ACH Authorization Form: Template and Rules

Short answer: an ACH authorization form is the customer's permission for a business to debit (or credit) their bank account. For consumer debits it must be signed or "similarly authenticated," state the amount, the date or frequency and the account, explain how to revoke recurring payments, and be copied to the customer. Keep it for two years after it ends.

Dated note: this guide reflects Regulation E and Nacha's published guidance as checked on October 29, 2026. Nacha rules change each year; we will update this page when an authorization rule changes. It is general information, not legal advice. Have your bank or lawyer review any form before you use it.

Most "free ACH form" pages hand you a PDF and stop there. That is fine for a landlord collecting rent from one tenant. It is not enough for an online store or membership site that pulls money from hundreds of customers, because the rules care less about the form and more about the proof behind it. This guide gives you copyable wording for one-time, recurring and business debits, maps each line to the rule that requires it, and shows how an online checkout replaces the paper form entirely.

What is authorization for ACH transactions?#

It is the account holder's agreement that a named business may move money to or from their account through the ACH Network, on stated terms. Two sets of rules shape it:

1. Regulation E (12 CFR 1005.10), a federal regulation that protects consumers. It says preauthorized transfers from a consumer's account "may be authorized only by a writing signed or similarly authenticated by the consumer," and "the person that obtains the authorization shall provide a copy to the consumer."
2. The Nacha Operating Rules, the private rules every bank in the ACH Network follows. Nacha's 2021 Meaningful Modernization rules say "only consumer debit authorizations require a writing that is signed or similarly authenticated," and apply the standards of "readily identifiable" and "clear and readily understandable terms" to all authorizations.

"Similarly authenticated" is what makes online authorization possible. A customer does not need to sign on paper if your process proves who they are and that they agreed, for example by logging in to their bank through Plaid Link and ticking an authorization box during the same session.

What must an ACH authorization form include?#

Nacha's guidance for online (WEB) debits says the rules do not require specific language or a particular format, but lists what "should be included in the authorization":

1. Express authorization language, for example "I authorize Company A to debit my account."
2. The amount. For recurring debits this can be the same amount each time, a range, or an amount based on specified activity.
3. The date(s) or frequency of the debits.
4. The consumer's account number.
5. The consumer's bank routing number.
6. Revocation language, for recurring payments or payments scheduled in advance.

On top of those six, three practical items are worth adding:

• Your company name as it appears on bank statements, so the customer recognizes the debit later. An unrecognized debit is the start of many unauthorized returns.
• A contact method (email or phone) for questions and cancellations.
• What happens if a debit fails, such as a returned-payment fee, if your terms allow one and local law permits it.

A note on account numbers: online, you rarely need the customer to type them. When a customer links an account through Plaid Link, Plaid Auth returns the account and routing number to your server, or your processor receives a token that stands for them. The authorization can then refer to the account by its bank name and last four digits, which is what BankBridge's default wording does.

Free ACH authorization form templates#

Below are three plain-text templates you can copy and adapt. Text in square brackets is for you to fill in. They are a starting point, not legal advice. Your bank (the ODFI) may require its own wording, and a lawyer should review the final version.

Template 1: one-time online ACH debit#

ACH DEBIT AUTHORIZATION (ONE-TIME)

I authorize [Company legal name] ("Company") to initiate a single
electronic ACH debit from my [checking/savings] account ending in
[last 4 digits] at [Bank name], routing number [routing number or
"on file"], in the amount of $[amount] on or after [date].

I confirm that I am an authorized signer on this account and that
this payment complies with applicable law.

This debit will appear on my bank statement as [statement name].
If the debit is returned, I understand Company may [describe any
fee or next step allowed by your terms].

