Two ways to be paid by ACH
Before you set anything up, decide which direction you want.
| Customer pushes (ACH credit) | You pull (ACH debit) | |
|---|---|---|
| Who starts the payment | Your customer, from their bank | You, through your bank or processor |
| What you give or get | You give the customer your bank details | You get the customer’s bank details and their authorization, usually a signed form |
| Setup needed | None. You only need a bank account | An ACH service from a bank or processor |
| Who controls the date | The customer | You |
| Can it come back? | Only in set cases, such as a wrong account or a sender’s reversal | Yes. Returns are part of the system |
If you send a few invoices a month, the first way may be all you need. Put your details on an ACH information form and send it with the invoice.
The rest of this guide is about the second way: collecting ACH debits.
Step 1. Choose a provider
A business cannot send payments into the ACH Network by itself. It goes through a bank. There are two routes.
| Your bank | A payment processor or invoicing tool | |
|---|---|---|
| How it works | You sign an ACH origination agreement and send debits through the bank’s cash management service | The processor sends the debits for you, under its own arrangement with a bank |
| Good for | Businesses with steady volume and an existing bank relationship | Quick setup, online checkout, invoices and subscriptions |
| Pricing style | Monthly fee plus cents per payment | A flat fee or a percentage, often with a cap |
| Example | Chase Business “ACH Collections” | Stripe, PayPal Braintree, GoCardless, QuickBooks Payments, Square Invoices |
In the rules, a processor that sends entries for businesses that have no agreement of their own with the bank is called a Third-Party Sender.
Nacha’s advice to small businesses is to start by contacting your own financial institution.
Step 2. Get the customer’s authorization
This is the step you cannot skip. In the ACH rules, the business that starts a payment is called the originator. Here, that is you. Nacha puts the duty on the business: each originator is responsible for getting proper authorization to debit an account.
For a personal account, the authorization must:
- be in writing, or the electronic equivalent
- be easy to identify as an authorization
- have clear and readily understandable terms
- say how the customer can cancel, if the payment recurs
Regulation E adds that you must give the customer a copy.
For a business customer, you need an agreement in which the customer agrees to be bound by the Nacha Operating Rules.
Our ACH authorization form is built to include these elements. There are also versions for recurring and one-time payments. Check the wording with your bank before use. If you are moving existing customers to ACH, an ACH letter with the form attached saves a step.
Keep every signed form for two years after the authorization ends or is cancelled. If a customer later disputes a payment, your bank will ask you for proof. If customers agree on your website or by phone, see using the wording online or by phone.
Step 3. Check the bank details
A wrong digit means a returned payment and a fee. Check before the first debit.
- Routing number. Test it with the routing number checker.
- Account. Nacha accepts a prenote, micro-entries or a commercial validation service. A prenote is a zero-dollar test entry. See ACH account verification for what each one proves.
For debits that consumers authorize online (WEB), checking the account is a rule, not a choice. It applies the first time you use an account number and whenever the number changes.
Step 4. Use the right payment type
Every ACH entry carries a three-letter code that says how it was authorized. Your provider usually sets it, but you should know which applies.
| Code | Use it when |
|---|---|
| PPD | A consumer signed a written authorization |
| WEB | A consumer authorized the debit online or on a phone app |
| TEL | A consumer authorized the debit by phone |
| CCD | The customer is a business |
The code matters when something goes wrong. Nacha says it is the originator’s job to know whether the account it is debiting is a personal or a business account. See ACH SEC codes.
Since March 20, 2026, a consumer debit for goods bought online must carry the description PURCHASE.
Step 5. Send the debit and tell the customer
Send the debit on the date the customer agreed to. Your provider will have a cut-off time each day. A debit sent after it goes out on the next banking day.
If you change the date of a recurring debit, give 7 calendar days’ notice. If you change the amount for a personal customer, give 10 calendar days’ notice. The ACH letter templates have a notice letter for each change.
Step 6. Watch for returns
An ACH debit is not guaranteed. The customer’s bank can send it back.
| Why | Time limit | Code |
|---|---|---|
| Not enough money | Two banking days | R01 |
| Account closed or not found | Two banking days | R02, R03 |
| Personal customer says it was not authorized | 60 days | R10 |
| Business customer says it was not authorized | Two banking days | R29 |
Nacha watches three return rates for every originator.
| Return type | Level |
|---|---|
| Unauthorized debits | 0.5% |
| Administrative returns (R02, R03, R04) | 3% |
| All debit returns | 15% |
Going over the 3% or 15% level starts an inquiry. It is not an automatic violation, but it is a warning to fix how you collect details and authorizations.
A debit returned for insufficient funds may be tried again, with RETRY PYMT in the description. Look up any code in our ACH return codes list.
Step 7. Protect the data and watch for fraud
- Account numbers. Nacha requires large non-bank originators, those sending more than 2 million ACH payments a year, to make stored account numbers unreadable. Smaller businesses should do the same: do not keep bank details in email or open spreadsheets.
- Fraud monitoring. Since June 2026, every business that originates ACH payments must have risk-based processes meant to identify payments started by fraud, and must review them at least once a year. Ask your provider what it does and what it expects from you.
What it costs
These are published prices. We checked Helcim and Square on October 4, 2026, and the others on October 2, 2026. They are examples, not rules.
| Provider | Price to collect an ACH payment |
|---|---|
| GoCardless | 0.5% + $0.05, capped at $5 |
| Helcim | 0.5% + $0.25, capped at $6. 0.05% more on amounts over $25,000. Its recurring payments tool adds 0.4% to each payment. Checked October 4, 2026 |
| PayPal Braintree | 0.75%, capped at $5 |
| Stripe | 0.8%, capped at $5 |
| QuickBooks Payments | 1% |
| Square Invoices | 1%, at least $1. No cap is shown on Square Free. Capped at $10 on Square Plus and Square Premium. Checked October 4, 2026 |
| Chase Business ACH Collections | $25 for the first 25 a month, then $0.25 each |
Add the cost of returns. Chase lists $2.50 for each returned payment, and Braintree, GoCardless and Helcim list $5. Full details are in ACH fees and ACH return fees.
How long until you have the money
At the network level a debit settles the same day or the next banking day. That is not the same as money you can spend. Because a debit can be returned, a provider may wait before paying out. Stripe lists four business days as standard and two for eligible users.
See how long an ACH transfer takes.
ACH compared with card payments
- Cost. Several of the prices above stop at $5 however large the invoice is, which matters most on large invoices. Not all do: QuickBooks lists 1% with no stated cap. Square shows no cap on its free plan, and a $10 cap on its paid plans.
- Disputes. There is no card-style chargeback process with an appeal. Stripe states that ACH Direct Debit disputes are final.
- Speed. A card payment is approved in seconds. An ACH debit is not confirmed as paid until the return window has passed.
The full comparison is in ACH vs credit card and debit card.
Common mistakes
- Debiting after a spoken yes. A one-time phone authorization only counts if it is recorded, or confirmed to the customer in writing. A signed form is simpler.
- Skipping the account check. For debits that consumers authorize online, the ACH rules require it the first time you use an account number. For other debits, a wrong digit still means a returned payment and a fee.
- Shipping the same day you collect. Wait for the return window on large orders.
- Using a personal-account form for a business customer. A business must agree to be bound by the Nacha rules.
- Retrying a debit returned as unauthorized. You need a new authorization.