Free ACH authorization form template

What an ACH authorization form is

It is the customer's permission for you to pull money straight from their checking or savings account through the ACH network, once or on a schedule. It names who agreed, the amount or how it is worked out, when the debits run, and how to stop them. Nacha, which writes the network's rules, says those rules ask for certain pieces of information but “do not require that the authorization contain specific language or be in any particular format.” So a plain form works, as long as nothing is missing.

Taking a card instead of a bank account? Different rules and a different template: the credit card authorization form prints blank card fields and leaves out the security code, and the hotel credit card authorization form covers deposits and incidentals for a stay.

How to use it: the life of one form

1. TodayFill in your side above: personal or business account, one-time or recurring, the amount wording and how the customer revokes it. Print it or save it as a PDF.
2. At signingThe customer writes the bank name, routing number and account number, checks that the name matches the bank account, signs and dates. Give them a copy.
3. Before the first debitEnter the account with your bank or payment provider, then file the signed form somewhere locked.
4. Each debitIf the amount varies and the customer did not agree to a range, tell them the amount and date before the debit, as the form promises.
5. When it endsThe customer revokes it the way the form says, or the last debit runs. Stop the debits and note the date on the form.
6. Two years onNacha's two-year keeping period has run. Unless another rule or your own policy says keep it longer, cross-cut shred it.

Worked example

A bookkeeper and a contractor, run through the generator. The bookkeeper bills a different amount each month, so the form promises notice before each debit instead of stating a figure. The contractor leaves the amount blank and writes it in at signing; the generator never fills in a price for you.

Both forms print the routing and account lines blank and a “keep until” line for your office. Neither names a returned-payment fee: if you charge one, add it under Other terms in your own words.

What Nacha asks a debit authorization to hold

Nacha's paper on proving authorization lists the information an authorization should include. The generator checks the same list in its result:

• Authorization wordingYou state it
• AmountYou state it
• Frequency and first dateYou state it
• Account numberCustomer writes it
• Routing numberCustomer writes it
• How to revokeYou state it

Source: Nacha, WEB Proof of Authorization Industry Practices (2022), p. 3. Revocation language is listed “for recurring payments or payments scheduled in advance.”

Since Nacha's Meaningful Modernization rule (effective September 17, 2021), “only consumer debit authorizations require a writing that is signed or similarly authenticated,” and every authorization must be “readily identifiable” with “clear and readily understandable terms.” That is why the form carries its own title and plain sentences instead of fine print. The same rule's own example pairs a paper authorization with the PPD code and an online one with WEB, and Nacha's WEB paper adds identity checks for online debits; your bank sets the code up with you.

Varying amounts: Nacha's business FAQ says that when a recurring amount changes, “you are required to notify the customer before the scheduled payment date or a dollar range can be specified in the enrollment process, and the customer can waive the notification.” The generator's “Each invoice” and “Within a range” options print those routes. Nacha's WEB paper also notes that federal Regulation E governs consumer WEB debits alongside its rules; ask your bank or counsel how it applies to yours.

How long to keep the signed form

Under Nacha Rule 2.3.2.7, the business initiating the debits must keep “the original or a copy of each written authorization” for “two years from the termination or revocation of the authorization” and be able to hand it to its bank on request. The clock starts when the authorization ends, not when it was signed: a monthly plan that runs for five years means about seven years in the drawer.

Source: Nacha, WEB Proof of Authorization Industry Practices (2022), p. 4.

ACH forms and PCI DSS

PCI DSS is the payment card industry's standard, and what it protects is card account data: in the Council's glossary, account data is cardholder data and/or sensitive authentication data, and the PAN is the “primary account number,” the card number that identifies the issuer and the cardholder account. A routing and account number written on this form is not a card number. Bank details for ACH sit under Nacha's rules instead.

Nacha and PCI DSS meet at one point. Nacha's data security rule makes larger originators render stored account numbers unreadable, and its FAQ says full use of a PCI DSS method for data at rest “would be deemed commercially reasonable,” while also stating that “this Rules requirement does not incorporate the PCI DSS standards by reference.” So PCI methods (encryption, truncation, tokenization) are a sound way to protect bank numbers, but the rules an ACH form answers to are Nacha's. If the same desk also takes card details, the card side still follows PCI DSS: map your PCI scope and check what you may store from a card.

Handling the paper form

• Get it back by hand or by mail. A photo by email or text puts the account number in an inbox or a camera roll.
• Scanning changes the rules. Nacha's unreadable-at-rest rule does not apply to paper, but it does apply “if these paper authorizations or other documents containing ACH account numbers are scanned.” The rule binds originators above 2 million ACH payments a year; below that, Nacha “strongly encourages” the same practice.
• Lock the file and limit who opens it. Nacha says access controls alone do not make stored data unreadable, and that a full account number someone needs for service work must still be limited to authorized staff.
• Shred when the keeping period ends. For paper with card data PCI DSS Req. 9.4.6 says “cross-cut shredded, incinerated, or pulped”; the same standard is a sensible bar for bank details.