ACH and eCheck processing in high-risk offers: the rules and what to compare

What ACH and eCheck processing mean

The ACH (Automated Clearing House) Network moves payments between US bank and credit union accounts. Nacha, the body that governs it, says these payments are also known as direct debit, EFT, electronic bank transfer and eCheck. In a merchant offer, “ACH processing” or “eCheck processing” usually means the same thing: your customer gives you their bank account details and authorises you to pull the payment from that account, instead of paying by card.

Nacha describes the path of an ACH debit in five roles. Nacha does not process payments itself, but every participant must follow its Operating Rules.

A provider that offers ACH processing to a merchant often sits between you and the originating bank, sending payments on your behalf. The federal bank guidance quoted below calls such a provider a payment processor or third-party sender.

Timing and limits

Nacha says the network is open for processing 23¼ hours every business day and settles payments four times a day, while the Federal Reserve’s settlement service is open. Settlement does not happen on weekends or federal holidays.

Nacha estimates that 80 percent of ACH payments settle in one banking day or less. Under its rules, an ACH debit cannot carry a settlement date more than one banking day in the future. Same Day ACH has a limit of $1 million per payment; a rule change raises it to $10 million on 17 September 2027.

Returned payments and the limits on them

A card payment can end in a chargeback; an ACH debit can come back as a return, for example because the account details are wrong, there are not enough funds, or the customer says they did not authorise it. Nacha’s rules set three measures of how often a business’s debits come back. Each is calculated over the preceding 60 days or two calendar months.

Scroll the table to see all columns.

Nacha’s own comparison shows how far these limits sit above normal activity: when it set them, the network-wide average was 0.03 percent for unauthorized debit returns, 0.33 percent for account-data errors and 1.42 percent for all debit returns (calendar year 2013).

The same rule restricts resubmitting a returned debit. A permitted resubmission must keep the same company name, company identifier and amount, and must carry the description “RETRY PYMT”. Resubmitting outside the circumstances the rules allow is prohibited.

Customer authorisation and fraud rules

For a consumer’s account, the federal rule is Regulation E. Under 12 CFR 1005.10, recurring transfers from a consumer’s account may be authorised only by a writing signed or similarly authenticated by the consumer, and whoever obtains the authorisation must give the consumer a copy. The consumer may stop a recurring payment by telling their bank at least three business days before it is due, and if an amount will differ from the previous one or from the authorised amount, written notice must be sent at least ten days before.

Where a paper check is used only as the source of account details for a one-time electronic transfer, Regulation E (12 CFR 1005.3) requires notice that the payment will or may be processed electronically and the consumer’s authorisation for each transfer.

Nacha’s rules add two fraud duties:

• Online-authorised debits: since 19 March 2021, the business must use a commercially reasonable fraud detection system that, at a minimum, validates that the account is open and can accept ACH entries the first time it is used or when it changes. Nacha names examples such as a prenotification, micro-entries or a validation service, and says some businesses may also need to verify who owns the account.
• Fraud monitoring: since 20 March 2026 for originators with 6 million or more ACH payments in 2023, and since 22 June 2026 for every other non-consumer originator and third-party sender, each must have risk-based processes reasonably intended to identify ACH payments initiated due to fraud, reviewed at least once a year.

Why high-risk businesses get extra scrutiny

ACH is not a way around card-network rules. A business that a card provider declines is still checked before it can take ACH payments: the federal guidance for banks expects due diligence on the processor and on each merchant it serves.

The FDIC’s guidance on payment processor relationships, revised in February 2026, says processors that serve telemarketing and online merchants may carry a higher risk profile. It asks banks to set thresholds for unauthorized returns, to obtain each merchant’s name, principal business activity, location and sales techniques, and to watch for rising returns, chargebacks and complaints. It also says the bank’s contracts with processors should allow immediate account closure and adequate reserves.

The OCC’s 2008 bulletin on payment processors adds that a bank should not accept high levels of returns because a processor has put up collateral, and notes that high levels of debits returned for insufficient funds can be an indication of fraud.

What to compare in an ACH or eCheck offer

When a provider proposes ACH or eCheck processing, ask for these terms in writing so offers can be compared on the same basis. Every answer is provider-declared until it is in your signed agreement.

Scroll the table to see all columns.

On Zolution, every proposal states its fees, reserve, settlement delay, payout schedule and conditions in the same fields, so you can set offers side by side; a provider can state its ACH or eCheck terms in its conditions and additional fees. Zolution is a free marketplace (Zolution Standard membership costs nothing); it processes no payments, holds no funds and approves nobody.

Questions, answered