Name: [Customer name]
Email: [Customer email]
Date and time authorized: [timestamp, time zone]
Order or invoice number: [reference]

[ ] I agree to this authorization.   [Authorize payment button]

Template 2: recurring online ACH debit#

ACH DEBIT AUTHORIZATION (RECURRING)

I authorize [Company legal name] ("Company") to initiate recurring
electronic ACH debits from my [checking/savings] account ending in
[last 4 digits] at [Bank name], routing number [routing number or
"on file"]:

Amount: $[amount] each [week/month/year]
  (or: an amount between $[min] and $[max], based on [how it is
  calculated])
First debit: [date]. Then on or about the [day] of each [period].
Debits that fall on a weekend or bank holiday will be made on the
next business day.

This authorization stays in effect until I cancel it. I can cancel
by [method: e.g. the Cancel button in my account, or by emailing
address] at least [number] business days before the next scheduled
debit. Company will give me at least [number] days' notice before
changing the amount or date of a debit.

This debit will appear on my bank statement as [statement name].

Name: [Customer name]
Email: [Customer email]
Date and time authorized: [timestamp, time zone]
Plan or subscription: [reference]

[ ] I agree to this authorization.   [Authorize payments button]

Template 3: business (CCD) debit authorization#

CORPORATE ACH DEBIT AUTHORIZATION

[Customer business legal name] ("Customer") authorizes
[Company legal name] to initiate ACH debits (CCD) from Customer's
business account ending in [last 4 digits] at [Bank name] for
invoices issued under [agreement name, date], in the invoice amount
on or after each invoice due date.

Customer can revoke this authorization by written notice to
[email/address], effective [number] business days after receipt.

Authorized signer name and title: [name, title]
Date: [date]
Signature or electronic acceptance: [signature / timestamp]

Where each line comes from#

Recurring vs one-time authorization: what changes?#

Recurring debits carry three extra duties.

1. Revocation terms. Nacha's list only requires revocation language for recurring or scheduled payments, but in practice every recurring form needs a clear, easy way to cancel. Nacha's own sample wording says the authorization "will remain in full force and effect until I notify COMPANY [insert manner of revocation...]" and that "COMPANY requires at least [X days/weeks] prior notice in order to cancel."
2. Notice when amounts vary. Regulation E 1005.10(d) says that when a preauthorized debit "will vary in amount from the previous transfer under the same authorization or from the preauthorized amount," the payee or bank must send written notice of the amount and date "at least 10 days before the scheduled date." The consumer can agree to receive notice only when a debit falls outside a stated range.
3. Notice when timing changes. Stripe's ACH Direct Debit docs tell merchants to give at least 7 calendar days notice if they change the timing of recurring debits.

A standing authorization is different from a recurring one. Nacha's 2021 rules define it as "an advance authorization by a consumer of future debits at various intervals," where each future debit needs "some further action" by the consumer, such as tapping Pay in an app that already has the account on file. Recurring entries, by contrast, "require no further action and occur at regular intervals."

How to stop ACH authorization#

There are two routes, and a careful customer uses both.

1. Tell the business, using the method in the authorization: a cancel button, an email address or a written letter. Ask for confirmation.
2. Tell your bank. Regulation E 1005.10(c) says a consumer "may stop payment of a preauthorized electronic fund transfer ... by notifying the financial institution orally or in writing at least three business days before the scheduled date of the transfer." The bank may require written confirmation within 14 days of an oral request, and an oral stop order "ceases to be binding after 14 days" without it.

If a business debits an account after the authorization was revoked, the customer's bank can return it. For a business, that return counts against its return rates, and the rules expect the debits to stop. BankBridge, for example, ends a recurring bank schedule when a debit comes back with a code that forbids further debits under the same authorization, including R07 (authorization revoked), R08 (payment stopped), R10 and R29 (not authorized), and closed or invalid account codes. Our ACH return codes guide explains each code.

How long must you keep an ACH authorization?#

Two years from the end of the authorization. Nacha's WEB proof of authorization guidance states: "Under the Nacha Operating Rules, Originators must retain the original or a copy of each written authorization of a Receiver, or a readily and accurately reproducible Record evidencing any other form of authorization, for two years from the termination or revocation of the authorization (Article II, Subsection 2.3.2.7) and be able to provide these records to the ODFI upon request."

