What is an ACH authorization?

What is an ACH authorization?

It is the customer's consent for a business to pull money from their bank account by ACH. Stripe calls it a mandate. When a customer gives their bank details, they "authorize your business to debit their account under the agreed terms."

What does Regulation E require for recurring debits?

Regulation E covers electronic fund transfers to and from consumer accounts. It defines a preauthorized electronic fund transfer as one "authorized in advance to recur at substantially regular intervals." A payment plan that debits a customer's account every month fits that description.

Section 1005.10(b) says these transfers "may be authorized only by a writing signed or similarly authenticated by the consumer," and "the person that obtains the authorization shall provide a copy to the consumer."

The CFPB's official interpretation adds:

• Electronic is fine. "Similarly authenticated" lets a signed authorization be given electronically, and complying with the E-Sign Act (15 U.S.C. 7001 et seq.) meets the writing and signature rules.
• The consumer has to sign. A payee can't sign on the consumer's behalf after only an oral authorization.
• The terms must be clear. An authorization is valid if it is "readily identifiable as such and the terms of the preauthorized transfer are clear and readily understandable."
• The payee carries the duty. If a third-party payee fails to get the authorization in writing or fails to give a copy, it is the payee that violates the rule, not the bank.

What if a payment amount changes?

Section 1005.10(d) applies when a debit will vary from the previous one under the same authorization, or from the authorized amount. The payee or the bank must send written notice of the amount and date at least 10 days before the debit. The consumer can instead choose to be told only when a debit falls outside an agreed range.

On a plan, this matters when you change an installment. A schedule of $1,108.33 a month with a last payment of $1,108.37 is set out in the authorization. A later change to the amounts is a varying debit. See Changing a payment plan after it starts.

Can a customer stop a debit?

Yes. Under 1005.10(c), a consumer can stop a preauthorized debit by telling their bank, orally or in writing, at least three business days before the scheduled date. The bank may ask for written confirmation within 14 days of an oral notice. If the consumer tells the bank that the authorization is revoked, the bank must block future debits from that payee. Stripe's docs say customers can also revoke a mandate by contacting the business directly, and a debit after a canceled mandate will fail.

What does Stripe add on top?

Stripe's ACH docs say that to comply with Nacha rules, you must give each customer an electronic or paper copy of the mandate. Stripe emails it by default when the customer gives a billing email. If you build your own payment form, you must show the mandate wording before confirming the payment. For recurring debits, Stripe says you must disclose how amounts are calculated or a range the customer can expect, and give at least 7 calendar days' notice if you change the timing.

What does a missing authorization cost?

A debit without valid authorization can be disputed. A consumer can dispute an ACH debit for up to 60 calendar days, and the dispute is final. See ACH dispute.

General information, not legal advice.