What compliance means for ACH payments

ACH compliance means following the rules set by NACHA (the National Automated Clearing House Association) and your bank about how you handle ACH transactions. These rules cover who you can debit, how you get permission, what you tell customers, how you handle errors, and what happens when a payment fails. Breaking them costs money in fines, rejected transactions, and lost customer trust—and can get your ACH access shut down.

The rules exist because ACH moves money directly from customer bank accounts. Unlike a credit card, where the card company sits between you and the customer's bank, ACH is a direct pull. That means you need explicit permission first, and you need to handle mistakes quickly and honestly when they happen.

Key Takeaways

  • You must get written authorization from the customer before you debit their account, and that authorization must clearly state the amount, frequency, and purpose of the charge.
  • NACHA rules require you to notify customers of failed payments within one business day and give them a way to dispute charges without penalty.
  • You must keep records of authorizations, transaction logs, and customer disputes for at least three years, and your bank will audit these during compliance reviews.
  • If you process more than a small volume of ACH transactions, you need a third-party processor or a dedicated compliance officer to monitor your practices.
  • Violations result in fines from NACHA, your bank, or both—ranging from hundreds to thousands of dollars per incident—and repeated violations can end your ACH access entirely.

Getting and keeping written authorization

Before you take the first payment, you need written authorization from the customer. This is not a verbal agreement or an email saying "yes, go ahead." It is a signed document—paper or electronic—that the customer keeps a copy of and you keep on file.

The authorization must include the customer's name, bank account number (or the last four digits), the amount of each payment or a statement that the amount may vary, how often the payment will happen, the purpose of the payment, and when the authorization starts. If the amount changes—like a subscription that scales with usage—you must tell the customer before each charge, or your authorization covers "amounts that may vary" and you document the reason for each variation.

For recurring charges (subscriptions, loan payments, insurance premiums), you must also provide a way for the customer to cancel the authorization. This cannot be buried in a terms-of-service document. It has to be easy to find and easy to use—a link on your website, a phone number, or an email address. When a customer cancels, you stop charging them. If you keep charging after cancellation, NACHA fines you per unauthorized transaction.

Keep the signed authorization on file for at least three years. Your bank will ask to see it during audits, and if you cannot produce it, you lose the dispute if the customer claims they never authorized the charge.

Notifying customers of failures and disputes

When an ACH payment fails—because the account is closed, the customer does not have enough funds, or the bank rejects it for another reason—you must notify the customer within one business day. This means by the end of the next calendar day, not "within 24 hours" (which could be interpreted as a rolling window).

The notification must explain why the payment failed and give the customer a clear way to contact you to resolve it. If you retry the payment, you must tell the customer that you are retrying and when. NACHA allows up to two retries per authorization, but only if your authorization document says you will retry. If it does not, you can only try once.

Customers have the right to dispute a charge. They can contact their bank and say the charge was unauthorized or incorrect. When a dispute comes in, you have 10 business days to respond to the bank with proof that the charge was authorized and correct. This proof is the signed authorization, the customer's account history showing the charge was applied correctly, and any communication showing the customer knew about the charge. If you cannot produce this proof, the bank reverses the charge and you lose the money.

You cannot charge a customer a fee for disputing a charge, and you cannot close their account or refuse service because they disputed a payment. If you do, NACHA fines you and your bank may terminate your ACH access.

Record-keeping and audit trails

You must keep records of every ACH transaction you process: the authorization, the date and amount of each charge, the customer's bank account number (or last four digits), the reason for the charge, and the result (success or failure). You also need to keep records of every dispute, including what the customer claimed, what proof you provided, and how it was resolved.

These records must be kept for at least three years. Your bank will audit your ACH program at least once a year, and they will pull a sample of transactions to verify that you have authorization on file, that you notified customers of failures, and that you handled disputes correctly. If your records are incomplete or missing, the bank assumes you violated the rule and may fine you or suspend your ACH access.

