ACH Payments for Small Business in 2026: How They Work, What They Cost and the New Nacha Rules

If you pay staff by direct deposit, pay suppliers from your bank's bill-pay screen or let customers settle invoices by bank transfer, you're already using the ACH network. For small businesses it's the cheapest common way to move money electronically, often costing cents where a card payment costs dollars. It's also the network fraudsters target with fake invoices and payroll-change requests, which is why the rules governing it tightened in 2026. This guide explains how ACH works, how long payments take, what they cost, what happens when one is returned, and what the 2026 Nacha rule changes ask of your business.

Quick answer

ACH is the US bank-to-bank network, run under Nacha rules, that carries direct deposit, bill payments and business transfers. Most payments settle in one business day or less; Same Day ACH handles payments up to $1 million. Costs are usually cents to about $1.50 per payment (an estimate — banks set their own prices), far below card fees. New 2026 Nacha rules require every business originator to run risk-based fraud monitoring.

• ACH credit = you push money; ACH debit = you pull it with authorization

• Insufficient-funds returns come back within two banking days

• Consumer unauthorized-debit claims can come back up to 60 days after settlement

• Keep unauthorized returns under 0.5% of debits

• PAYROLL and PURCHASE entry descriptions required since March 20, 2026

How ACH payments work

ACH, short for Automated Clearing House, is a batch network: instead of sending each payment instantly, banks collect payments into files and exchange them at set times during the day. Nacha, the organization that governs the network, describes five participants in every payment.

The Originator is the business or person that starts the payment, such as an employer running payroll or a company collecting a monthly fee. The ODFI (Originating Depository Financial Institution) is the originator's bank, which bundles payments into files and sends them on. An ACH Operator, either the Federal Reserve's FedACH service or The Clearing House, sorts the payments and routes each to the right bank. The RDFI (Receiving Depository Financial Institution) is the receiver's bank, which posts the deposit or withdrawal. The Receiver is the person or business whose account is credited or debited.

An ACH payment from start to finish

Step 1

Originator authorizes payment

Step 2

ODFI batches and sends file

Step 3

ACH Operator (FedACH or The Clearing House) sorts

Step 4

RDFI posts credit or debit

Step 5

Receiver's account updated

same day to 2 banking days

There are two directions. An ACH credit pushes money out of the originator's account into the receiver's: payroll direct deposit, paying a vendor through online banking, or a customer paying your invoice from their bank. An ACH debit pulls money from the receiver's account into the originator's, based on the receiver's authorization: subscription billing, a gym membership, a utility auto-pay, or a supplier you've authorized to collect on invoice due dates. Nacha says credits and debits each make up roughly half of network volume.

Every ACH entry carries a Standard Entry Class (SEC) code that says what kind of payment it is. The ones small businesses meet most often are PPD for consumer payments authorized in writing (payroll and recurring bills), CCD for business-to-business payments, WEB for consumer debits authorized online, and TEL for consumer debits authorized by phone. The code determines what authorization you need and which return rules apply, so your bank or payments provider will ask how you collect authorization before enabling ACH debits.

If you invoice other businesses, the simplest way to start is to put your bank's routing and account number on the invoice for ACH credits, which costs you nothing to receive at many banks. Collecting by ACH debit takes more setup: a written or online authorization from each customer and an origination agreement with your bank or a payments platform that underwrites you much as a card processor would. Our invoice payment terms guide explains how to word the payment instructions.

How long ACH takes: standard and Same Day ACH

Nacha estimates that about 80% of ACH payments settle in one banking day or less. Debits must settle on the same day or the next banking day; credits can settle on the same day, the next banking day or in two banking days. Only the US Treasury can send credits settling further out. Weekends and federal holidays aren't banking days, so a payment sent on a Friday afternoon usually lands on Monday or Tuesday.

Same Day ACH lets eligible payments settle on the day they're sent if your bank submits them before its same-day cut-off. Nacha's rules cap each Same Day ACH payment at $1 million, a limit raised from $100,000 in 2022 and scheduled to rise to $10 million on September 17, 2027. The Federal Reserve's FedACH service runs several same-day settlement windows each business day, but your bank sets its own customer cut-off times, often earlier in the day, so ask for them in writing. Banks also pay each other a small per-payment fee for same-day processing, which is why Same Day ACH often costs you more than standard ACH.

