ACH payment controls are the policies, system checks, approval steps, and monitoring activities that help accounts payable teams send the right payment to the right vendor account at the right time.
The automated clearing house, or ACH, is one of the most widely used electronic payment networks in the United States. In 2025, the ACH Network processed 35.2 billion payments worth $93 trillion. Business-to-business payments accounted for 8.08 billion transactions and $63.11 trillion in value.
ACH payments are popular because they are efficient, suitable for recurring payments, and generally less expensive than other payment methods. Processing costs often range from $0.20 to $1.50 per transaction, and ACH is generally considered the least expensive electronic payment method for many high-value or recurring business payments. Actual pricing depends on the bank, payment provider, and whether the transaction uses Same Day ACH.
A strong ACH payment control framework combines account validation, segregation of duties, approval thresholds, payment holds, exception queues, fraud prevention, and post-settlement reconciliation. Teams looking to automate vendor account checks can explore Trustpair’s automated account validation solution.
Key Takeaways
• ACH payment controls should cover the full lifecycle, from vendor onboarding and bank detail changes through approval, settlement, returns, and reconciliation.
• ACH credits push funds to a vendor, while ACH debits pull funds from the company’s account. These payment types require different authorization and monitoring controls.
• A valid routing number does not prove that a bank account belongs to the intended vendor. Account ownership should be independently verified before the first payment and after banking detail changes.
• Recurring ACH payments can support vendor invoices, mortgage payments, insurance premiums, payroll direct deposit, and government benefits, but recurring activity requires ongoing monitoring.
• Unverified payees, unusual payment amounts, duplicate transactions, rejected files, and repeated return codes should enter named exception queues.
What Are ACH Payment Controls for US Accounts Payable Teams?
ACH payment controls are preventive and detective measures designed to reduce payment errors, unauthorized transactions, and vendor payment fraud.
For accounts payable teams, ACH controls should answer five questions before money leaves the company:
- Is the vendor legitimate?
- Does the bank account belong to that vendor?
- Is the payment supported by an approved invoice or payment instruction?
- Has the payment been reviewed and approved by the right people?
- Can the company prove what happened if the transaction is rejected, returned, disputed, or investigated?
ACH is well suited to recurring vendor payments because it supports high-volume, scheduled transactions between known counterparties. The network is also used for payroll direct deposit, mortgage payments, utility bills, insurance premiums, tax refunds, government benefits, and account-to-account transfers.
The Federal Reserve’s 2024 Business Payments Study found that ACH was used by 71% of surveyed businesses overall, while usage reached 77% among very large businesses. The study surveyed 2,000 US businesses across industries and company sizes.
Recurring ACH payments can create control weaknesses, however. Once a vendor and bank account have been approved, AP teams may assume that future payments are safe. That assumption can allow fraudulent account changes, unauthorized debits, duplicate payments, or unusual payment amounts to pass without sufficient review.
A complete ACH control framework should cover:
• Vendor onboarding and bank account validation
• Independent verification of changed payment details
• Invoice and purchase order matching
• Payment preparation and approval
• Approval thresholds
• Exception handling
• Payment holds
• Bank submission
• Return and reversal management
• Post-settlement reconciliation
How Does the Automated Clearing House Network Route Payment Files?
The automated clearing house, or ACH, is a batch-oriented electronic payment network that clears and settles transactions between participating financial institutions.
The ACH Network reaches US bank and credit union accounts and supports both ACH credit entries and ACH debit entries. ACH credit entries push funds into a receiving account, while ACH debit entries pull funds from a receiving account.
What Do the ODFI and RDFI Do?
The Originator is the company, person, or organization that initiates an ACH transaction. In a vendor payment, the buying company is usually the Originator of an ACH credit.
The Originating Depository Financial Institution, or ODFI, is the financial institution that receives payment instructions from the Originator and forwards the ACH entries to an ACH Operator. The ODFI may also perform file-level validation before transmitting the payment.
An ACH Operator receives files from an ODFI, sorts the transactions, routes them to the appropriate receiving institutions, and performs settlement functions. The two ACH Operators are the Federal Reserve and The Clearing House.
The Receiving Depository Financial Institution, or RDFI, receives ACH entries from an ACH Operator and posts them to the Receiver’s account.
For an ACH credit, the vendor is generally the Receiver because the vendor’s account receives the funds. For an ACH debit, the company whose account is being charged is the Receiver.
Understanding these roles helps AP and treasury teams assign responsibility when a payment file is rejected, a credit union account cannot be located, or an ACH transaction is returned.
How Do Automated Clearing House ACH Payments Work?
ACH credits and ACH debits use the same network but move funds in opposite directions.
How Do ACH Credit Entries Work?
An ACH credit is a payer-initiated push of funds from the Originator’s account to the Receiver’s account.
