ACH Authorization Form: 2 Free Templates and What Nacha Requires

What an ACH Authorization Form Is and Why Your Bank Asks for It

An ACH authorization form is your customer's signed permission to debit their bank account. It is also what your bank will ask you to produce if that customer tells their own bank they never agreed. Nacha's developer guide expects proof within 10 days of a request, and a bank asked for proof can agree to accept the return instead.

This guide covers debit authorizations, where you pull money from a customer's account. If you're collecting bank details to pay someone, such as payroll direct deposit or a vendor payment, that's an ACH credit authorization and this guide doesn't cover it; ask your bank which form it expects.

No card network sits in the middle of an ACH debit, so for rent, a gym membership or a monthly donation, the customer's permission is the whole basis for the payment. Nacha, which governs the ACH Network, calls authorizations the foundation under which ACH entries may be sent at all.

Two rulebooks apply. Regulation E, the federal rule protecting consumer bank accounts, says preauthorized electronic transfers from a consumer's account "may be authorized only by a writing signed or similarly authenticated by the consumer," and whoever obtains the authorization must give the consumer a copy. Under the CFPB's official interpretation, if either piece is missing, the payee is in violation, not the bank. The second rulebook is the Nacha Operating Rules, which bind you through your agreement with the bank that sends your entries.

In Nacha terms you're the Originator and your bank is the ODFI; our glossary covers the rest. Taking cards too? See the credit card authorization form guide.

Nacha Authorization Requirements: Consumer vs. Business Accounts

The big fork is whose account you're debiting. Nacha requires a signed or similarly authenticated writing only for consumer debits. Business accounts can authorize in any manner permitted by law. Each entry also carries a Standard Entry Class (SEC) code that reflects the account type and how you got permission:

You can't reliably tell from the numbers whether an account is personal or business, and Nacha puts the burden of proof on the Originator. So add a personal or business checkbox to the form and have the customer fill it in. A B2B supplier should still get a written form. It's your evidence when the customer's AP team says nobody approved the debit. If a business customer would rather push the money to you, compare wire transfer and ACH costs and finality before you agree.

Nacha's 2021 "Meaningful Modernization" rules also allow standing authorizations (one advance authorization, with each later payment triggered by the customer's own action) and oral authorizations beyond the phone call, if they meet the same minimum standards.

And since June 22, 2026, Nacha requires non-consumer Originators of every size to have risk-based processes and procedures reasonably intended to identify ACH entries initiated due to fraud. Ask your bank what that means for you.

What an ACH Debit Authorization Form Must Include

Nacha doesn't prescribe wording or layout, but it does require certain information, and its consultants write that authorizations often leave some out. Every authorization must be readily identifiable as one, with clear and readily understandable terms (Regulation E uses the same standard). Nacha's paper on proof of authorization lists these elements for consumer debits:

• Authorization language. A plain sentence such as "I authorize [Business] to debit my account."
• The amount. For recurring debits, that can be the same amount each time, a range, or an amount set by specified activity, such as the balance on each monthly invoice.
• The date or frequency of the debit or debits.
• The account number and the bank's routing number.
• Revocation language for recurring or future-dated debits: how the customer cancels directly with you, and how much notice you need.

Then add these four:

• A signature or similar authentication, and the date. Per the CFPB's interpretation, an authorization that complies with the federal E-Sign Act satisfies the writing and signature requirements.
• Your legal name and the name that will appear on the customer's bank statement. A customer who doesn't recognize a debit calls their bank, not you.
• Account type (checking or savings) and classification (personal or business).
• Notice terms for changes in amount or date (see the dated example below).

ACH Authorization Form Template: One-Time Debit

Both templates are generic and original. Replace every bracketed item and have your attorney review the final wording, since ACH authorizations sit where Regulation E, the Nacha rules, state law and e-signature law meet.

[Business Legal Name]: One-Time ACH Debit Authorization

• Account holder name: ____________
• Business name (if a business account): ____________
• Billing address: ____________
• City / State / ZIP: ____________
• Phone: ____________ Email: ____________
• Bank name: ____________
• Account type: Checking / Savings
• Account classification: Personal / Business
• Routing number: ____________
• Account number: ____________
• Amount to be debited: $____________
• Description of payment: ____________
• Debit date (on or after): ____________

Authorization language: I authorize [Business Legal Name] to initiate a single ACH debit from the bank account listed above for the amount and date stated, as payment for the goods or services described. I confirm that I am the account holder or am authorized to approve debits to this account. I understand the debit will appear on my bank statement as [Name on Bank Statement]. If the debit date is in the future, I may cancel this authorization by contacting [phone / email] at least [number] business days before the debit date. This authorization covers this one payment only. [Optional, only if permitted in your state: If the debit is returned unpaid, a returned-payment fee of $______ may be charged.] I acknowledge that I have received a copy of this authorization.

