You need your customer’s authorization before you debit their bank account through the automated clearing house (ACH) network. An ACH authorization form is the usual way to get it. For consumer accounts, Nacha’s rules call for a signed or similarly authenticated written authorization.
An oral one also works if you record it or confirm it in writing. Either way, the customer gets a copy. The right form depends on the Standard Entry Class (SEC) code: PPD, WEB, TEL, or CCD.
This guide explains what each form needs and gives you four templates to adapt. It also covers how long to keep authorizations and what happens when a customer disputes a debit.
Is an ACH Authorization Form Required?
Yes. Every ACH debit needs the account holder’s authorization, and the form it takes depends on who owns the account.
For a consumer account, a written authorization must be signed or similarly authenticated. Every authorization must be readily identifiable as one, with clear and readily understandable terms (Nacha). It must also tell the customer how to revoke it, and you must give the customer a copy (Nacha, November 2025). Oral authorizations are allowed when you record them or confirm them in writing, as covered below.
Federal law says the same for recurring consumer debits. Regulation E allows them only with a writing signed or similarly authenticated by the consumer, and the business must provide a copy (12 CFR 1005.10). Electronic signatures that meet the Electronic Signatures in Global and National Commerce Act (E-Sign Act) count (Consumer Financial Protection Bureau).
For a business account, the two companies need an agreement, and both must be bound by the Nacha Rules. The Rules don’t dictate the agreement’s contents (Nacha ACH developer guide).
Which ACH Authorization Form Do I Need?
The SEC code follows two questions: whose account you’re debiting, and how they gave you the authorization.
| SEC code | Whose account | How they authorize | Common uses |
|---|---|---|---|
| PPD (Prearranged Payment and Deposit) | A consumer’s | A signed form, on paper or in person | Tuition, childcare, rent, membership dues |
| WEB (Internet-Initiated/Mobile) | A consumer’s | Online, in an app, or by voice over the internet | Payment portals, online enrollment |
| TEL (Telephone-Initiated) | A consumer’s | Orally, on a phone call | Payments taken by phone |
| CCD (Corporate Credit or Debit) | A business’s | An agreement between the two businesses | Business-to-business (B2B) invoices, franchise royalties |
Nacha’s Meaningful Modernization rules, effective September 17, 2021, tied the code to the channel. An oral authorization given over the internet, such as on a video call, is a WEB entry. TEL is for authorizations given on a telephone call (Nacha).
WEB debits carry one more duty. Since March 19, 2021, your fraud detection must include validating the account before the first debit. You must validate it again whenever the account number changes (Nacha). And since June 22, 2026, Nacha’s fraud monitoring rule covers every business that originates ACH payments (Nacha).
Our guide to ACH debits vs. ACH credits explains when a debit is the right tool in the first place.
What Must an ACH Authorization Include?
Nacha’s rules set seven minimum elements for consumer debit authorizations (Nacha):
- Whether it’s for a single payment, recurring payments, or payments under a standing authorization
- The amount, or how you’ll determine it
- The timing: the start date, and the number or frequency of payments
- The customer’s name or identity
- The account to be debited
- The date of the authorization
- How the customer can revoke it with you, including how much notice you need
Beyond the list, the form must be readily identifiable as an authorization. Fine print buried inside another agreement can fail that test. Put it on its own form or screen, with a clear heading and plain terms.
What Must a Recurring Authorization Include?
A recurring authorization needs all seven elements, stated so the customer can predict every debit. Spell out the frequency, the start date, and either the fixed amount or how the amount is set.
When the amount varies, Regulation E requires written notice at least 10 days before each debit. You may also let customers choose to get notice only when the amount falls outside a range they agree to (12 CFR 1005.10(d)). Nacha’s developer guide also calls for notice before changes: 7 calendar days for a date change and 10 for an amount change (Nacha).
Customers can also stop a recurring debit through their bank. Regulation E lets them do it by telling their bank at least three business days before the scheduled date (12 CFR 1005.10(c)). Your form should still tell them how to cancel with you directly.
Since September 17, 2021, Nacha also recognizes standing authorizations. A customer authorizes future debits in advance, then starts each payment with a further action, such as tapping “pay now” (Nacha).
ACH Authorization Form Templates
Use these as starting points. Replace the brackets, keep the seven elements, and give every customer a copy of what they authorized. Have your counsel review the final wording before you use it.
Template 1: Recurring Consumer Debit (PPD)
[Business name] ACH Debit Authorization
I authorize [Business name] to debit my bank account below by ACH for [what the payments are for, such as monthly tuition for (student name)].
- Payment type: Recurring
- Amount: $[amount] each [month] [or: the amount on my monthly statement. I will receive notice of the amount at least 10 days before each debit.]
- Timing: On the [day] of each [month], starting [date], until [end date or I cancel]. If that day isn’t a business day, the debit runs on the next business day.
- Name on account: [name]
- Bank: [bank name] · Routing number: [9 digits] · Account number: [number] · Type: [checking or savings]
I can cancel this authorization by [calling (phone number) or emailing (address)] at least [3] business days before the next debit. [Business name] will notify me at least 10 days before any change in amount and at least 7 days before any change in date. If a debit is returned for insufficient or uncollected funds, [Business name] may try it again up to two more times within 180 days of the original settlement date.
Signature: [customer’s signature] · Date: [date signed]
Template 2: Online Authorization (WEB)
Show this text on its own screen, above the button:
By selecting “I authorize,” I authorize [Business name] to debit the bank account I entered by ACH [once, for $(amount), on (date)] [or: for $(amount) on the (day) of each (month), starting (date)]. I confirm I’m authorized to use this account. I can cancel by [method] at least [3] business days before a scheduled debit. I will receive a copy of this authorization by email.
