What Is an ACH Authorization Form and When Do You Need One?

An ACH authorization is your consent for a specific party to initiate an electronic transfer involving your account. The CFPB describes an ACH authorization as "a payment authorization that gives the lender permission to electronically take money from your bank, credit union, or prepaid card account when your payment is due" — and the same idea applies to any company you authorize, not just a lender. The organization you authorize is called the originator; it uses your authorization to send the transaction into the ACH network.

Crucially, an ACH authorization is voluntary. You can decline to sign one and pay another way. Federal law even bars certain creditors from requiring repayment by preauthorized recurring electronic transfer as a condition of credit — the CFPB notes that lenders "cannot condition a payday loan on obtaining an authorization from the consumer for 'preauthorized' (recurring) electronic fund transfers." Because the authorization gives someone standing permission to touch your account, only grant it to organizations you trust.

ACH moves money in both directions, and which way it moves determines what kind of authorization you are granting. An ACH debit authorization lets the originator pull money out of your account — the rail behind automatic rent, a gym membership, an insurance premium, or a subscription. An ACH credit authorization lets money be pushed into your account, which is how direct deposit of your paycheck works. Both ride the same ACH network; they simply run in opposite directions.

Most authorizations consumers are asked to sign are debit authorizations, because that is the case where a company needs your standing permission to take money. A direct deposit setup is the credit side — you give your employer your account details so wages can be deposited. Knowing which one you are granting matters: a debit authorization is the one that lets funds leave your account, so it is the one to read carefully and keep a record of.

• ACH debit authorization — permits an originator to pull money out (rent, dues, premiums, subscriptions).
• ACH credit authorization — permits money to be pushed in (direct deposit of wages).
• Both use the ACH network; the difference is the direction the money moves.

Under the Nacha operating rules that govern the ACH network, a consumer debit authorization must be in writing and signed or similarly authenticated by you, and it has to be readily identifiable as an authorization with clear and readily understandable terms. In practice that means the authorization spells out the essentials so there is no ambiguity about what you agreed to: who is being paid, from which account, how much, and on what schedule.

It also has to make plain whether the debit is a single, one-time entry or a recurring series, and — importantly — how you can revoke it. The CFPB advises making sure your authorization "states clearly how it can be stopped or revoked" before you sign. A complete authorization typically captures the items below, which is also the information an originator needs to process the payment correctly.

• Your name and the account holder details.
• Your bank routing number and account number, and the account type (checking or savings).
• The amount, or how a variable amount will be determined.
• Whether it is a one-time debit or a recurring payment, and the frequency and start date.
• Clear instructions for how to revoke the authorization.
• Your signature (or similar authentication) and the date.

An ACH authorization can cover a single payment or an ongoing series, and the authorization must say which. A one-time authorization permits a single debit — for example, a one-off electronic payment — and then it is done. A recurring authorization permits a series of debits on a schedule, such as monthly rent or a subscription, and it stays in effect until you revoke it. That standing nature is exactly why recurring authorizations deserve careful reading and record-keeping.

For recurring debits, the CFPB has emphasized that companies must keep clear records of what you authorized and give you a copy of the terms — including the amount you agreed to, the recurring nature of the debits, and the timing of the payments. Keep your own copy too. Because a recurring authorization does not expire on its own, tracking the ones you have granted is the only way to know who currently has permission to debit your account.

Because you granted the authorization, you can also withdraw it. In general, you revoke a recurring ACH authorization by notifying the company that collects the payment, in writing, that you are withdrawing your permission, and keeping a dated copy. The authorization itself should tell you how — that is one of the terms it is required to make clear. If a company will not honor the revocation, or you are worried a debit will slip through, you can also tell your bank, which can place a stop payment on the preauthorized transfer under federal Regulation E.

Revoking an authorization, stopping a payment at the bank, and disputing an unauthorized charge are three related but distinct steps. This article is about granting the authorization; for the full process of ending a recurring debit, see the guide on stopping an automatic ACH payment, and for challenging a debit you never approved, see disputing an unauthorized automatic payment. To stop a single specific item at your bank, see the guide on stopping payment on a check or ACH.

• Tell the company collecting the payment, in writing, that you revoke the authorization, and keep a dated copy.
• If needed, tell your bank too — it can stop payment on a preauthorized transfer under Regulation E.
• Revocation (ending the agreement), stop payment (blocking an item), and dispute (challenging an unauthorized charge) are separate steps.

When a company asks for your authorization to set up automatic payments, a clean written form is what they need and what protects you. It records exactly what you agreed to — the account, the amount, the schedule, and how to cancel — and gives you a dated copy to keep. Read it before you sign: confirm the amount or how a variable amount is set, whether it is one-time or recurring, and that it states clearly how to revoke it.

When you need to provide one, you can generate an ACH debit authorization form with your account details, the payment amount and frequency, and your signed consent laid out the way an originator expects. Keep a copy of every authorization you grant so you always know who has permission to debit your account — and remember that a recurring authorization stays in effect until you revoke it.

An ACH authorization is your written permission letting an organization move money to or from your account electronically over the ACH network. A debit authorization lets a company pull money out; a credit authorization lets money be pushed in, as with direct deposit. Under the Nacha rules, a consumer debit authorization must be written, signed, and state in clear terms the amount, the timing, whether it is one-time or recurring, and how to revoke it. It is voluntary, so only grant it to organizations you trust, keep a copy, and remember a recurring authorization runs until you cancel it.