A typical vendor payment lifecycle is:
- AP approves an invoice or payment batch.
- A payment preparer creates the ACH file.
- An authorized approver reviews the file and payment details.
- The company submits the file to its ODFI or payment provider.
- The ACH Operator sorts and routes the entries.
- The vendor’s RDFI receives the entries and credits the vendor’s account.
- AP reconciles the bank report against the approved payment batch.
ACH credit entries are commonly used to pay vendors, fund payroll, issue tax refunds, and send government benefits. Payroll software can also create ACH files for payroll direct deposit, allowing employers to pay employees directly into their bank or credit union accounts.
How Do ACH Debit Entries Work?
An ACH debit is a creditor-initiated pull of funds from the company’s account.
A typical ACH debit lifecycle is:
- The company authorizes a vendor, service provider, or creditor to debit its account.
- The creditor submits the debit instruction through its ODFI.
- The ACH Operator routes the entry to the company’s RDFI.
- The company’s account is debited.
- The creditor’s account is credited.
- The company reviews the transaction against the authorization and expected amount.
ACH debit entries are common for recurring obligations such as mortgage payments, insurance premiums, subscriptions, loan payments, and utility bills.
ACH debits require careful authorization management because an external party initiates the withdrawal. The company should maintain approved creditor lists, debit limits, authorization records, and monitoring for unexpected amounts or frequencies.
What Is the Difference Between Standard ACH and Same Day ACH?
Standard ACH may settle on the same day, the next business day, or two business days later, depending on the transaction and processing arrangements. Nacha states that ACH debits generally settle on the same day or the next business day, while ACH credits may settle on the same day, the next business day, or in two business days.
Same Day ACH allows eligible credit and debit payments to settle within hours on the same business day. The current per-payment limit is $1 million. Nacha has approved an increase to $10 million effective September 17, 2027.
Same Day ACH can improve working capital and reduce payment delays, but faster settlement also reduces the time available to identify a fraudulent or incorrect payment instruction.
Which Controls Should Apply to ACH Credits and ACH Debits?
ACH credits and ACH debits should not be controlled identically because their initiation and authorization risks differ.
| Control area | ACH credits | ACH debits |
|---|---|---|
| Initiation | The company or AP team initiates the payment | A vendor or creditor initiates the withdrawal |
| Primary risk | Paying the wrong vendor account or wrong amount | Unauthorized, excessive, or unexpected withdrawals |
| Core control | Account validation and payment approval | Authorization and debit monitoring |
| Key review point | Before bank submission | Before authorization and during recurring activity |
| Escalation trigger | New vendor, changed account, unusual amount | New creditor, revoked authorization, unusual debit |
What Controls Should Apply to ACH Credits?
For each ACH credit, AP should confirm that the vendor is active and approved, the invoice or payment request is valid, and the bank account belongs to the intended vendor.
The payment should also match the approved vendor record, amount, due date, payment method, and purchase documentation. The system should identify duplicate payments and prevent a preparer from approving their own payment batch.
First-time payments, changed bank accounts, urgent requests, high-value payments, and Same Day ACH transactions should receive additional review.
What Controls Should Apply to ACH Debits?
For each ACH debit authorization, AP or treasury should confirm that the creditor is authorized to debit the company’s account and that the authorization identifies the relevant account, amount or calculation method, and frequency.
The debit should be consistent with the underlying contract or service agreement. The authorization should not be expired, revoked, or superseded, and the expected amount and frequency should remain within approved limits.
Recurring ACH debit authorizations should be reviewed periodically because the business relationship, amount, account, or service terms may change.
For a deeper explanation of approval stages and segregation of duties, see Trustpair’s payment approval process guide.
How Should AP Validate ACH Account and Routing Details?
ACH account validation should confirm more than whether a routing number and account number are formatted correctly.
What Should Routing Number Validation Include?
Routing number validation should confirm that the number has the correct format, passes its check-digit test, is active, and is eligible for ACH transactions.
AP teams should also confirm that the routing number is associated with the expected financial institution and that the account type and transaction code are appropriate.
A valid routing number only identifies a financial institution. It does not prove that the vendor owns the account or that the account is suitable for the payment.
How Should AP Verify Account Ownership?
Account ownership should be verified before the first ACH payment release. The verification process should confirm that the account is associated with the vendor’s legal name and, where relevant, its tax, registration, or business information.
When a vendor changes its routing number or account number, AP should treat the change as a new payment risk, even if the vendor is long established.
Independent confirmation should use a trusted source, such as a callback to a known vendor contact using an existing phone number, a validated vendor portal, a trusted bank or account validation service, or a previously approved contact outside the channel used to request the change.
AP should not rely solely on the email, phone number, or attachment included in a bank detail change request. If a vendor mailbox has been compromised, the attacker may control all three.
