How to Get ACH or eCheck Processing for an Online Business

Identify who initiates the payment and what the provider actually offers

Describe the customer type, bank-account type, payment initiation channel and collection frequency. Ask the proposed provider to identify the network and appropriate entry classification for the actual flow. Do not select a business-to-business classification merely because the seller itself is a business.

Identify the merchant, payment provider and originating bank roles, including who handles returns and support. A customer entering routing and account numbers is only one part of a valid collection process.

Design authorization for the actual transaction

Confirm the wording and evidence required for the relevant payment type with the provider. For recurring preauthorized transfers from a consumer account, Regulation E requires a signed or similarly authenticated written authorization and a copy for the consumer. It also addresses varying amounts and stopping payments. Do not apply one generic mandate to every bank-payment flow. CFPB: Regulation E, section 1005.10: preauthorized transfers

• Identify the merchant collecting the money and the obligation being paid.
• Explain amount or calculation method, frequency and timing before authorization.
• Retain the authorization version and evidence of the customer's assent through a secure process.
• Provide the required copy or confirmation and a workable cancellation or revocation route.
• Define what happens when the amount, schedule or account changes, rather than silently reusing old permission.

Authorization is not simply a checkbox added after collection. Ask the provider to review the actual online or contractual flow before launch, including mobile presentation and the way a customer receives their copy.

Keep account validation separate from identity, consent and available funds

Nacha's WEB debit rule requires account validation before first use and before changing an account number, as part of the relevant fraud-detection system. Its minimum validation standard concerns an open account that accepts ACH entries; it does not by itself require ownership verification. A valid account is not proof of consent or sufficient funds. Nacha: Supplementing fraud detection standards for WEB debits

As of this guide's review, Nacha's 2026 phase-two fraud-monitoring requirements are in effect. They extend risk-based processes and procedures to non-consumer originators and the covered service-provider and sender roles regardless of volume, relevant to each role. Nacha identifies June 22, 2026 as the practical deadline because the stated June 19 date was a federal holiday. Nacha: Risk management: fraud monitoring phase two

Document which checks the provider performs and which remain yours. Establish an owner for suspicious activity, unusual payment patterns and exceptions. Do not assume that buying an account-validation tool completes the entire fraud-monitoring obligation.

Plan returns, refunds and delivery before promising immediate payment

An initiated debit is not necessarily final collected money. Ask how pending, settled, returned and refunded states are represented and what they mean for the business's fulfillment decisions. Avoid delivering an expensive irreversible service based only on a checkout success page.

• Define who reviews return notifications and how they reach accounting and customer support.
• Confirm when a retry is permitted and when a new authorization or another action is required.
• Prevent a refund and a return from creating an unintended double credit.
• Agree how invoices and customer balances change when an entry is returned.
• Understand provider thresholds, funding delays and any reserve using the actual contract rather than a generic market percentage.

Use clear customer communications about timing and status. A payment that appears in a provider dashboard is not automatically unrestricted cash in the merchant's bank account, and an account-validation result is not a payment guarantee.

Prepare the merchant file and a safe data flow

Provide a business-level description, entity and ownership information, operating countries, products or services, customer type, expected transaction sizes and collection frequency. Explain existing return experience if available and the reason bank payments would help the business.

Describe where banking information is entered, stored and accessed. Use the provider's supported collection tools and protect operational access. Do not send customer routing numbers, account numbers, online-banking credentials or raw authorization records through an ordinary public contact form.

The FDIC's payment-processor guidance emphasizes due diligence and monitoring in bank relationships. Its bank-focused discussion reinforces that a different rail is not an exemption from scrutiny of the underlying merchant. It is not a standardized approval packet or a claim that MBA acts as an originating bank. FDIC: Payment processor relationships: guidance revised February 2026

Validate costs, responsibility and exception handling

• Confirm permitted business activity, entry types, transaction limits and account configuration.
• Review transaction, return, verification, monthly and other applicable fees together.
• Test authorization, validation failure, returned entries, revocation and refunds using approved test tools.
• Reconcile provider events to customer obligations and actual deposits.
• Agree ongoing review of fraud procedures and changes to the merchant's products or payment flow.

The right decision may be ACH for certain invoices or customers rather than replacing every card transaction. Evaluate customer adoption and operational work as well as fees. MerchantBridge can explore whether an available relationship should assess that use case, without promising lower cost or universal acceptance.

For ISOs: refer a defined bank-payment use case

When a merchant asks for eCheck, establish whether it wants invoice payments, recurring consumer debits or another collection method. A card decline or category restriction does not establish that an ACH provider can accept the same business. Disclose the actual activity and the reason for the request.

MBA can explore potential relationships for eligible merchants that need bank-payment options. The opportunity is strongest when the merchant's customer behavior, authorization process and operations support the proposed method. No claim is made that MBA is an ODFI, a direct network participant or the provider of every technical integration.

Agree who manages onboarding, authorization review, support and return escalations. Any referral economics or other commercial arrangement must be confirmed specifically. Avoid promising guaranteed funds, no returns or freedom from underwriting merely because the transaction does not use a card.

Summarize the flow before requesting private banking evidence

• Your ISO contact and permission to discuss the merchant.
• The underlying business, entity country and consumer or business customer mix.
• Who initiates payments, whether they recur and what obligation they satisfy.
• Approximate volume and tickets, current provider limitation and return experience if known.
• The integration, authorization and reconciliation capabilities already in place or still needed.

Start with those business facts. MBA can determine whether a potential partner conversation is available and establish a secure next stage without exposing customer bank information in the initial inquiry.