A rule change on September 18, 2026 made standard ACH credits faster to reach receivers. Banks must now make funds from non-same-day ACH credits available by 9:00 a.m. local time on the settlement date, without the earlier condition that the bank had received the file by 5:00 p.m. the day before. For employees and suppliers, that means direct deposits sent on time are usable first thing on payday.

Nacha rule changes for 2026 and 2027

Mar 20, 2026

PAYROLL and PURCHASE Company Entry Descriptions required

Mar 20, 2026

Fraud monitoring Phase 1: all ODFIs, plus originators and third parties with 2023 ACH volume of 6 million+

Jun 22, 2026

Fraud monitoring Phase 2: all other business originators, third-party service providers and senders (June 19 was a holiday)

Sep 18, 2026

Standard ACH credits available by 9:00 a.m. on settlement date

Sep 17, 2027

Same Day ACH per-payment limit rises to $10 million

What ACH costs compared with cards and checks

Nacha doesn't set what banks charge their customers, so ACH pricing varies by bank and provider. As an estimate based on published business-banking and payments-platform price lists, originating an ACH payment typically costs from a few cents to around $1.50 per payment, sometimes with a monthly ACH module fee, and Same Day ACH a few dollars more. Some online platforms instead charge a small percentage per ACH payment with a dollar cap. Receiving an ACH credit is often free. Returned payments usually carry a fee per return.

Compare that with cards. On a $2,500 invoice paid with a business credit card, interchange alone on Visa's April 2026 schedule is 2.65%–3.00% + $0.10 for card-not-present business cards, before network fees and processor markup, so the all-in cost can easily exceed $75. The same invoice paid by ACH might cost you under a dollar. Paper checks also cost more than they look once you count printing, postage, the time spent depositing them and the risk of theft or alteration.

Worked example: moving B2B invoices from cards to ACH

A wholesale supplier issues about 100 invoices a month averaging $2,500, $250,000 in total. Today most customers pay by business credit card. Assume an all-in card cost of about 3.2% on those cards, an estimate built from Visa's business card interchange plus typical network and processor fees. That's roughly $8,000 a month.

If the supplier moves 80% of invoices to ACH, 80 invoices worth $200,000 go by bank transfer. At an estimated $1.00 per ACH payment received or collected, plus a $50 monthly ACH fee, the cost is $130. The 20 remaining card invoices, $50,000, still cost about $1,600. Total monthly payment costs fall from about $8,000 to about $1,730, saving around $6,270 a month, or more than $75,000 a year.

$250,000 a month in B2B invoices (estimates)

≈ $8,000

All by business card

≈ 3.2% all-in

≈ $1,730

80% ACH, 20% card

$130 ACH + $1,600 card

≈ $6,270

Monthly saving

≈ $75,000 a year

1 day

Typical ACH settlement

same day if sent Same Day ACH

There are trade-offs. Card payments arrive with a guarantee from the card network, while an ACH debit can be returned, so a supplier collecting by debit takes on some return risk. Many businesses handle that by asking customers to push ACH credits to them, which can't be returned for insufficient funds once received, and by offering a small early-payment or ACH discount to encourage the switch. The payment fee calculator lets you compare per-payment costs for your own invoice sizes.

Compare a card fee with a flat ACH fee on your average invoice

I chargeI want to receive

AmountPercentage FeeFixed Fee

Amount Charged₹1,000.00

Processing Fee₹29.30

Effective Fee Rate2.93%

You Receive₹970.70

Open the full Payment Processing Fee Calculator (PDF, save, compare)

ACH returns, reversals and return-rate limits

When an ACH debit can't be completed or is disputed, the receiver's bank sends it back as a return with a reason code. The ones a small business sees most are R01 (insufficient funds), R02 (account closed), R03 (no account or unable to locate) and R04 (invalid account number), which banks generally must return within two banking days. Unauthorized-debit claims are different. On consumer accounts, a customer who says a debit wasn't authorized (R10) or didn't match the authorization, for example the wrong amount or an early date (R11), can have it returned for up to 60 days after settlement, provided they sign a written statement. On business accounts, an unauthorized corporate debit is returned with code R29 on the standard short timeframe, so B2B debits carry less long-tail risk.