Nacha’s account validation requirement is specifically connected to WEB debits. For WEB debit entries, the Originator must use a commercially reasonable fraud detection system and validate the account number before first use and before an account number change.
That rule does not mean every B2B ACH credit is subject to the same specific account validation requirement. Nevertheless, validating vendor account ownership before releasing ACH credits is a strong fraud prevention control against payment diversion and vendor impersonation.
Each validation result should be documented in the vendor record, including the date and time, validation method, account and routing details reviewed, result, supporting evidence, and approval decision.
For additional guidance, see Trustpair’s ACH verification strategy.
What Should Happen When ACH Details Cannot Be Verified?
When ACH details cannot be verified, AP should place the payment on hold, assign the issue to a named reviewer, and block release until the validation issue is resolved.
When Should AP Place an ACH Payment Hold?
A hold is appropriate when the routing number is invalid, the account appears closed or inactive, account ownership cannot be confirmed, vendor information does not match bank information, or banking details changed shortly before a payment deadline.
A hold is also appropriate when the vendor cannot be reached through an independent channel, a required authorization is missing or expired, or the payment is associated with a known fraud indicator.
New vendor banking information should receive a secondary review. The second reviewer should examine the evidence independently rather than simply approving the first reviewer’s conclusion.
Acceptable release documentation may include independent callback notes, account validation results, vendor confirmation from a trusted contact, supporting onboarding documents, and written approval from an authorized treasury or finance leader.
An approved invoice is not sufficient evidence that the bank account belongs to the vendor. Because payment requests can originate from a compromised vendor mailbox, AP teams should independently verify every bank detail change and follow a documented process for spotting and stopping fraudulent vendor bank detail change requests.
How Should AP Manage ACH Exception Queues?
ACH exceptions should be routed into named queues with clear ownership, service-level targets, and escalation rules.
An invalid account queue should include invalid routing numbers, failed account validation, closed accounts, and mismatched account ownership.
A duplicate transaction queue should compare the vendor, invoice, amount, due date, account number, and payment reference against pending and recently released transactions.
A rejected file queue should include invalid file formats, incorrect control totals, missing fields, invalid dates, bank submission failures, and partial file rejections. Resubmission should require review to ensure that corrected entries do not duplicate payments that were already processed.
When Should ACH Payments Require Manual Review and Release Approval?
ACH payments should require manual review when their risk exceeds the company’s standard payment profile.
Common triggers include a new vendor, a first payment, a recently changed bank account, an unusual amount, a new payment frequency, an urgent or same-day request, a mismatch between vendor information and account ownership, a split payment designed to avoid an approval threshold, or repeated ACH return codes.
How Should the ACH Payment Release Workflow Work?
The release workflow should separate preparation, approval, submission, and reconciliation.
The preparer selects approved invoices, confirms vendor and payment data, reviews system warnings, resolves routine exceptions, and submits the batch for approval.
The approver reviews the batch independently, confirms high-risk attributes, verifies that holds and exceptions have been resolved, and approves or rejects the batch.
The bank submission stage sends the approved file to the ODFI or payment provider. System records should confirm when the file was submitted, accepted, rejected, or partially processed.
The final reconciliation stage compares bank reports with the approved payment population and identifies returned, missing, duplicated, or unexpected transactions.
High-risk ACH transfers should require dual approval. Risk thresholds may consider the payment amount, vendor risk rating, first-time payment status, banking detail changes, Same Day ACH selection, urgency, and unusual transaction patterns.
The audit trail should record the payment batch, preparer, approver, date and time, system checks, exceptions, evidence reviewed, decision, and subsequent changes.
What Should Emergency ACH Release Procedures Include?
Emergency procedures should not eliminate controls. If an urgent payment must be released, the company should require independent confirmation of the vendor’s bank details, approval from an authorized senior finance or treasury leader, and a documented explanation of the emergency.
A post-release review should be completed by someone outside the emergency approval chain.
What ACH Compliance and Operating Rules Should AP Consider?
ACH payment controls should align with the Nacha Operating Rules, the company’s ODFI requirements, applicable contracts, and relevant federal and state laws.
What Do the Nacha Operating Rules Cover?
The Nacha Operating Rules establish responsibilities for Originators, ODFIs, RDFIs, and other ACH Network participants. They address transaction processing, authorization, returns, reversals, data security, and risk management.
Nacha rules change over time, so AP and treasury teams should review current requirements with their ODFI and payment providers.
Does Regulation E Apply to ACH Payments?
Regulation E provides protections for electronic fund transfers involving consumer accounts. It addresses unauthorized electronic fund transfers, error resolution, and consumer liability.
Regulation E should not be treated as a complete control framework for B2B accounts payable. Many business accounts are outside its consumer-account scope, while commercial agreements, state law, bank agreements, and Nacha requirements may still apply.
