NACHA Authorization: What U.S. Real Estate Brokerages Must Prove
Nacha guidance says originators should obtain permission to debit an account and keep authorization records readily reproducible. Nacha guidance places the burden of proof for authorization on the Originator.
TL;DR:
- Consumer debit authorizations should identify the debit, timing, amount or calculation method, account, consumer, authenticated assent, authorization date, and cancellation instructions.
- Keep records for two years after termination or revocation, and be ready to provide proof to your ODFI, typically within 10 banking days.
- For consumer transfers, Regulation E requires written or similarly authenticated authorization, and consumers must receive a copy; electronic records must comply with the E-Sign Act.
- Distinguish consent to access bank data from payment authorization; also renew authorization when debit timing or amount changes under the new terms.
- Brokerages that collect and forward payments for others should ask their ODFI whether third party sender rules, audits, and risk assessments apply.
Table of Contents
- What are the required elements of a NACHA authorization?
- Which authorization formats does NACHA accept?
- How long must you keep authorizations, and how fast must you produce them?
- How do Regulation E and the CFPB affect authorizations?
- When do third-party sender and TPSP rules apply?
- What does a practical compliance checklist look like?
- Where do originators most often go wrong?
- Why this matters for real estate brokerages
- How we help brokerages capture and store compliant authorizations
- FAQ
- Sources
What are the required elements of a NACHA authorization?
Nacha’s guidance puts the burden of proof for authorization squarely on the Originator, and Nacha’s Originator Essentials guide says authorizations must follow guidelines based on the transaction type. For consumer debits, Nacha practitioners identify seven essential elements:
- Language that makes clear the consumer is authorizing a debit to their account, so there is no doubt about what was agreed.
- The timing of the debits, such as a one-time charge, a recurring schedule or a specific date.
- The amount, or the method used to determine it.
- The consumer’s account information, including routing and account numbers.
- The consumer’s name and a signature or similarly authenticated assent.
- The date of the authorization, which anchors your retention clock.
- Clear revocation instructions, telling the consumer how to cancel.
Keep a record that can be reproduced accurately. Nacha guidance says the Originator bears the burden of proof for authorization.
Nacha says that if an Originator cannot produce a readily and accurately reproducible record within the requested timeframe, it effectively loses the dispute by default.
An unreproducible record can make it harder to support your position in a dispute.
Which authorization formats does NACHA accept?
Authorization formats vary by transaction type and must meet applicable requirements. The CFPB explains that electronic signatures and records can satisfy Regulation E when they comply with the E-Sign Act:
- WEB (internet-initiated): The authorization is captured online, so your system must preserve the exact screen language, the consumer’s assent and a timestamp. Nacha publishes industry practices for WEB proof of authorization worth reading.
- TEL (telephone): Check the applicable Nacha requirements and laws before relying on an oral authorization.
- PPD (prearranged payment and deposit): Check the applicable authorization requirements for this transaction type.
- ARC, BOC and RCK: Check the applicable requirements for these check-conversion entry types.
Whatever the format, keep the authorization separate from any other consent. Open-banking consent to access account data is not a payment authorization, as Nacha’s Operations Bulletin #3-2024 makes clear.
How long must you keep authorizations, and how fast must you produce them?
Keep authorization records in a form that can be reproduced accurately. Check the applicable Nacha requirements for how long to retain them.
- Retention: Keep records in a form you can reproduce accurately, and check the applicable Nacha requirements for the retention period.
- Production: You must provide proof to your ODFI on request, typically within 10 banking days.
- Emergency relief: During the coronavirus national emergency, Nacha Operations Bulletin #3-2020 extended some proof deadlines to 20 banking days. Treat that as temporary relief, not a planning assumption.
- Consequences: Missing the window can mean returns, warranty claims against you and scrutiny from your bank.
Two years from termination or revocation is how long you must keep an authorization record, per the NACHA Operating Rules as summarized by Nacha. Build your storage around that date, not the signing date.
How do Regulation E and the CFPB affect authorizations?
Regulation E layers consumer protections on top of NACHA. The CFPB’s Compliance Bulletin 2015-06 explains that preauthorized electronic fund transfers from a consumer’s account must be authorized by a writing signed or similarly authenticated by the consumer, and that a copy must be provided to the consumer.