That 60-day window ties into federal consumer protection. Under the CFPB's Regulation E, consumers have 60 days after their bank statement is sent to report an unauthorized electronic transfer to limit their liability. Business accounts aren't covered by Regulation E, which is one reason businesses should watch their own accounts daily and use their bank's ACH debit blocks or filters.

Nacha also limits how many returns an originator can generate. It measures them over the preceding 60 days or two calendar months.

Exceeding these levels doesn't automatically mean a rules violation, but it triggers inquiries from your bank and, for unauthorized returns, possible enforcement and fees. In practice, a bank that sees your returns climbing may impose reserves, lower your limits or end the origination agreement. Keep returns down by validating account numbers before the first debit, sending advance notice of variable amounts, getting clear written or recorded authorizations, and stopping debits promptly when a customer cancels.

A reversal is different from a return: it's the originator correcting its own error, such as a duplicate file or wrong amount. Nacha's rules limit reversals to specific errors and require them within five banking days of the original settlement date. Using a reversal to claw back a payment for any other reason, such as a dispute with a contractor, is an improper reversal that the receiver's bank can return.

The 2026 Nacha fraud-monitoring rules

The biggest change in 2026 is a set of risk-management rules aimed at payments made under false pretenses: payments induced by someone misrepresenting their identity, authority or account ownership. Think of a fake email from a "supplier" announcing new bank details, a scammer posing as an employee to redirect their direct deposit, or a fraudster impersonating your CEO to order an urgent transfer. These are authorized by the business, so they weren't caught by older rules focused on unauthorized debits.

Nacha's rules now require non-consumer originators, third-party service providers and third-party senders to establish and implement risk-based processes to identify ACH entries suspected of being unauthorized or authorized under false pretenses, and to review those processes at least annually. Phase 1 took effect on March 20, 2026 for all ODFIs and for originators and third parties that originated 6 million or more ACH payments in 2023. Phase 2 removed the volume threshold, so from June 22, 2026 (the practical date because June 19 was a federal holiday) it applies to every other business originator, including small businesses that send payroll or vendor payments through their bank. Receiving banks also have to monitor incoming credits for fraud.

Nacha says the rule doesn't require you to screen every payment individually or check before sending, but a risk-based approach still needs at least a basic risk assessment that separates higher-risk payments from lower-risk ones. For a small business, a proportionate process could be as simple as the checklist below, written down and reviewed once a year.

A small-business ACH fraud-monitoring process

0/6

• Verify any change to a vendor's or employee's bank details by calling a number you already have on file
• Require two people to approve new payees and payments above a set amount
• Compare each ACH batch with expected payroll and payables before release
• Flag first-time payees, urgent requests and changes made just before a payment
• Use your bank's ACH debit block or filter on operating accounts
• Write the process down and review it at least once a year

Share Print

The second change, also effective March 20, 2026, standardizes two Company Entry Descriptions so receiving banks can spot fraud. Payroll and similar compensation credits to consumer accounts must carry the word PAYROLL, and consumer debits for online purchases of physical goods must carry PURCHASE. If you run payroll through a provider, it handles this; if you upload payroll files from your accounting system to your bank, check that the description field says PAYROLL.

Common mistakes and how to avoid them

Changing bank details on request by email. Business email compromise is the costliest ACH fraud for small firms. Never update payment details without a call-back to a known number, and treat urgency as a red flag.

Debiting without proper authorization. For consumer debits you need an authorization that clearly states the terms and, for recurring payments, how to revoke it. For B2B debits, the authorization terms belong in your agreement with the customer. Keep a copy of every authorization in case a customer later disputes a debit.

Ignoring returns. A debit returned for insufficient funds can be re-presented, but Nacha limits reinitiation to two more attempts, each marked "RETRY PYMT", with the same company name, ID and amount. Re-sending a debit that was returned as unauthorized is an improper reinitiation.

Missing cut-offs. Payroll that misses your bank's cut-off can arrive late. Build a buffer of at least two banking days into your payroll calendar, or budget for Same Day ACH.

ACH vs wire transfers and instant payments

Wire transfers move money individually and in real time between banks and are final once sent, which makes them useful for large one-off payments such as property closings but expensive, often tens of dollars per wire, and unforgiving of fraud. Instant payment networks, the Federal Reserve's FedNow Service and The Clearing House's RTP network, settle individual payments in seconds around the clock, and many banks now let businesses receive them, though sending options and limits vary by bank. ACH remains the cheapest choice for routine, predictable payments such as payroll, rent, vendor bills and recurring customer collections.

