Understanding ACH Debit Authorization Requirements

ACH debit authorization appears to be a simple process—and on the surface, it is. It occurs when a consumer gives an “originator”(an entity or company) permission to initiate a debit entry to his or her account. However, at E-Complish, we’ve seen some confusion among our clients where ACH debit authorization and considerations for originators are concerned. Let’s clarify a few things with a look at the answers to these frequently asked questions.

Q: Do NACHA Operating Rules dictate that originators include specific language or information in ACH debit authorizations?

A: Yes and mostly no—or more accurately, mostly no to the first part of this question and yes to the second. According to the NACHA Operating Rules, originators do not need to incorporate any specific language in ACH debit authorizations—except for what is known as “express authorization language”(e.g., “I authorize Company A to debit my account”). Additionally, no specific format is required.

But when it comes to the information such authorizations must contain, things get a bit more complicated. Specifically, the dollar amount of the transaction must be indicated. For recurring transactions, the dollar amount can be the same each time. It can also be for a range of amounts or amounts determined on the basis of a particular purchase or activity. Other information that must appear in ACH debit authorizations includes the date(s) and/or frequency of the transactions, the consumer’s account number, the routing number of the consumer’s bank, and parameters pertaining to cancellation of recurring debit payments or debit payments that have been scheduled in advance (e.g., “Scheduled payments may be cancelled only if cancellation occurs x number of days in advance”).

Q: How do originators prove that an ACH debit was properly authorized?

A: Originators should be able to provide documentation that shows transaction details, such as consumer information and sales documentation that specifies what goods were exchanged or what services were provided to the consumer. For instance, according to NACHA, some documentation can be captured in the form of a screenshot of the authorization language, along with two other items: a timestamp that indicates what date and time the consumer authorized the ACH debit, and evidence of the consumer’s identity and consent to the debit transaction.

Q: What about retaining clients’ authorizations? What are the requirements, and are originators required to keep copies authorizations in paper form?

A: Under NACHA Operating Rules, originators are required to retain an original copy or a copy of each written authorization of each consumer, “or a readily and accurately reproducible record evidencing any other form of authorization.” Authorizations may be retained in paper or electronic form. However, either way, originators must be able to accurately reproduce an authorization when requested by their original depositing financial institution (ODFI) for a period of two years following the termination or revocation of that authorization.

More and more merchants are accepting ACH debit as a payment method. Understanding the requirements that go along with doing so will prevent headaches in the short- and long terms alike.