ACH Debit

An ACH debit is an electronic transfer that pulls money out of a bank account. ACH stands for the Automated Clearing House, the US network banks use to move batches of payments. In lending, the lender (the "originator") sends a file through its bank asking the borrower's bank to move a set amount from the borrower's account to the lender's account on a set date.

The ACH network runs under the Nacha Operating Rules. Nacha is the organization that writes and enforces those rules. Several of them shape how lenders collect:

• Authorization. The lender needs the borrower's permission before debiting. For business accounts, debits usually use the CCD (Corporate Credit or Debit) entry type, under an agreement with the borrower. For consumer accounts, they use PPD (Prearranged Payment and Deposit), with written authorization for recurring debits.
• Timing. A debit settles in a day or two, and Same Day ACH can be faster. But the payment is not final at once. The borrower's bank can still return it for a set period.
• Returns. Common reasons include non-sufficient funds (code R01), a closed account (R02) and an unauthorized debit. A business can generally report an unauthorized debit within two banking days. A consumer generally has up to 60 days.

Why it matters for lenders

ACH debits cut collection costs and late payments, which is why term lenders, community development financial institutions (CDFIs) and merchant cash advance (MCA) funders rely on them. MCA funders often debit daily or weekly to collect the holdback.

They also bring duties. Nacha tracks return rates for each originator. As of 2026, the review levels are 0.5% for unauthorized returns, 3% for administrative returns (such as closed or invalid accounts) and 15% for all debit returns. Crossing them can trigger a review by Nacha and pressure from the lender's bank. Since June 19, 2026, Nacha also requires every business that originates ACH entries, regardless of volume, to have risk-based processes to detect fraudulent entries and to review them at least once a year.

How it works in practice

A CDFI collects most loan payments by ACH. At closing, each borrower signs an ACH authorization that is saved on the loan. Each morning, the servicing system builds the day's debit file from the loan records and sends it to the bank.

Two days later, a few payments come back. The system reverses the postings, flags each loan and opens a task: call the borrower for an ACH return (NSF), or stop debits and get new bank details for a closed account. Missed payments start the clock on delinquency.

When debit files are built by hand, a wrong amount or account goes out. Returns then pile up, and staff spend hours untangling them.