New look, same great product! HelloSign is now Dropbox Sign.
Your customer has agreed to recurring ACH payments. Before you take the first debit, you need to collect their authorization. The ACH authorization form you need depends on whether the money is coming from a consumer or business account.
Regulation E covers recurring debits from consumer accounts used mainly for personal, family, or household purposes. Its consumer-account rules generally don’t cover business accounts. Nacha rules and requirements from your bank or payment processor may still apply to both account types.
This guide helps you work out which rules apply, what the form needs to say, and how to collect authorization electronically.
Disclaimer: This information is intended for general purposes only. It isn’t legal advice and shouldn’t replace counsel from a licensed attorney.
Key takeaways
- Check the account first: Regulation E covers recurring debits from consumer accounts, not business accounts. Nacha rules and requirements from your bank or payment processor may apply to both account types.
- You can collect authorization electronically: An electronic record and signature can meet Regulation E’s requirements when you follow the E-SIGN rules. The process should show who authorized the payments and that they agreed.
- Make the authorization easy to understand: The customer should be able to identify the authorization and understand its terms without searching through unrelated information.
- Plan for changing payment amounts: You may need to give the customer written notice at least 10 days before a payment changes unless an allowed range or variation has been agreed on.
- Give the customer a copy: The business collecting the authorization is responsible for obtaining it and providing a copy to the customer.
Which ACH authorization form do you need?
Start with the account, not the form’s title. Under Regulation E, a consumer is a natural person and a covered account is held primarily for personal, family, or household use. A company operating account doesn’t fit that definition.
The table below compares Regulation E’s requirements only. Separate Nacha rules, agreements, and other laws may apply to business payments.
Business ACH payments still have rules. Public ACH guidance from Nacha says the business partners need an agreement and must be bound to the Nacha Operating Rules. Your bank or processor may add requirements through its ACH origination agreement.
The rest of this guide focuses on recurring consumer debits. Regulation E contains exemptions and transaction-specific provisions, so confirm that it covers your payment flow.
How to create an ACH authorization form
Regulation E doesn’t provide a required federal ACH authorization form. Its official interpretation gives a standard instead:
“An authorization is valid if it is readily identifiable as such and the terms of the preauthorized transfer are clear and readily understandable.”
If the authorization appears within another document, it needs to stand out from the surrounding terms. The consumer should be able to identify it and understand the amount, timing, and duration of the payments without searching through unrelated information.
A practical recurring-payment form will usually include the information below. These are common drafting elements, not a complete list of terms required by Regulation E:
- The parties: The consumer’s name and the legal name of the business initiating the debit.
- The account: The bank name, routing number, account number, and account type.
- The payment terms: The amount or method used to calculate it, along with the payment schedule.
- The duration: The first payment date and when the authorization ends.
- Revocation instructions: How the consumer can cancel the authorization and how much notice to provide.
- Approval: The consumer’s signature (or other authentication) and the authorization date.
The person collecting the authorization must also give the consumer a copy, electronically or on paper. Making a copy available only if the consumer asks for one isn’t enough.
What does an ACH authorization look like?
This simplified sample ACH authorization form is for recurring debits from covered consumer accounts. It isn’t a ready-to-use legal document. Adapt it to your payment channel and have your originating bank or payment processor and counsel review it.
SAMPLE RECURRING ACH DEBIT AUTHORIZATION
I authorize [Payee legal name] to initiate recurring ACH debit entries to the account identified below. I also authorize the financial institution named below to debit that account according to the terms of this authorization.
Account holder name: [full name]
Financial institution: [bank name]
Routing number: [9-digit routing number]
Account number: [account number]
Account type: ☐ Checking ☐ Savings
Amount: [fixed amount or method used to calculate a variable amount]
Frequency and expected debit date: [schedule]
First debit date: [date]
Duration: [end date, number of payments, or until revoked]
Variable payments, if applicable
I understand that I have the right to receive written notice of the amount and date at least 10 days before each payment that varies. I choose:
☐ Notice of every varying payment
☐ Notice only when the payment falls outside [specified range]
☐ Notice only when the payment differs from the previous payment by more than [agreed amount]
(If offering a range, use one the consumer could reasonably anticipate.)
