Reference guide

ACH authorization form, line by line.

What a debit authorization must say, by SEC code, with sample wording and records.

Updated October 25, 2026 · 7 primary sources

The short answer

Nacha requires authorization for every ACH debit, but no set wording or format.
Consumer debits need written or similarly authenticated consent; phone debits use a recording or notice.
Keep each authorization two years after it ends, and produce it on request.

The six pieces

What every authorization should include

Nacha's list for an ACH debit authorization form; the Rules set no exact wording.

Piece	What it covers	Example
Authorization language	Express permission to debit the account	I authorize Company A to debit my account
Amount	Same each time, a range, or a stated basis	The amount on each monthly invoice
Date or frequency	When each debit will happen	On the first of each month
Account number	The consumer's account to be debited	Checking account ending 6789
Routing number	The consumer's bank's routing number	The nine-digit number for that bank
Revocation terms	How to cancel future or scheduled debits	Email us at least three days before a debit

By SEC code

SEC code	Used for	Authorization
PPD	Consumer debits arranged in advance	Writing signed or similarly authenticated
WEB	Consumer debits authorized online or by mobile	Similarly authenticated; account validated on first use
TEL	Consumer debits authorized by phone	Recording or written notice before settlement
CCD	Debits to business accounts	Agreement between the companies
CTX	Business debits with remittance addenda	Agreement between the companies

Recurring debits

Revocation: Recurring authorizations must say how to revoke future debits with the originator.
A copy: Regulation E: whoever obtains a preauthorized transfer authorization gives the consumer a copy.
Varying amounts: Regulation E: notice ten days before a transfer that differs from the last.
New dates: Nacha: seven calendar days' notice before changing a consumer debit's date.
Stop payment: A consumer may stop a preauthorized transfer at the bank three business days ahead.

Proof of authorization

Two years: Keep it two years from the authorization's termination or revocation (Rule 2.3.2.7).
Any durable form: The original, a copy, or a reproducible record of another form of authorization.
Online authorizations: Keep the authorization and a record of how it was linked to the consumer.
Screenshots alone fail: Nacha: a screenshot of the wording alone does not link the consumer to it.
Proof on request: The ODFI has 10 banking days to provide requested proof or accept the return.

Sample wording

An ACH authorization form template; the Rules require the information, not these words.

Piece	Sample wording
Authorization	I authorize [Company] to debit my account below.
Amount	[Amount] each time, or the amount on each invoice.
Date or frequency	On [date], then every [period] until I cancel.
Account	Routing [nine digits]; account [number]; checking or savings.
Revocation	I may cancel by telling [Company] [days] before a debit.
Signature	[Name], signed or accepted online on [date].

Questions

What is an ACH payment authorization form?: The record of a receiver's permission for an originator to debit their account.
Is there an official Nacha form?: No. Nacha requires certain information, not specific language or a particular format.
Can a customer authorize online?: Yes. Consumer debits may be similarly authenticated, as WEB debits are.
How long do I keep an authorization?: Two years from its termination or revocation, ready to produce on request.
Do ACH credits need authorization?: Nacha says credits should be properly authorized too, in writing for payroll.
What about business accounts?: CCD debits need an agreement between the companies, binding both to the Rules.

Sources

Primary sources only. Rules change, so check the date above.

After the cart

Thirty minutes with the people who build it.