Official links

• Nacha — How ACH payments workParticipants and settlement timing
• Nacha — New rulesEffective dates for 2026 and 2027 changes
• Nacha — Fraud monitoring ruleWho must monitor and how
• Nacha — Company entry descriptionsPAYROLL and PURCHASE
• Federal Reserve — About FedACHHow the Reserve Banks operate ACH
• CFPB — Regulation E § 1005.6Consumer unauthorized-transfer liability

What to do next

Add your ACH details to every invoice and offer customers a reason to use them, such as a small ACH discount or longer terms. Ask your bank for its ACH origination pricing, same-day cut-offs and debit-block options, and write down a one-page fraud-monitoring process to satisfy the 2026 rules. Use the invoice generator to add payment instructions to your invoices, and see our credit card processing fees guide to measure what you save by moving customers off cards.

This is general information, not legal or tax advice — confirm on the official source or with a professional.

Frequently asked questions

How long does an ACH payment take?

Most ACH payments settle within one business day. Under Nacha's rules, debits settle the same day or the next banking day, and most credits settle the same day, the next day or in two banking days. Same Day ACH settles on the day it's sent if your bank submits it before the cut-off, for payments up to $1 million each. Weekends and federal holidays don't count.

How much do ACH payments cost a small business?

There's no fixed price; banks and payment providers set their own. As an estimate, sending or collecting an ACH payment through a business bank account or payments platform usually costs from a few cents to around $1.50 per transaction, sometimes with a monthly fee, and Same Day ACH costs more. That's typically far below card fees, which run about 2% to 3.5% of the sale.

What's the difference between an ACH credit and an ACH debit?

An ACH credit pushes money from the payer's account, such as payroll direct deposit or a customer paying your invoice through their bank. An ACH debit pulls money from someone else's account with their authorization, such as collecting a monthly subscription or a supplier auto-pay. Debits carry return risk because the account holder can dispute them.

Can an ACH payment be reversed?

A sender can reverse an ACH payment only in limited cases, such as a duplicate or wrong amount, and generally within five banking days. Separately, a receiving bank can return a payment: for insufficient funds or a closed account within two banking days, and for unauthorized debits from consumer accounts for up to 60 days after settlement with a signed written statement.

What are the new Nacha rules in 2026?

From March 20, 2026, large originators and all banks that originate ACH had to have risk-based processes to detect fraudulent and false-pretenses payments; from June 22, 2026 the requirement extended to all other business originators and third-party processors. Also from March 20, 2026, payroll credits must carry the description PAYROLL and consumer e-commerce purchase debits PURCHASE.

Is ACH safer than paper checks?

Generally yes. ACH avoids lost or stolen checks, check washing and manual deposit errors, and payments carry standard data under Nacha rules. The main risk has shifted to fraud through impersonation, such as fake emails asking you to change a vendor's bank details. Always verify bank-detail changes by phone using a number you already have.

Sources & verification

Figures on this page were checked against the sources below when it was last reviewed on 12 October 2026. Each rate and limit is stored once with its own official source and review date, and official update channels are monitored daily so changes are picked up. How we verify

1. 1.How ACH Payments Work — Nacha · accessed 12 October 2026
2. 2.Nacha Operating Rules — New Rules — Nacha · accessed 12 October 2026
3. 3.Risk Management Topics — Fraud Monitoring Phase 1 — Nacha · accessed 12 October 2026
4. 4.Risk Management Topics — Company Entry Descriptions — Nacha · accessed 12 October 2026
5. 5.Same Day ACH — Nacha · accessed 12 October 2026
6. 6.ACH Network Risk and Enforcement Topics — Nacha · accessed 12 October 2026
7. 7.Differentiating Unauthorized Return Reasons — Nacha · accessed 12 October 2026
8. 8.Regulation E § 1005.6 — Liability of consumer for unauthorized transfers — Consumer Financial Protection Bureau · accessed 12 October 2026
9. 9.ACH Network Rules: Reversals and Enforcement — Nacha · accessed 12 October 2026
10. 10.Minor Rules Topics — reinitiation — Nacha · accessed 12 October 2026
11. 11.Fedwire and FedACH: About the automated clearinghouse — Board of Governors of the Federal Reserve System · accessed 12 October 2026