Many businesses use ACH processors (like Stripe, Square, or Bill.com) to handle this record-keeping automatically. The processor keeps the records and provides reports you can download for your own files. If you process ACH in-house, you need a system—a spreadsheet, a database, or accounting software—that tracks all of this. Do not rely on memory or email.

Handling refunds and reversals

If a customer overpays, pays twice by mistake, or you charge them incorrectly, you must refund the money. The refund goes back to their bank account via ACH, and it should happen within one to two business days. You cannot hold the money or ask the customer to wait.

If the customer disputes a charge and you lose the dispute (the bank sides with the customer), the bank reverses the charge automatically. The money comes out of your account at your bank. You cannot re-charge the customer for the same transaction. If you believe the reversal was wrong, you can file a counter-claim with the bank, but this is rare and requires strong proof.

Some businesses try to avoid refunds by making them hard to request or by delaying them. NACHA and your bank track this. If customers complain about refund delays, your bank will investigate and may fine you or restrict your ACH access.

Working with third-party processors and banks

If you use a payment processor to handle ACH, the processor is responsible for some compliance tasks—keeping records, notifying customers of failures, handling disputes. But you are still responsible for getting authorization and for the accuracy of the charges. Read your processor's contract to understand who does what.

Your bank is responsible for monitoring your ACH activity and making sure you follow the rules. They have the right to audit you, ask for documentation, and fine you if you violate NACHA rules. They also have the right to terminate your ACH access if violations are serious or repeated. If your bank terminates you, other banks will see this on your history and may refuse to work with you.

If you process a high volume of ACH transactions (more than a few hundred per month), your bank may require you to have a dedicated compliance officer or to work with a third-party compliance consultant. This person reviews your authorizations, your dispute handling, and your record-keeping to catch problems before your bank does.

Common violations and their costs

The most common ACH violations are charging without authorization, failing to notify customers of failures, and not keeping records. Each violation can result in a fine from NACHA, your bank, or both. NACHA fines typically range from $100 to $1,000 per violation, but if you have many violations in a short time, the fines add up quickly. Your bank may also charge you a fee for each violation they discover during an audit.

If you accumulate violations, your bank will send you a warning letter and give you a deadline to fix the problem. If you do not fix it, they will restrict your ACH access (limiting the number of transactions you can process per day or per month) or terminate it entirely. Once terminated, you will have trouble finding another bank that will process ACH for you.

Beyond fines, violations damage your reputation. Customers who are charged without authorization or who cannot get refunds will leave negative reviews, file complaints with their state attorney general, and report you to the Better Business Bureau. This costs you customers and makes it harder to grow.

Frequently Asked Questions

Do I need a compliance officer if I only process a few ACH payments a month?

No. If you process fewer than a few hundred transactions per month, you can handle compliance yourself by keeping good records, getting written authorization, and notifying customers of failures. Your bank will still audit you, but they expect smaller businesses to have simpler systems. As you grow, your bank will tell you if they want you to hire someone or work with a processor.

What happens if a customer disputes a charge and I have the authorization on file?

You send the authorization and transaction records to your bank within 10 business days. The bank reviews them and usually sides with you if the authorization is clear and the charge matches what the customer authorized. The customer's bank notifies them that the dispute was denied. The charge stays in your account.

Can I charge a customer a fee if their payment fails?

No. NACHA rules prohibit charging a customer a fee because an ACH payment failed due to insufficient funds or a closed account. You can retry the payment (up to two times if your authorization allows it), but you cannot charge them for the failed attempt. You can charge a late fee if the payment was late, but only if your authorization document says you will.

How long do I have to keep ACH records?

At least three years from the date of the transaction. Your bank may ask to see records older than three years if there is a dispute or an investigation, so keeping them longer is safer. Most businesses keep records for five to seven years as a standard practice.

What should I do if my bank terminates my ACH access?

Find out why. Ask your bank for a detailed explanation of the violations. Fix those problems—get better authorization forms, improve your record-keeping, hire a compliance person. Then contact other banks and explain what happened and how you fixed it. Some banks will work with you; others will not. It takes time to rebuild trust.