Note the start of the clock. A member who pays monthly for five years and then cancels needs their authorization kept for seven years in total: five years active, plus two years after revocation.

When the receiving bank asks for proof, Nacha's 2021 rules let the sending bank choose, within 10 banking days, to "either provide proof or agree to accept a return." Either way, you need the record ready.

What counts as proof for an online (WEB) authorization?#

More than a screenshot. Nacha's guidance is blunt: "A simple screen shot of the authorization language presented and agreed upon by the consumer does not constitute adequate proof of authorization as it does not establish any link to the accountholder and the authorization." Nacha lists the practices it sees in the industry:

Two more Nacha rules sit behind online authorizations:

• Account validation for WEB debits. Nacha requires WEB debit originators to use a commercially reasonable fraudulent transaction detection system that includes account validation the first time an account is used. A bank login through Plaid Auth is one way; micro-deposits are another. Our bank account verification guide and micro-deposits guide cover the options.
• Fraud monitoring. Since 2026, Nacha's risk management rules require every non-consumer originator to run risk-based processes to identify debits that may be unauthorized or authorized under false pretenses. See Nacha's 2026 fraud monitoring rule.

How online checkout replaces the paper ACH form#

On a WordPress site, the "form" becomes three steps inside the checkout, each leaving a record.

1. The customer links the account. Plaid Link opens and the customer logs in to their bank. This both authenticates them and validates the account, so you never handle their bank password and usually never see the full account number.
2. The customer reads and accepts the authorization. The wording appears next to the Pay button, filled in with the amount, date, bank name and last four digits, and a required checkbox records consent.
3. The business records and confirms. The site stores the wording, the time and the order, sends the customer a copy (the order confirmation email is the natural place), and creates the debit.

How BankBridge records the authorization#

BankBridge builds this flow into WooCommerce checkout, MemberPress signups and its payment forms. Here is what it does, based on the plugin's settings and code:

BankBridge's default wording reads: "By submitting this payment, I authorize {site} to electronically debit my account ending in {mask} at {institution} for {amount} on {date}. I understand this authorization will remain in effect until the transaction is complete, and that I may revoke it by contacting {site} at least 3 business days before the debit." Review it with your bank, adjust it for recurring plans, and include the accepted wording in your order confirmation email so the customer has a copy.

You can try the checkout, including the authorization box, on the live demo, read the WooCommerce setup doc and the MemberPress doc, or buy BankBridge. Plaid bills its own fees on your Plaid account.

Vendor ACH authorization forms: the other direction#

A "vendor ACH form" usually means the opposite flow: a supplier gives you its bank details so you can pay it by ACH credit. That form collects the vendor's legal name, tax ID if your accounts payable process needs it, bank name, routing and account number, account type, a remittance email, and a signature from someone authorized at the vendor. The consumer debit rules above do not apply to paying a vendor, but fraud risk does: change-of-bank-details requests are a classic business email compromise trick. Confirm any new or changed vendor bank details by calling a number you already have on file, not one in the email.

Common mistakes with ACH authorization forms#

1. No revocation method on a recurring form, or one that is hard to use.
2. A statement name customers do not recognize, which turns into "I never authorized this" claims.
3. Changing the amount without notice when the authorization named a fixed amount.
4. Keeping only a screenshot of the wording instead of the full record.
5. Deleting records when a customer cancels, when the two-year clock only starts then.
6. Debiting again after an R07, R08 or R10 return without a new authorization.
7. Skipping account validation for the first online debit to a new account.

Related: ACH payments for membership sites, how to accept ACH payments in WooCommerce and Same Day ACH cutoff times.

This guide is general information, not legal advice. Plaid is a trademark of Plaid Inc. BankBridge is an independent plugin and is not affiliated with or endorsed by Plaid. Nacha, Stripe and WooCommerce are trademarks of their owners; BankBridge is not affiliated with or endorsed by any of them.