- Writing or similar authentication: Electronic signatures and records can satisfy this when they comply with the E-Sign Act.
- Copy to the consumer: Provide the consumer with a copy in a form they can keep.
- Clear terms: Disclose the timing and amount of the transfers plainly, so the consumer knows what they agreed to.
- Revocation: Explain how consumers can cancel, and follow applicable requirements when they do.
- Enforcement: Review the applicable requirements and seek qualified advice if you are unsure how they apply.
Reading NACHA and Regulation E together gives you a single workable standard: capture the elements, authenticate the consumer, deliver a copy and keep the record.
When do third-party sender and TPSP rules apply?
If you collect payments and forward them to others, you may be classified as a Third-Party Sender. Nacha guidance for property managers discusses additional responsibilities that may apply, including Rules Compliance Audits and risk assessments.
- Contracts: Your agreement with the ODFI should spell out roles, warranties and audit schedules.
- Audit attestation: Review Operations Bulletin 3-2025 for details about Nacha’s audit-attestation process.
- Exposure: Ask your ODFI about the consequences of failing to meet any audit responsibilities that apply to you.
Brokerages moving commission, referral and co-op money for others should check early whether they fall into this category.
What does a practical compliance checklist look like?
- Capture every required field in one authorization flow, including revocation instructions.
- Send the consumer a copy, ideally before the first debit.
- Store the record in a format you can reproduce exactly, tied to the account and the authorization date.
- Set a retention trigger so records are kept two years after termination or revocation.
- Practice proof requests so you can respond within the 10-banking-day target.
- Refresh the authorization when the timing or amount of a debit changes, since Nacha notes the original may no longer cover the new terms.
Pro Tip: Map each commission payout to the authorization record behind it, so every ACH entry links to a specific, retrievable authorization.
Review the process regularly and coordinate with your ODFI and legal counsel. If you are weighing how to fund compliance tooling, alternatives to merchant cash advances are one way to compare repayment structures before committing capital.
Where do originators most often go wrong?
Nacha consultants see the same mistakes repeatedly. Many businesses omit key items, especially clear revocation instructions, and the authorization must be readily identifiable.
- Incomplete elements: One missing field can weaken the whole record.
- No revocation language: Consumers must know how to cancel.
- Wrong consent: Account-access consent is not payment authorization.
- Unreproducible records: If you cannot show it, you cannot prove it.
The fixes are simple. Start from Nacha’s sample authorization form, require clear revocation instructions and schedule audits that include a test of your proof-production workflow.
Pro Tip: Run mock proof requests periodically: pick a debit and check whether you can produce its complete authorization.
Why this matters for real estate brokerages
Commission, referral and co-op payments are exactly where informal habits creep in, and an unauditable payment becomes a RESPA conversation fast. Brokerages should treat authorization records as part of the payment itself, not paperwork filed afterward. Our blog on compliant co-op payment workflows shows what that looks like in practice.
— Wes
How we help brokerages capture and store compliant authorizations
We built BrokerPay so brokerages do not have to assemble this process from spreadsheets and payment apps. Our platform routes commission payments through brokerage-controlled accounts and keeps the records you may need when someone asks for proof.
- Authorization records and audit trails: Each payment links back to its documentation.
- Broker-controlled workflows: Approvals happen before money moves.
- Easier proof requests: Records are organized, so producing them is far less of a scramble.
If you are still paying manually, see how to switch from manual to automated payouts. Then explore our Starter, Growth and Enterprise plans at Brokerpay to request a demo and details.
This article is general information, not a substitute for advice from a qualified financial advisor. Consult a qualified financial professional about your own circumstances before acting on anything here.
FAQ
Do I need written authorization for every ACH debit?
You need a compliant authorization, though not always on paper. NACHA accepts written and electronic forms, and some transaction types allow recorded oral authorization when legal standards are met.
How long must I keep ACH authorization records?
Keep the original, copy or a readily reproducible record for two years from the termination or revocation of the authorization. Your bank may ask you to produce it typically within 10 banking days.
Does Regulation E apply to ACH authorizations?
Yes, for consumer preauthorized transfers. Regulation E requires a signed or similarly authenticated writing and a copy provided to the consumer, as the CFPB bulletin explains.
Is consent to link a bank account enough?
No. Consent to access account data is separate from authorization to originate a payment, so you still need a payment authorization.