• Account holder signature: ____________
• Date: ____________

ACH Authorization Form Template: Recurring Debits

Use this one for rent, dues, memberships, legal retainers and supplier accounts. Property managers and gyms can collect it at lease signing or enrollment. Our recurring billing guide covers the operations side.

[Business Legal Name]: Recurring ACH Debit Authorization

• Account holder name: ____________
• Business name (if a business account): ____________
• Billing address: ____________
• City / State / ZIP: ____________
• Phone: ____________ Email: ____________
• Bank name: ____________
• Account type: Checking / Savings
• Account classification: Personal / Business
• Routing number: ____________
• Account number: ____________
• Amount per debit: $__________ (or describe how it is determined, e.g., "the balance on each monthly invoice, not to exceed $__________")
• Frequency (weekly / monthly / quarterly / other): ____________
• Debit date each period (e.g., the 1st of the month): ____________
• First debit date: ____________
• End date (or "until revoked"): ____________

Authorization language: I authorize [Business Legal Name] to initiate recurring ACH debits from the bank account listed above in the amount and on the schedule described. I confirm that I am the account holder or am authorized to approve debits to this account. I understand these debits will appear on my bank statement as [Name on Bank Statement]. If a debit will differ from the amount described above, [Business Legal Name] will notify me in writing of the amount and date at least [10 or more] days before the debit, and will notify me at least [7 or more] days before any change in the debit date. If a debit is returned, [Business Legal Name] may re-present it only as permitted by the Nacha Operating Rules. This authorization remains in effect until the end date above or until I revoke it by notifying [Business Legal Name] at [phone / email / address] at least [number] business days before the next scheduled debit. Revoking this authorization does not cancel amounts I already owe. I acknowledge that I have received a copy of this authorization.

• Account holder signature: ____________
• Date: ____________

Example: The Recurring Template, Filled In

Example Fitness LLC is a made-up gym and Jordan Sample is a made-up member. After Jordan signs up, the key fields might read:

The 3-business-day revocation window matches the lead time Regulation E gives Jordan to stop a payment at the bank, so cancelling with the gym is no harder than cancelling through the bank. Writing the notice periods into the form also means front-desk staff don't have to remember them.

Changing the Amount or Date on a Recurring Debit

A debit that doesn't match what the customer signed can come back as an R11 return, so changes need advance notice. Regulation E requires written notice of the amount and date at least 10 days before a debit that differs from the previous one or from the preauthorized amount. Nacha's developer guide sets a 10 calendar-day notice for a change of amount (consumer accounts only) and a seven calendar-day notice for a change of date (consumer and business accounts).

Example: Example Fitness changes its billing.

• Dues go from $49 to $55 starting with the November 1, 2026 debit. Jordan's written notice of the new amount and date has to go out by October 22, 2026.
• The gym then moves the debit from the 1st to the 15th, starting December 15, 2026. That notice has to go out by December 8, 2026.
• Skip the first notice, and a $55 debit Jordan didn't expect is the wrong-amount case R11 exists for.

Regulation E also lets the consumer opt to get notice only when a debit falls outside a specified range, as long as you tell them they have the right to notice of every varying debit and the range is one they could anticipate.

Taking ACH Authorizations Online or by Phone

Online or by phone, the terms stay the same. What changes is how you prove agreement. For a web sign-up, follow this order:

1. Show the full authorization terms on the page: statement name, amount, schedule and how to revoke.
2. Collect bank details over an encrypted connection. Nacha's secure-transmission rule (Article One, Section 1.7) requires banking information collected over an unsecured network like the internet to be encrypted or sent over a secure session.
3. Authenticate the customer and record how: the verification step, a time stamp and the IP address. Nacha's WEB proof-of-authorization paper warns that a screenshot of your authorization language alone isn't adequate proof, because it doesn't link the account holder to the authorization.
4. Validate the account on first use and whenever it changes, as Nacha has required of WEB debit Originators since March 19, 2021. Prenotes, micro-entries and commercial validation services are among the methods Nacha lists.
5. Email the customer a copy of the full terms they agreed to.

By phone (TEL), a one-time debit needs a recording or a written confirmation sent before the debit settles, kept for two years from the authorization date. Recurring phone authorizations still have to meet Regulation E's written-authorization and copy requirements, and you keep the recording and proof the copy was sent for two years after the authorization ends or is revoked.

