What is an ACH debit?
An ACH debit is a pull payment that allows a business or individual to withdraw funds directly from a payer's bank account via the ACH network, with the payer's prior authorization. The payee initiates the transaction; the payer does not need to take any action once authorization is in place.
ACH debits are also called direct debits, ACH pulls, or eChecks. They are the standard mechanism for recurring collections in the US: utility bills, loan repayments, insurance premiums, SaaS subscriptions, and B2B invoice collections.
How does an ACH debit work?
An ACH debit follows a defined sequence involving the payer, the originator, two financial institutions, and the ACH network.
- The payer authorizes the originator to debit their account, specifying the account details, amount, and timing
- The originator submits a debit instruction to their bank, the ODFI, which formats it as an ACH entry
- The ODFI submits the file to the ACH network, which routes it to the payer's bank, the RDFI
- The RDFI processes the debit against the payer's account and settles funds to the ODFI
- The ODFI credits the originator's account
Standard settlement takes 1-3 business days. Same Day ACH is available for debits up to $1 million per transaction. NACHA estimates 80% of all ACH payments settle in one banking day or less.
What authorization is required for an ACH debit?
Authorization is mandatory for every ACH debit. NACHA rules require the originator to obtain and retain the payer's authorization before initiating any debit.
Authorization can be:
- Written: A signed paper or electronic form for recurring debits
- Electronic (WEB): An online authorization for internet-initiated transactions, which requires additional account validation
- Verbal (TEL): A telephone authorization for one-time or recurring debits, which requires a recording or written notice to be sent
The authorization must specify who can pull funds, from which account, under what conditions, and for what amount and timing. Originators must retain authorization records for two years after revocation. Debiting an account without proper authorization is an NACHA rules violation and triggers unauthorized return codes.
What are the main ACH debit SEC codes?
ACH debit entries are classified by Standard Entry Class (SEC) codes that identify how the authorization was obtained. The most common are:
The SEC code determines which NACHA rules apply, including return timeframes and authorization requirements.
What is the difference between an ACH debit and an ACH credit?
ACH debits and ACH credits move money in opposite directions and are initiated by different parties.
What happens when an ACH debit is returned?
If the payer's bank cannot process a debit, it sends a return entry to the originating bank with a standardized reason code. Common reasons include insufficient funds (R01), account closed (R02), or a claim that the debit was unauthorized (R07 or R10).
Returns must arrive within 2 banking days for most reason codes. Consumer unauthorized debits carry a 60-calendar-day return window, which is the most consequential return type for originators.
NACHA enforces three return rate thresholds that originators must stay within:
- Overall return rate below 15%
- Administrative returns (R02, R03, R04) below 3%
- Unauthorized returns (R05, R07, R10, R29, R51) below 0.5%
Exceeding the unauthorized threshold is a serious compliance issue that can result in the ODFI restricting origination privileges. See the full ACH return codes and ACH payment returns entries for a complete breakdown.
How do ACH debits relate to eChecks?
An eCheck is a consumer-facing term for an ACH debit. The underlying transaction is identical: a pull payment processed through the ACH network. The term eCheck is most common in billing and SMB contexts. In payment infrastructure, API documentation, and B2B settings, the same transaction is called an ACH debit.
