ACH authorization requirements for third-party senders

Learn how proper authorization practices can help strengthen compliance, reduce ACH risk, and support smoother payment processing.

Key insights

• ACH entries generally require authorization from the Receiver before an entry is initiated.
• Consumer debit authorizations must contain specific elements required by the Nacha Operating Rules.
• Authorizations must be retained for at least two years after termination or revocation.
• Third-party senders must be prepared to provide proof of authorization when requested through the ACH Network.
• Electronic, oral, and standing authorizations may be permitted when specific Nacha requirements are met.

Proper authorization is an important component of compliance with Nacha rules. Before an Originator initiates ACH entries to a Receiver’s account when transmitting ACH entries through their originating depository financial institution (ODFI), appropriate authorization must be both obtained and maintained in accordance with Nacha Operating Rules.

For third-party senders (TPSs), understanding authorization requirements is especially important. Because TPSs originate ACH payments on behalf of their Originators, they play a critical role in promoting compliance with appliable authorization and record-retention requirements.

“Authorization requirements are designed to protect every participant in the ACH Network,” said Noelle McKenzie, Regions Bank Treasury Management digital and shared services product manager. “When third-party senders understand what information is required and how records must be maintained, they’re in a stronger position to support compliance and reduce operational risk.”

How can training support compliance efforts?

Ongoing education can help third-party senders stay current with evolving ACH requirements and better understand their responsibilities.

This training, conducted by Nacha and furnished by Regions Bank, reviews ACH authorization requirements, explains record-retention obligations, and outlines best practices for responding to authorization requests and other compliance-related inquiries.

Training is conducted by Nacha and furnished by Regions for informational purposes only and should not be construed as legal advice or a legal opinion from Regions.

Why are ACH authorizations important?

The Nacha Operating Rules require Originators to obtain authorization from Receivers before initiating ACH entries to their accounts. While authorization requirements vary depending on the transaction type and Standard Entry Class (SEC) code involved, several core principles apply broadly across ACH payments.

All authorizations must:

• Comply with applicable legal requirements.
• Be readily identifiable as an ACH authorization.
• Contain clear and understandable terms.
• Be retained for a minimum of two years following termination or revocation of the authorization.

These requirements help establish the Receiver’s consent while providing documentation that may be needed if a transaction is questioned or disputed.

Consumer authorization requirements

Authorization requirements differ for consumer credits and consumer debits.

For consumer credit entries, an Originator may generally obtain authorization in any manner permitted by applicable law. Although not required in all circumstances, written authorization is recommended.

For consumer debit entries, authorizations generally must be in writing and signed or similarly authenticated unless otherwise expressly permitted under the Nacha Operating Rules. The Originator also must provide the Receiver with an electronic or hard-copy version of the authorization.

What information must any consumer debit authorization include?

Consumer debit authorizations typically must contain:

• Whether the authorization applies to a single entry, recurring entries, or subsequent entries under a standing authorization.
• The amount of the entry, entries, or method used to determine the amount.
• Timing information, including the start date and frequency of payments when applicable.
• The Receiver’s identity.
• The account information to be debited.
• The date of authorization.
• Revocation instructions that explain how the Receiver may revoke authorization directly with the Originator.

The Originator must provide the Receiver with a reasonable opportunity to communicate a revocation before an entry is initiated.

Notification requirements for recurring debit entries

When recurring consumer debit entries involve changes in amount or timing, additional notice requirements may apply.

Changes in amount

If the amount of a recurring debit differs from the previous payment or from a preauthorized amount, the Originator generally must provide written notice of the new amount and debit date at least 10 calendar days before the transaction is initiated.

Changes in date

If a recurring debit is scheduled for a different date, the Originator generally must notify the Receiver at least seven calendar days before the first affected payment. Routine variations caused by weekends or banking holidays are not considered changes in the scheduled date.

Responding to authorization requests

Proper record retention can become especially important when proof of authorization is requested.

When a receiving depository financial institution (RDFI) requests evidence of authorization, Regions Bank may request supporting documentation from the Originator or third-party sender. The requested authorization records must be provided in sufficient time to allow Regions Bank to meet applicable Nacha response requirements.

For non-consumer transactions, Regions Bank may be required to provide either an accurate record of the authorization or Originator contact information, depending on the transaction type and circumstances.

“Maintaining authorization records is just as important as obtaining them,” McKenzie said. “Organizations should have a clear process in place for retaining and retrieving documentation when requests arise.”

Understanding electronic and oral authorizations

Electronic signatures can include traditional e-signature solutions as well as certain authorizations communicated through telephone or internet-based communications when permitted by the Nacha Operating Rules and applicable law.

For oral authorizations, additional requirements apply.

For a single-entry oral authorization, an Originator generally must either:

• Make and retain an audio recording of the authorization.
• Provide written confirmation of the authorization before settlement and retain that record.

For recurring oral authorizations, the Originator generally must comply with Regulation E requirements, provide a copy of the authorization to the Receiver, and retain supporting documentation.

What are standing authorizations?

A standing authorization is an advance authorization that permits future debit entries to a consumer account, provided the Receiver takes additional affirmative action before each subsequent debit is initiated.

Common examples include app-based or online services where a consumer grants authorization in advance and then initiates future transactions through individual actions, such as requesting a service and confirming payment. In these situations, the Originator may need to demonstrate both the standing authorization and evidence of the Receiver’s subsequent affirmative action.

Because standing authorizations can involve multiple methods of communication and various SEC codes, organizations should review applicable Nacha requirements and ensure appropriate controls are in place for each transaction type.

Building a stronger authorization process

Strong authorization practices help support compliance, improve operational efficiency, and reduce risk exposure.

Third-party senders can strengthen their authorization framework by:

• Reviewing authorization forms and processes regularly.
• Maintaining clear record-retention procedures.
• Educating employees on authorization standards.
• Monitoring compliance with SEC code requirements.
• Establishing processes to respond promptly to authorization requests.
• Periodically reviewing ACH policies and procedures.

Organizations that proactively address authorization requirements may be better positioned to manage evolving compliance expectations and support the integrity of ACH payments.

Ready to help

Regions can help with Treasury Management solutions that simplify payments, enhance controls, and support ACH compliance efforts. Learn more by contacting your Regions Treasury Management relationship manager.