Revocation
I may revoke this authorization by contacting [Payee legal name] at [contact information] using [method]. To stop the next scheduled debit, [Payee legal name] must receive my revocation by [deadline established under the applicable process].
This revocation process is separate from my right to stop payment through my financial institution.
I understand that I will receive a copy of this authorization.
_______________________
[Signature or other authentication], [printed name]
Date: [date]
DISCLAIMER: These documents are provided to users as a starting point for convenience. Using a template isn’t a substitute for legal advice from a licensed attorney, and the information contained in the document therefore shouldn’t be construed as legal advice. Because the law differs in each legal jurisdiction and may be interpreted or applied differently depending on your location or situation, you shouldn’t rely on the materials provided here without first consulting an attorney about your specific situation. Dropbox Sign doesn’t make any representation as to the legal enforceability or effectiveness of any templates, or the resulting documents created using them.
Can you collect an ACH authorization electronically?
Yes. Section 1005.10(b) says recurring debits from a covered consumer account must be authorized in writing and signed or similarly authenticated by the consumer. Its official interpretation says the authorization can be electronic when the E-SIGN Act requirements are met.
In practice:
- The consumer must authorize the payments: A business can’t sign the authorization for the consumer based only on oral approval.
- The process should identify the consumer: It should connect the consumer to the authorization and show that they agreed to its terms.
- The consumer must receive a copy: You can provide the copy electronically or on paper.
- Different electronic methods can work: The official interpretation gives digital signatures and security codes as examples, but they aren’t the only options.
Meeting the E-SIGN Act requirements can satisfy Regulation E’s writing and signature requirements. You still need clear authorization terms, the consumer’s agreement, a copy for the consumer, and any additional steps required for the payment channel.
For a practical comparison of signing methods, see the types of electronic signatures.
Do recurring and one-time debits follow different rules?
Yes. Regulation E calls a payment approved ahead of time and scheduled to repeat at somewhat regular intervals a preauthorized electronic fund transfer. For recurring debits from a covered consumer account, the consumer must authorize the payments in writing, either with a signature or an electronic method that meets the rules described above. The business collecting the authorization must give the consumer a copy.
A one-time debit requires a separate look at how the payment is authorized. When a business uses information from a consumer’s check to create a one-time electronic transfer, Section 1005.3(b)(2) requires notice and authorization for each transfer. At a point of sale, the business must display the notice prominently and give the consumer a copy.
Other one-time ACH debits may follow different Nacha authorization requirements depending on how the authorization is collected. Ask your originating bank or payment processor to confirm the Standard Entry Class code and the process you need to follow.
What if your debit amount varies?
If the amount of a covered recurring debit changes, Regulation E generally requires the payee or financial institution to tell the consumer the new amount and payment date in writing at least 10 days before the payment is scheduled.
The consumer can choose a different notice arrangement. After being informed of their right to notice for every varying payment, they may agree to receive notice only when:
- The payment falls outside a specified range
- The payment differs from the previous one by more than an agreed amount
Any range you use must be realistic enough for the consumer to anticipate. The Consumer Financial Protection Bureau's (CFPB) official interpretation gives the example of a gas bill, where the range could reflect typical winter and summer charges.
Adding a range to the form isn’t enough by itself. Explain the consumer’s right to receive notice of every varying payment and record the option they choose.
Changes to the payment date follow a separate rule. Public guidance from Nacha says its rules require seven calendar days’ notice when the debit date changes for either a consumer or corporate payment.
Can you require ACH autopay?
Usually not when the payments are used to repay consumer credit. Regulation E generally prevents a creditor from making recurring electronic payments a condition of receiving credit.
There are limited exceptions, including certain overdraft credit plans and credit used to maintain a minimum account balance. A creditor may also offer a lower rate or another cost-related incentive for choosing automatic payments, as long as it also offers an option that doesn’t require them.
This restriction applies specifically to consumer credit. Other payment arrangements may follow different rules. Before requiring autopay or connecting it to pricing, have counsel review the proposed terms.
How do revocation and stop payment differ?