How Long Should ACH Authorization Evidence Be Retained?
Organizations should retain authorization and approval evidence in a form that can be reproduced.
For certain consumer recurring or oral authorizations, Nacha guidance includes specific retention requirements, including two years from termination or revocation in certain circumstances.
For business ACH payments, AP should follow the company’s legal retention schedule, ODFI requirements, contractual obligations, and audit policy. A practical policy is to retain evidence for the entire vendor relationship and for the applicable period after the relationship ends.
How Should AP Manage ACH Returns, Reversals, and Reconciliation?
Returned ACH transactions should automatically enter an exception queue rather than being silently retried.
How Should AP Respond to ACH Return Codes?
Return codes should be mapped to specific corrective actions.
R02 indicates that the account is closed. AP should confirm the vendor’s current account independently before resending the payment.
R03 indicates that the account cannot be located. AP should confirm the account number, routing number, account status, and ownership.
R04 indicates an invalid account number. The payment file and vendor record should be reviewed before resubmission.
R07 indicates that authorization was revoked by the customer. Future debit activity should stop until a new authorization is obtained.
R10 indicates that a customer advises an unauthorized debit. The transaction should be escalated to treasury, the bank, and the relevant compliance or fraud team.
R29 indicates that a corporate customer advises that a debit was not authorized. The creditor’s authorization and related transactions should be investigated.
R28 indicates a routing number check-digit error. The routing number should be corrected and the payment file revalidated.
Return codes are examples rather than a complete code library. Each organization should maintain a current code-to-action matrix aligned with its ODFI and payment systems.
When Are ACH Reversals Permitted?
ACH reversals are not a general recovery tool. Nacha rules permit reversals for defined erroneous situations, including duplicate entries, incorrect receivers, incorrect dollar amounts, and certain incorrect settlement dates.
A reversing entry must generally be made available to the RDFI within five banking days of the erroneous entry’s settlement date.
A reversal should not be used to correct a payment that was merely inconvenient, improperly approved, insufficiently funded, or suspected to be fraudulent without meeting the applicable rule requirements.
How Should AP Reconcile ACH Transactions?
Reconciliation should compare bank reports against the approved ACH population using the batch identification, entry trace number, vendor name, account and routing details, payment amount, effective entry date, settlement status, and return or reversal status.
Unmatched items should remain open until resolved. Reconciliation should identify both missing payments and unexpected payments, including unauthorized ACH debits that were never included in the company’s approved payment population.
How Can AP Implement and Measure ACH Payment Controls?
Implementation should begin with an inventory of existing controls.
AP and treasury should document how vendors are onboarded, who can create or edit bank details, how account ownership is verified, who prepares payment files, who approves ACH batches, which thresholds trigger additional review, how holds are released, how bank submissions are confirmed, how returns are managed, and how reconciliation is completed.
Each control should have a named owner across AP, treasury, procurement, finance, IT, and risk functions.
Payment systems should enforce role-based access, segregation of duties, approval thresholds, vendor banking change workflows, duplicate detection, payment holds, exception routing, required evidence, and audit logging.
Controls should be tested against realistic payment scenarios, including a new vendor, a bank account change requested by email, a duplicate invoice, a Same Day ACH payment above the approval threshold, a rejected file, an unexpected recurring debit, and a payment prepared by an unauthorized user. These tests should also confirm that vendor records remain accurate and that bank detail changes follow the controls outlined in Trustpair’s vendor master file cleanup guide.
Which ACH Control Metrics Should AP Track?
Useful metrics include validated payee rate, ACH exception rate, payment hold resolution time, unauthorized ACH attempt volume, return rate by reason code, dual approval compliance, and reconciliation completion rate.
Validated payee rate measures the percentage of active ACH payees with verified bank details. ACH exception rate measures the percentage of ACH entries routed to an exception queue.
Payment hold resolution time measures the average time between a hold being placed and its documented resolution. Unauthorized ACH attempt volume tracks suspected or confirmed unauthorized debit attempts.
Return rate by reason code helps AP distinguish administrative errors from account, authorization, or fraud-related issues. Dual approval compliance measures whether high-risk ACH transfers received the required approvals. Reconciliation completion rate measures the percentage of ACH transactions reconciled within the company’s required period.
ACH Transfer Control Checklist
Before releasing an ACH payment, AP should confirm that:
- The payee has verified bank details.
- The routing number is valid and eligible for ACH transactions.
- Account ownership was confirmed before the first payment release.
- Changed bank details were independently verified.
- The payment has documented approval.
- The preparer and approver are different people.
- High-risk transfers received dual approval.
- Any payment hold has a named resolution owner.
- Duplicate transactions were reviewed.
- Any rejected, returned, or reversed transaction was reconciled and documented.