What is the ACH Network
Automated Clearing House (ACH) refers to the nationwide, batch-oriented electronic funds transfer system. The system moves large volumes of transactions between participating financial institutions. ACH rules and regulations are established by the National Automated Clearing House Association (NACHA) and the Federal Reserve Bank’s ACH operating circulars.
How it Works
- Receiver authorizes the ACH payment via ACH authorization form
- Originator (your company) prepares the ACH file
- VisionBank (ODFI) reviews and sends file to ACH Operator
- ACH Operator sends file to RDFI
- RDFI processes and funds are debited or credited to receiver
What are the requirements and responsibilities of an originator (your company)?
New Rule effective 2026 - Originators will have to add Payroll or Purchase in the ACH description field before an ACH file is created.
Keep on file an ACH authorization form including the following information for two year after termination or revoked authorization. The form should be kept in a secure location. VisionBank may ask for a copy of the authorization form during their annual audit.
Information to include on the Authorization Form
- "I (employee or vendor) authorize (your company) to debit my account."
- Financial Institution Name
- Financial Institution ABA/Routing Number
- Name on the Account
- Type of Account
- Receiver’s account number
- Revoked requirements
Direct Deposit Authorization are not required by NACHA. VisionBank recommends your company to collect a Direct Deposit Authorization form to make debit entries in the event of an error to a receiver.
Best Practices for accepting Direct Deposit Forms
- Collet a voided check to ensure the proper information is provided
- Emailed Direct Deposit forms should be verified by speaking with the employee
VisionBank will send Notification of Change to your company when received. Per NACHA guidelines, VisionBank must provide the updated information to you within 2 banking days; as the company you are required to make the change to your ACH file within 6 banking days of the notification or prior to initiating another entry to the receiver’s account, whichever is later.
Common Notification of Change Codes
- C01 - Incorrect Account Number or formatted incorrectly
- C02 - Incorrect Routing Number due to merger or consolidation
- C05 - Incorrect Transaction Code; ACH file being sent as a checking account code should be savings account code or vice versa
- C06 - Incorrect Account Number ad Transaction Code
Your company must comply with Office of Foreign Assets Control (OFAC) requirements by checking payees against the OFAC report.
- Your company can find further information and review the OFAC report at sanctionssearch.ofac.treas.gov.
VisionBank will set an exposure limit to best fit your company’s ACH activity. Your company is responsible for communicating ACH limit increase requests with VisionBank.
Standard Entry Class (SEC) Codes— SEC Codes are payment types used by Originators to identify ACH credits or debits.
Commonly used SEC Codes:
- Prearranged Payment or Deposit (PPD) is used for a credit or debit to a consumer’s account. PPD is mostly used to send payroll or direct payments to/from a consumer account.
- NACHA requires your company to collect an ACH authorization form.
- Corporate Credit or Debit (CCD) is used for a credit or debit sent to a corporate account.
- NACHA doesn't define an agreement, VisionBank recommends an ACH authorization form is collected by the receiving company.
ACH Return—A return that the RDFI is unable to post for a reason defined by NACHA. RDFI is required to initiate the return in time for VisionBank to receive it by opening of business on the second business day following the settlement date of the original entry. To find the full list of Return Codes you may visit https://www.nacha.org.
Commonly used Return Codes:
- R01 - Insufficient Funds
- R02 - Account Closed
- R03 - No Account/Unable to Locate
- R04 - Invalid Account Number Structure
- R07 - Authorization Revoked by Customer
- R08 - Payment Stopped
- R09 - Uncollected Funds
- R16 - Account Frozen/Entry Returned Per OFAC Instructions
- R20 - Non Transaction Account
- R24 - Duplicate Entry
Corporate Account Takeover (CATO) - CATO occurs when cyber thieves gain control of systems by stealing sensitive employee credentials and information.
Best Practices to avoid CATO:
- Always lock your computer when unattended
- Educate employees about phishing emails, don’t click on any unknown links within an email, and suspicious websites
- If your company sends ACH files or Wires, use dual controls if available
Third Party Processors— customers who process ACH files for multiple different companies
- Must complete a comprehensive risk assessment of each Originator prior to originating Entries
- VisionBank will require evidence of an annual ACH audit performed by the Third Party Sender ensuring compliance with Rules
Glossary
- Exposure Limit - is the maximum dollar threshold for credits/debits VisionBank will accept from your company. VisionBank is set to give company single day exposure limits.
- Notification of Change (NOC) - is a non-monetary entry transmitted by an RDFI to identify incorrect information and will provide the corrected information.
- Office of Foreign Assets Control - enforces economic sanctions programs primarily against countries and groups of individuals, such as terrorists and narcotics traffickers.
- Originator - a person or company that has authorized an ODFI to transmit a credit or debit ACH file to a receiver at a RDFI.
- Originating Depository Financial Institution (ODFI) - participating financial institution who directly or indirectly send ACH files to an ACH Operator.
- Phishing Emails - a fraudulent email that appears to be from a legitimate source to gain access to personal information.
- Receiver - a person or company that has authorized an Originator to initiate a credit or debit entry to their account at the RDFI.
- Receiving Depository Financial Institution (RDFI) - participating financial institution who directly or indirectly receives ACH files from an ACH Operator.
- Third Party Processor - a company that facilitates bank - to - bank payments and/or direct deposits through the Automated Clearing House (ACH). Acing as the middleman between your customers, your business and the banks.
