ACH authorization form: what you must collect and keep

An ACH authorization form is the record of a customer’s permission for a business to debit their bank account. Network rules require the originator — the business taking the payment — to obtain authorisation before debiting, to give the customer a copy, and to retain the authorisation for a defined period after it ends.

The reason it matters commercially is disputes. When a customer claims a debit was unauthorised, the originator is asked to produce the authorisation. A business that cannot is not in a position to argue: the return is processed, and a pattern of them affects standing with the processor. The form is not paperwork for its own sake — it is the evidence in the only proceeding that follows.

What an ACH authorization form has to contain

• The customer’s name and the account and routing details being debited.
• Clear language authorising debits — one-off or recurring, stated explicitly.
• The amount, or, for variable amounts, how it will be determined and how the customer will be told before each debit.
• The frequency and, for recurring debits, the schedule.
• How the customer can revoke, and how much notice is required.
• The date and the customer’s signature or a similarly authenticated agreement — an online authorisation needs an authentication method, not just a tick.
• Your business name as it will appear on their statement, which prevents a large share of disputes on its own.

Retention outlasts the relationship

The obligation is to keep the authorisation for a period after it is revoked or terminated — commonly two years — because a dispute can arrive after the customer has left. That means authorisations belong in a retained record rather than in the payment system, which may purge inactive customers on its own schedule. Where a customer revokes, keep both the authorisation and the revocation, with dates.

Give the customer a copy at the time. It is required for many authorisation types, and it is also the single most effective reduction in disputes: people query debits they do not recognise, and a copy in their inbox from the day they signed usually ends the conversation before it becomes a return.

Business-to-business debits work differently

Debits between businesses use a different entry class and rest on the agreement between the parties rather than a consumer-style authorisation form, and the window for the receiving business to return an item is much shorter. That is why suppliers taking payment from business customers should still hold a signed authorisation as a term of the contract — the network rules are less prescriptive, but the evidential problem when a customer disputes is identical.

Collecting and storing them

Ettex Forms collects the authorisation with the required fields and the customer’s acceptance recorded, Ettex Records keeps it against the customer with the retention date visible so revoked authorisations are not deleted early, and the cheque-side equivalent of this control is covered in positive pay.

To be clear: this is forms and records, not a payments processor, and none of it is legal advice. Network rules set the required content, retention and entry classes, and they change; your processor and the current rules are the authority.