customer. This guide covers what Nacha's rules and Regulation E require, a field-by-field template you can copy into your own form, the three ways to collect an authorization, and how long to keep each one. We give you a field list rather than a file, because the wording should come from your bank's requirements and your own terms.

Cards are a separate subject with separate rules. If customers pay you by card on file, our credit card authorization form guide covers that form and how to protect card data. Rules cited were checked on October 14, 2026.

What is an ACH authorization form, and when do you need one?

You need one before every ACH debit you originate, whether it's a single payment or the first of a monthly series. The form is your evidence that the account holder agreed. It isn't needed when money flows the other way.

Three documents get called an ACH form, and only one of them is a debit authorization:

If you only need to pay employees or suppliers, you're sending ACH credits, and our guide to ACH credits and debits explains how those differ. Everything below is about taking money in.

What do Nacha rules and Regulation E require?

Two sets of rules apply. Nacha's operating rules bind every business that sends debits through its bank, whatever kind of account it debits. Regulation E, the federal rule the CFPB administers, adds protections when the account belongs to a consumer: it covers electronic transfers that authorize a financial institution to debit or credit a consumer's account (CFPB).

Rules for every ACH authorization

Nacha's Meaningful Modernization rules, effective September 17, 2021, apply two standards to all authorizations: each must be readily identifiable as an authorization, and its terms must be clear and readily understandable (Nacha). A debit permission buried in paragraph 14 of your terms of service fails the first test. Give it its own heading, its own box, its own signature.

Nacha also expects you to be able to prove the authorization later. For online sign-ups, its guidance on WEB authorizations says the originator keeps the authorization and a record of the process that tied it to the customer (Nacha).

Extra rules for consumer accounts

When you debit a personal account on a recurring schedule, Regulation E sets four requirements that shape your form (CFPB):

1. The consumer must authorize the debits in a writing they sign or similarly authenticate. An electronic signature counts; your note that they agreed on the phone doesn't.
2. Whoever obtains the authorization must give the consumer a copy.
3. If a debit will differ from the last one or from the authorized amount, the consumer gets written notice of the amount and date at least 10 days before, unless they agreed to a range.
4. The consumer can stop a scheduled debit by telling their own bank, orally or in writing, at least three business days before it. The bank may ask for written confirmation within 14 days of an oral order.

The fourth point matters for how you write your cancellation terms. Your form can ask customers to cancel with you first, but it can't take away their right to stop a payment at their bank. The same text appears in the eCFR if your lawyer prefers the official code.

A consumer who says a debit was never authorized has a long time to say so: up to 60 days to return it (Nacha).

Business (corporate) accounts

Debits to company accounts have a much shorter window for an unauthorized return. It must come back within 2 banking days (Nacha). That doesn't make the paperwork optional. Nacha warns that a breach of the warranty of proper authorization can lead to extended returns, up to two years for consumers and one year for non-consumers (Nacha).

For business customers, most companies put the debit terms in the signed service agreement or a one-page authorization attached to it. Ask your bank what wording it wants in a corporate authorization before you write yours.

ACH authorization form template: the fields to include

Copy these fields into your own paper form, PDF or online form, and drop any that don't apply. The table works as an ACH form template for one-time and recurring debits alike.

Some businesses also ask for a voided check to confirm the numbers. If you take one, it's another piece of paper with account details on it, and you now have to store it securely.

Sample authorization wording

The authorization statement is the heart of the form. A plain version, to adapt with your bank's input:

Keep the sentence close to the signature line, in the same size type as everything else. If the customer would need a magnifying glass to find it, it isn't readily identifiable.

Written, online or phone: how should customers authorize?

Online is the easiest to run at volume, paper suits business customers, and phone works best for one-off payments. Each channel needs a different record.

Online sign-ups bring one Nacha requirement of their own. For WEB debits, fraud screening includes validating the account the first time you use an account number and whenever it changes (Nacha). Nacha's account validation FAQ sets the minimum as confirming the account is open and can accept ACH entries, without having to confirm who owns it (Nacha).

Phone needs the most care. Nacha's rules treat a debit authorized on a telephone call as its own entry type, TEL. For a recurring debit authorized orally, the originator must meet Regulation E's authorization requirements and keep the recording or an equivalent for two years after the authorization ends (Nacha). Since Regulation E wants a signed or authenticated writing for recurring consumer debits, a phone call alone won't carry a monthly plan. Take the details on the call, then email a link where the customer accepts the written terms before the first debit.

Picture a made-up lawn care company in Tulsa selling $65-a-month plans. Its office takes sign-ups by phone in spring, when the phones ring all day. The fix is a short script for the call and an online acceptance page sent by text before the first mow, so every plan has a written authorization behind it.

How should you store ACH authorization forms?

Keep each authorization for two years after it's terminated or revoked, in a place you can search in minutes. Nacha's guidance says originators retain the original or a copy of each written authorization, or a reproducible record of any other form of authorization, for two years from termination or revocation (Nacha).

The clock starts when the authorization ends, not when it's signed. A customer who signed up in January 2024 and canceled in March 2027 needs that form kept until at least March 2029. Given the warranty exposure above, many businesses simply keep authorizations as long as their other customer contracts.

Storage habits that hold up:

• Scan paper forms into a system with logins and access controls, and lock away or shred the originals once your bank confirms a copy is acceptable.
• Never leave forms in a shared inbox or an open folder. Routing and account numbers are enough to attempt fraud.
• File each form under the customer's name and the last four digits of the account, so you can produce it the day a bank asks.
• When a customer changes accounts, take a fresh authorization rather than editing the old one.

What happens if a customer says they never authorized a debit?

Their bank returns it, and your authorization form decides what you can do next. If the customer authorized you but the debit was wrong in some detail, such as the amount or the date, Nacha's rules let you correct the error and send it again without a new authorization within 60 days of the return's settlement date (Nacha). If there was no valid authorization at all, stop debiting that account until you have one.

A made-up property manager in Boise shows how the form earns its keep. A tenant signs up for rent by ACH at $1,525 a month. In month seven, a utility pass-through pushes the debit to $1,598, and the tenant disputes it with their bank, which sends it back. Had the form set a range of $1,450 to $1,650, the higher debit would have been inside what the tenant agreed to. Without a range, the manager needed to send notice of the new amount and date 10 days ahead, and didn't.

Keep an eye on totals as well as single cases. Nacha's unauthorized return rate threshold is 0.5% (Nacha), and a sloppy form is the quickest way to get there. Our guide to ACH return codes explains R10, R11 and the rest, and our eCheck guide covers taking one-off bank payments online.

Common ACH authorization form mistakes

• Folding the authorization into general terms and conditions where nobody can find it.
• Letting someone other than the account holder sign, such as a spouse or an employee.
• Debiting a new amount with no range in the form and no 10-day notice.
• Running a recurring consumer plan on a phone call with no written follow-up.
• Shredding forms when the customer cancels, instead of two years later.
• Storing scanned forms with account numbers in an unsecured shared drive.

Next step

Once your form is ready, you need a way to send the debits. Clearo offers ACH payment processing, priced by quote for each business, and Clearo says ACH payments usually fund the next business day. For customers who'd rather pay by card, our virtual terminal sends invoices and payment links. Our ACH payments guide covers settlement and returns in more depth, and the rules above apply the same way across the United States.

If you already take cards, send us a recent statement for a free statement review and we'll show you what each payment type costs you. Or contact us to talk through adding ACH.