ACH payments: how they work, timing and returns

ACH payments are electronic transfers between bank accounts that travel over the Automated Clearing House network, under operating rules set by Nacha. For a business, they move in two directions. An ACH credit is money a customer pushes into your account from their bank or payables system. An ACH debit is money you pull from a customer's account after they authorize it, the way a gym collects monthly dues or a utility collects a bill.

The volume is enormous. Nacha counted 35.2 billion ACH payments worth $93 trillion in 2025, and close to 8.1 billion of them went from one business to another (Nacha).

This guide covers the operating side: how to start accepting ACH, when the money actually lands, what happens when a payment comes back, and what an authorization has to say. If you're still weighing ACH against cards for large invoices, our comparison of ACH vs credit card handles cost and risk. You can set ACH up through your bank or a processor; Clearo offers ACH payment processing alongside cards, and this guide shows where each fits. Rules cited were checked on October 9, 2026.

How do ACH payments work?

Every ACH payment follows the same path: one bank sends an instruction into the network, and another bank posts it. Here's an ACH debit from start to finish, with you collecting the money:

1. Your customer signs an authorization that lets you debit their account.
2. You create the payment, with their routing number, account number, amount and date, in your bank's portal or your billing software.
3. Your bank bundles your payments with others and sends them into the ACH network before its cutoff.
4. The network delivers each payment to the customer's bank.
5. On the settlement date, the money moves from the customer's bank to yours.
6. If something is wrong, such as a closed account, the customer's bank sends the payment back as a return.

An ACH credit runs the same chain from the other end. The customer's bank starts it, and all you do is give the customer your routing and account numbers and wait for their payment run.

Bank agreements and Nacha's rules use their own names for the players:

You probably receive ACH payments already, even if you've never sent one. According to the OCC's handbook for bank examiners, acquiring banks usually fund merchants by sending ACH credits to their deposit accounts (OCC). Your card deposits most likely arrive that way.

Should you accept ACH credits, ACH debits or both?

Credits are easier to start; debits put you in control of the date.

Many businesses end up with both: credits from large business customers who pay on their own schedule, and debits for recurring charges on dates you set.

How do you start accepting ACH payments?

Receiving ACH credits takes almost no setup. Pulling ACH debits takes more, because your bank has to approve you to send them. A typical path looks like this:

1. Decide whether you need debits at all. If credits cover you, print your routing and account numbers on your invoices and stop there.
2. Ask your bank, or an ACH provider your bank works with, about ACH origination. Expect an application and a review of your business, and ask what limit it will set on your debit volume.
3. Get the price list in writing: the fee per payment, the fee per return, any monthly charge, and any extra charge for Same Day ACH.
4. Write your authorization form before you need it. The section below covers what goes in it.
5. Choose how you'll create payments: your bank's online portal, your billing or accounting software, or the provider's platform.
6. Learn your bank's cutoff times for standard and same-day payments, and which time zone they're in.
7. Decide now what you'll do when a payment comes back, so the first return doesn't turn into a scramble.

Protect your own account details while you're at it. Anyone with your routing and account numbers can send you money, and fraudsters send customers fake "our bank details have changed" emails to redirect what they owe you. Tell customers your details will never change by email alone. If an account should only ever receive deposits, find out whether your bank offers debit blocks or filters for it.

How long do ACH payments take?

Most ACH payments settle within a banking day. Per Nacha, debits settle the same day or the next banking day, credits settle the same day, the next banking day or in two banking days, and about 80% of all ACH payments settle in one banking day or less.

Same Day ACH is faster. It handles payments of up to $1 million, with three settlement windows each banking day (Nacha). In Nacha's published schedule, payments submitted by 10:30 a.m. ET settle at 1:00 p.m., and those submitted by 2:45 p.m. ET settle at 5:00 p.m. (Nacha). The per-payment limit is set to rise to $10 million on September 17, 2027 (Nacha). Your bank's own cutoffs come earlier than Nacha's deadlines, so ask for them.

Banking days drive everything. Weekends don't count, and neither do Federal Reserve holidays. The Federal Reserve Financial Services holiday calendar shows the next one as Columbus Day, Monday, October 12, 2026.

Here's a made-up example. A landscaping company in Charlotte pulls 140 monthly maintenance payments of $95 each, $13,300 in all. Its bank's cutoff for next-day settlement is 4 p.m.

Holidays are where days slip away. Had the company uploaded on Friday, October 9, before the cutoff, the money would have settled Tuesday, October 13, because Monday is a holiday. Miss that Friday cutoff and the file doesn't go out until Tuesday, so the money settles Wednesday, October 14.

What happens when an ACH payment is returned?

A return is the customer's bank sending a payment back, with a reason code that tells you why. For a debit, money you thought you had comes back out of your account, which makes returns the real risk of collecting by ACH.

How long the window stays open depends on the reason and the type of account:

Nacha's rules set the standard two-day timeframe and reserve longer windows for specific cases (Nacha). The 60-day extended right of return covers unauthorized consumer debits (Nacha), while an unauthorized debit to a business account has to come back within 2 banking days (Nacha). That gap is one reason ACH debits suit business-to-business billing.