Revocation and stop payment are two different actions.
- Revocation: The consumer tells the business that it no longer has permission to take future payments. The authorization should explain how to revoke, whom to contact, and how much notice the business needs. Public guidance from Nacha says recurring consumer debit authorizations must include instructions for revoking authorization.
- Stop payment: The consumer tells their bank or other financial institution not to process a scheduled payment. Under Regulation E, the consumer can make this request orally or in writing at least three business days before the payment is scheduled.
The financial institution may ask the consumer to confirm an oral stop-payment request in writing within 14 days. If it does, it must explain that requirement and provide the address where the confirmation should be sent. The oral request stops being binding after 14 days if the consumer doesn’t provide the requested confirmation.
Revoking authorization addresses the business’s permission to take future payments. A stop-payment request addresses the financial institution’s handling of a scheduled payment. Consumers may need to contact both, depending on what they want to stop.
Who’s responsible for obtaining ACH authorization?
The business or other payee collecting a recurring consumer debit authorization is responsible for obtaining it and giving the consumer a copy. Regulation E makes these requirements apply to any person collecting the authorization, not only to financial institutions.
The CFPB’s official interpretation is clear about this distinction. If a third-party payee fails to obtain the required authorization or provide a copy, the payee violates that rule. The consumer’s bank doesn’t violate the same rule merely because the payee failed to meet its obligation.
This addresses responsibility for obtaining the authorization and providing a copy. It doesn’t determine who’s responsible for every type of payment error or dispute.
Your bank or payment processor may also ask for proof that the consumer authorized the debit. Nacha states that an originator must be able to provide proof of authorization to its originating bank on request.
Send ACH authorization forms with Dropbox Sign
If you collect the same type of authorization from each new customer, you can create an ACH authorization form template with Dropbox Sign templates and reuse it for later requests. You can pre-fill information you already have, send the form for signature, and see which requests have been completed—and which still need attention.
Automated reminders can reduce manual follow-up. If you need to send a form to a larger group, Bulk Send can create an individual signature request for each recipient in a single workflow, depending on your plan. See the Dropbox Sign Bulk Send guide for details.
Dropbox Sign helps you prepare, send, and track the forms. It doesn’t determine whether their content or your payment process meets Regulation E, Nacha rules, state law, or the requirements of your bank or payment processor. Confirm those requirements separately.
Questions fréquentes
What is an ACH authorization form?
ACH stands for Automated Clearing House. An ACH authorization form records an account holder’s permission for an organization to initiate one or more ACH payments under stated terms. A recurring debit from a covered consumer account generally requires a written or electronic authorization from the consumer.
How do I get an ACH authorization form?
Ask your bank or payment processor first. If it provides a form or requires particular language, follow the instructions. If it doesn’t, treat the sample above as a starting point and have the form reviewed for your account type and payment channel.
Who fills out an ACH authorization form?
The business usually prepares the form. The account holder reviews the terms, enters any requested account or payment details, and signs or electronically authenticates the authorization. When Regulation E applies, the person collecting the authorization must give the consumer a copy.
What is a bank-issued ACH authorization form?
It’s a form supplied by a bank or payment processor for use with its ACH service. Before using a generic ACH authorization form, instead ask whether the supplied form is required or whether your authorization must include particular language.
How long does a business need to keep an ACH authorization?
Regulation E generally requires evidence of compliance to be kept for at least two years from the date a required disclosure or action occurs. Published guidance from Nacha says a recurring authorization must be kept for two years after it ends or is revoked and provided to the originating bank on request.
Another law, payment rule, or bank agreement may require you to keep it longer.
Can a business collect an ACH authorization by phone?
In some cases. A CFPB compliance bulletin says a recorded oral authorization or a code entered through a telephone keypad may satisfy Regulation E when the method meets E-SIGN requirements and the consumer intends to sign the record.
You must still give the consumer a copy of the authorization terms. Nacha also has requirements for telephone and other oral authorizations, and state call-recording laws may apply. Confirm the process with your originating bank and counsel before using it.
Ready to experience the difference?
Restez informé
Thank you!
Thank you for subscribing!