How Long to Keep an ACH Authorization Form

Under the Nacha rules, keep the original or a copy of each written authorization (or a readily and accurately reproducible record of any other form) for two years from the termination or revocation of the authorization, and be able to provide it to your bank on request.

Example: a long-running tenant. A tenant signs a recurring rent authorization on March 1, 2024 and revokes it at move-out on August 31, 2029. The two-year clock starts at revocation, so that form stays on file until August 31, 2031. That's seven and a half years of retention for one authorization.

And a bad authorization can surface late. Nacha notes that a breach of the authorization warranty can lead to extended returns of up to two years (plus the first 95 calendar days) for consumer accounts and one year for business accounts.

Regulation E and Nacha both require the customer's copy for consumer debits. The CFPB's interpretation offers a simple method: hand over two copies, have the customer sign and return one, and let them keep the other.

Storing Bank Account Details Safely

A completed ACH authorization form holds routing and account numbers, and Nacha regulates how you store them.

• The rule. Nacha's Supplementing Data Security Requirements rule requires non-bank Originators, Third-Party Senders and Third-Party Service Providers with more than 2 million ACH entries a year to render account numbers, consumer and business, unreadable when stored electronically. The 6-million tier took effect June 30, 2021 and the 2-million tier June 30, 2022.
• Under that volume? Nacha doesn't mandate it but strongly encourages it as a sound business practice.
• Scans count. Paper forms aren't covered, but scanned copies are. A folder of scanned authorizations on a shared drive is electronic storage.
• Passwords aren't enough. Nacha says access controls alone don't meet the standard. It names encryption, truncation, tokenization and destruction among the options, and says PCI DSS data-at-rest methods should also satisfy the rule.

Our position: the account and routing numbers your customers provide should be tokenized and vaulted rather than stored in readable form. Enter them into your payment gateway vault, lock up any signed paper, and don't let completed forms sit in email.

R10, R11 and the 0.5% Unauthorized Return Rate

When a consumer tells their bank a debit wasn't authorized, it comes back to you as a return, and Nacha's consultants call returns caused by non-compliant authorizations preventable. Two codes point at the form:

• R10: the customer says they don't know you, have no relationship with you, or never authorized the debit.
• R11: an authorization exists, but the debit didn't match its terms (wrong amount, taken earlier than authorized, or improperly reinitiated). Nacha puts the R11 return timeframe at 60 days, and lets you fix the error and send a new entry within 60 days of the return's settlement date without a new authorization.

Both count toward your unauthorized return rate. Nacha sets the threshold at 0.5% for return codes R05, R07, R10, R11, R29 and R51, measured as those returns divided by debits originated over the preceding 60 days or two calendar months. Your bank monitors it.

Example: a gym with 400 monthly drafts. Over two calendar months the gym originates 800 debits. Half a percent of 800 is 4. Four unauthorized returns in that window put the gym right at the threshold, and a fifth takes it to 0.625%, even though that's only five members out of 400.

Common mistakes that lead to these returns:

• Debiting earlier than the date on the form.
• Charging a new amount without the 10-day written notice.
• A statement name the customer won't recognize.
• A screenshot as your only proof of an online authorization.
• Scanned forms sitting in a shared drive or inbox.
• Re-running a debit that came back unauthorized. Nacha's retry rule covers R01 and R09, not unauthorized returns; an R11 can be corrected under the 60-day rule above.

For every code and how to respond, see our ACH return codes guide.

This guide is general information, not legal advice. Rules change, so have your attorney review your forms and retention policy.

We provide ACH authorization forms and return management. See how ACH payment processing and eCheck processing work. If you're paying card rates on payments that could run as ACH, send a recent statement for a free statement review and we'll show you exactly what you're paying.

Sources

• CFPB, Regulation E, 12 CFR 1005.10 Preauthorized transfers, observed September 2026.
• CFPB, Official interpretations of 12 CFR 1005.10, observed September 2026.
• Nacha, The Importance of Compliant ACH Authorizations, observed September 2026.
• Nacha, Meaningful Modernization, observed September 2026.
• Nacha ACH Guide for Developers, How ACH Works, observed September 2026.
• Nacha, WEB Proof of Authorization Industry Practices, observed September 2026.
• Nacha, Supplementing Fraud Detection Standards for WEB Debits, observed September 2026.
• Nacha, Supplementing Data Security Requirements, observed September 2026.
• Nacha, Risk Management Topics – Fraud Monitoring Phase 2, observed September 2026.
• Nacha, Differentiating Unauthorized Return Reasons, observed September 2026.
• Nacha, ACH Network Risk and Enforcement Topics, observed September 2026.
• Nacha, How to Calculate Unauthorized Return Rate, observed September 2026.