Nacha groups the reason codes, and at first the group matters more than the individual code:

The unauthorized codes come from Nacha's guide to calculating the unauthorized return rate, and the administrative codes from its fact sheet on network quality rules.

Return rates Nacha watches

Nacha also tracks how often your debits come back. Its rules set an unauthorized return rate threshold of 0.5% (Nacha), calculated over a rolling 60 days or two calendar months (Nacha). Two more levels trigger a closer look: 3.0% for administrative returns and 15.0% for returns of any kind. Going over one of those levels doesn't automatically count as a rules violation, but it can start an inquiry (Nacha).

The threshold is easy to cross. Say a fitness studio in Columbus pulls 600 membership dues a month, 1,200 over two months. In that window:

• 7 debits come back as unauthorized: 7 ÷ 1,200 = 0.58%, over the 0.5% threshold.
• 24 come back for account data errors: 2.0%, under the 3.0% level.
• 50 come back for other reasons, mostly a lack of funds. All 81 returns together are 6.75%, under the 15.0% level.

Seven complaints out of 1,200 payments sounds like nothing, but it puts the studio over the line, and its bank may well ask why. The usual fixes are clearer authorizations, a business name customers recognize on their statements, a reminder before each debit, and an easy way to cancel. Our page for wellness and fitness businesses covers the card side of membership billing.

What should an ACH authorization include?

An authorization is your proof that the customer agreed to be debited. For consumer accounts, federal law sets the floor, and your bank and Nacha's rules add to it.

When debits recur from a consumer's account, Regulation E requires the consumer to authorize them in a writing they sign or similarly authenticate, and electronic signatures count (CFPB). Signing on a customer's behalf after they agree by phone doesn't satisfy it. And if a debit will differ from the previous one or from the authorized amount, the customer must get written notice of the amount and date at least 10 days ahead, unless they agreed to a range.

A practical authorization covers:

• The customer's name, and the account holder's name if it's different
• The routing number, account number and account type (checking or savings)
• The amount, the range, or how the amount is calculated
• How often you'll debit, the first date, and the end date or "until canceled"
• Your business name as it will appear on the customer's bank statement
• How to cancel, and how much notice you need
• The customer's signature or electronic acceptance, with the date

Send the customer a copy, and keep yours for as long as you're debiting the account and for as long afterward as your bank requires. If the customer is a business, the debit terms usually sit in your signed agreement; ask your bank what wording it wants.

Customers who sign up online add one more step. For internet-authorized debits, which Nacha calls WEB debits, account validation is part of the fraud screening required the first time you use an account number and whenever it changes (Nacha). Nacha's FAQ says the minimum standard is confirming that the account is open and can accept ACH entries, and that it doesn't extend to confirming who owns it (Nacha). Your bank or provider can tell you which validation method it supports.

If some customers would rather pay by card on file, the paperwork is different. Our credit card authorization form guide has a template.

How do you protect your business from ACH fraud?

Good process does most of the work here, and the weak spot to guard is a convincing fake instruction. A few habits close the common gaps:

• Confirm any change to a customer's or vendor's bank details by calling a number you already have on file.
• For a new customer paying by debit, wait for the return window to pass before you ship something expensive.
• Require two people to approve outgoing payments above an amount you choose.

Nacha's rules now expect this kind of attention from businesses that send debits. Its new risk management rules arrived in two phases in 2026: the first on March 20, and the second in June, which applies whatever your origination volume (Nacha). They require non-consumer originators, a group that includes a business pulling customer debits, to have risk-based processes intended to identify ACH entries initiated due to fraud. Your bank can tell you what that means for your setup.

How do ACH payments fit alongside card payments?

ACH and cards do different jobs, and plenty of businesses take both. ACH suits recurring bills and large invoices from customers you know. Cards suit new customers, one-off sales and anyone paying on the spot, because you get an approval before the goods leave.

Two habits make running both easier. Reconcile them separately, because ACH receipts, ACH returns and card deposits all land in the same bank account; our guide to payment reconciliation shows how. And offer cards for recurring billing too, for customers who'd rather not share bank details, which our recurring billing guide covers. For invoice terms, see our guide to B2B payments.

That card side is where we come in. Clearo's virtual terminal handles invoices, payment links and recurring card billing, and our payment processing includes same-day or next-day funding options for card deposits. Your ACH stays with your bank.

Because Nacha's rules are national, the timing and return windows above apply to a business anywhere in the United States. Canadian bank transfers run on a different system with different rules, so check with your bank if you also sell in Canada.

Common ACH mistakes

• Shipping to a brand-new customer the moment a debit settles, before the return window closes.
• Sending an unauthorized return through again instead of talking to the customer.
• Taking recurring consumer debits on a verbal OK, with no signed or electronically authenticated authorization.
• Ignoring the unauthorized return rate until the bank calls about it.
• Changing a vendor's bank details because an email asked you to.

Next step

We can't price your ACH, because your bank sets those fees. We can show you what the card side of your business costs. Send a recent merchant statement for a free statement review, and we'll break your card costs down by card type and payment method, which makes it easier to decide which customers to steer toward ACH. Or contact us to talk through invoices, payment links and recurring card billing.