☐ I authorize [Business name] to debit my account as described above.
[Full name] · [Date] · [I authorize]
Before the first debit, validate the account. Email the customer a copy right away, and store the record with the date and time it was accepted.
Template 3: Phone Authorization Script (TEL)
Read this script on a recorded line:
- “This is [your name] with [Business name]. Today is [date]. I’m recording this call to confirm your ACH authorization.”
- “Am I speaking with [customer name], and are you authorized to use the account ending in [last four digits]?”
- “You’re authorizing [Business name] to debit $[amount] from your [checking or savings] account at [bank] on [date].” [For recurring: “on the (day) of each (month), starting (date).”]
- “You can cancel by calling [phone number] at least [3] business days before a scheduled debit.”
- “Do you authorize this debit?” [Wait for a clear yes.]
- “We’ll send a written copy to [email or mailing address]. Thank you.”
Template 4: Business Debit Agreement Clause (CCD)
[Customer company] authorizes [Business name] to initiate ACH debit entries to the account below for amounts due under [the agreement dated (date) or invoices issued under it], on [each invoice due date or the (day) of each month]. Both parties agree to be bound by the Nacha Operating Rules. This authorization remains in effect until [Customer company] gives [Business name] [30] days’ written notice of termination.
Account: [bank name, routing number, account number, type] · Authorized signer: [name, title] · Signature: [signature] · Date: [date signed]
Send an invoice or remittance notice before each debit, and get the signature of someone authorized to bind the company.
Can ACH Payments Be Authorized Over the Phone?
Yes. A consumer can authorize a debit orally on a phone call, and you send it as a TEL entry. The recording or confirmation must cover the same seven elements as a written form (Nacha).
The rules differ by payment type. For a single payment, you must either record the oral authorization or send the customer written notice confirming it before the debit settles. For recurring payments, you must record the authorization and also send the customer a written copy, as Regulation E requires.
The Consumer Financial Protection Bureau (CFPB) has said a recorded call satisfies Regulation E’s writing requirement only if it meets the E-Sign Act (CFPB, 2015). For recurring payments, the safer route is a signed or E-Sign-compliant written authorization, plus the copy.
How Long Must I Keep ACH Authorizations?
Keep each authorization for two years after it ends, whether the customer revokes it or the payments finish (Nacha). For a one-time phone authorization, keep the recording or written notice for two years from the date of the authorization.
The receiving bank can ask for proof. When it does, your bank must provide a copy within 10 banking days, so your processor may ask you for it on short notice (Nacha). Store authorizations where you can find any one of them within minutes.
What Happens When a Customer Disputes a Debit?
A customer who says a debit wasn’t authorized can have their bank return it. Consumers have up to 60 days for unauthorized returns such as R10 and R11 (Nacha). Under the Nacha Operating Rules, a business customer’s unauthorized return, R29, must come back within two banking days.
These returns count against Nacha’s unauthorized return rate threshold of 0.5% (Nacha). A clear authorization, a copy in the customer’s hands, and notice before changes prevent many disputes. Our guide to ACH return codes explains each code, and our post on how long an ACH transfer takes covers the return windows.
What to Do Next
- Match each payment flow to its SEC code: paper forms, online enrollment, phone payments, and business customers.
- Update your forms so each includes all seven elements and a clear way to cancel.
- Send every customer a copy of what they authorized.
- Validate accounts before the first WEB debit, and whenever an account number changes.
- Set up notices for amount and date changes on recurring debits.
- Store authorizations for two years after they end, somewhere you can search.
- Train your phone staff on the TEL script, and record every call that includes an authorization.
Authorizations are also part of your fraud controls. Our ACH fraud monitoring procedure template shows how they fit.
How ReliaFund Helps
ReliaFund specializes in a number of industries, including childcare, franchise operations, property managers, and schools. Our ACH processing includes reporting down to the transaction level.
When you call 1-866-243-5040, a team member answers and directs your call.
Frequently Asked Questions
Can I use one authorization form for every customer? Only if they all authorize the same way. Use a PPD form for paper, WEB wording for online enrollment, a TEL script for phone payments, and an agreement for business customers.
Do electronic signatures count? Yes, when they meet the E-Sign Act. Nacha and Regulation E both accept a writing that is “similarly authenticated,” which covers compliant electronic signatures.
Do I need a new authorization if the amount changes? Not for a variable amount the authorization already describes; send notice at least 10 days before each debit instead. If the terms change beyond what the customer agreed to, get a new authorization.
Can a customer cancel an ACH authorization? Yes. The customer can revoke it with you, using the method on your form. A consumer can also stop a recurring debit by telling their bank at least three business days before the scheduled date.
Do I need a voided check? No Nacha rule requires one. Many businesses ask for one to confirm account numbers. For WEB debits, account validation is required before the first debit either way.
These templates are general information. They aren’t legal advice. Have your counsel review them, and confirm your obligations with your bank.
Sources
- Nacha: Meaningful Modernization (effective September 17, 2021)
- Nacha: The Importance of Compliant ACH Authorizations (November 3, 2025)
- Nacha: ACH developer guide, How ACH Works
- Nacha: Supplementing Fraud Detection Standards for WEB Debits
- Nacha: Differentiating Unauthorized Return Reasons and ACH Network Risk and Enforcement Topics
- eCFR: Regulation E, 12 CFR 1005.10, preauthorized transfers
- CFPB: Official interpretation of 12 CFR 1005.10 and Compliance Bulletin 2015-06