NACHA-compliant mandate capture
Every ACH debit needs a valid mandate. topropay's hosted authorization form, embedded fields and PDF / e-signature paths all produce the same mandate ID — carried on every debit, retained for the life of the relationship, defensible in disputes.
Key benefits
Four properties that separate a real NACHA-compliant mandate flow from a hand-rolled form-plus-CSV workflow.
The same authorization form template covers one-off debits (WEB, TEL), business debits (CCD), consumer standing debits (PPD) and recurring debits (WEB / PPD recurring). The merchant doesn't fork the form per SEC code — the platform selects the right code at debit time.
Send the customer a hosted authorization link, embed the form in a portal via hosted iframe fields, or accept a signed PDF captured with an e-signature provider. All three produce the same mandate ID the debit engine uses.
Every ACH debit carries the authorization mandate ID plus the SEC code, capture timestamp, IP and consent-language version. That evidence pack ships automatically with the debit — and is retained for the required period per NACHA rules.
One recurring ach payment authorization form authorises the whole billing series. The recurring engine references the mandate on every scheduled debit; the customer isn't asked to re-authorise every renewal.
How the recurring ach payment authorization form runs end-to-end
What happens between the merchant sending the authorization link and the debit landing in reconciliation — with mandate evidence attached at every hop.
Merchant creates a hosted authorization form via API or dashboard. topropay returns a per-customer URL with the merchant's brand and the debit terms pre-filled.
Customer opens the link, enters routing number and account number, checks the consent box and (for higher-risk merchants) completes micro-deposit or Plaid-style bank verification.
topropay stores the mandate, consent language version, timestamp, IP and evidence pack. A mandate ID returns to the merchant's back-end via webhook — recorded alongside the customer record.
The merchant triggers debits (one-off or scheduled) against the mandate ID. The ACH debit engine builds the correct SEC-code entry, carries the mandate reference and submits through the partner ACH processor.
R-code-aware retries handle NSF / R01 / R03 / R04 returns per the merchant's policy. Mandate-terminating returns (R07 revoke, R08 stop) auto-flag the mandate as revoked and stop future debits.
Main use cases
Five recurring merchant shapes where ACH mandate capture drives real cost or approval wins over card-recurring.
US SaaS merchants substitute ACH recurring for card for large-ticket enterprise plans — lower interchange, longer settlement, no card expiry. One authorization form captured at contract; recurring debits on the monthly cycle.
Wholesale and trade sellers capture a CCD authorization at customer onboarding; debits fire on NET-30 / NET-60 as invoices come due. The mandate carries invoice references in the addenda.
Gyms, tutoring, subscription boxes, insurance premiums — the recurring payment authorization form runs monthly / annual debits on the same mandate for the life of the customer relationship.
Bill-pay style merchants capturing monthly variable-amount debits — the authorization allows a variable range with customer notification per NACHA rules.
Licensed consumer lenders capturing standing debit authorisations for loan repayments — with mandate revocation on payoff and audit-grade evidence retention.
Platform features
The default form template captures every field NACHA requires plus the metadata that makes disputes defensible. Every field is merchant-configurable if the wording needs to match a specific customer-experience style.
As it appears on the bank account being debited.
9-digit US bank routing; format-validated on entry.
Bank account number for the debit; validated against issuer BIN where possible.
Checking or savings — some SEC codes are restricted per account type.
Fixed amount for one-off; amount range for variable recurring.
One-time, weekly, monthly, annual or on-invoice.
NACHA-compliant authorization copy — versioned and stored per capture.
Depending on merchant preference — both produce a valid mandate under WEB / TEL SEC codes.
Industry relevance
A downloadable "free ach payment authorization form" PDF template can capture the legal consent — but produces no mandate ID, no evidence retention, no R-code-aware debit engine and no dispute-defence workflow. topropay's ACH-side posture targets licensed US merchants running recurring billing (SaaS, service businesses, B2B, lending, utility-style variable amounts) who need the whole loop under one roof rather than a PDF plus a spreadsheet.
Trust & compliance
One audited environment for the orchestration layer; NACHA-compliant mandate copy; evidence retention that survives disputes years after the fact.
Ready to capture NACHA-compliant mandates
A 30-minute review covers the SEC codes relevant to your traffic (WEB, TEL, PPD, CCD), the authorization surface shape (hosted, embedded or PDF), your existing ACH processor relationship, and a sandbox to test against before any commercial commitment.
Frequently asked
Definitions, SEC-code mechanics, mandate revocation, evidence retention and the practicalities of running ACH recurring under one platform.
An ach payment authorization form on topropay is the NACHA-compliant capture surface the platform generates per merchant. It collects the customer's routing and account number plus consent to debit, versions the consent language, and returns a mandate ID the merchant references on every subsequent ACH debit against that customer.
An ach recurring payment authorization form authorises a series of debits rather than a single one — typically fixed-amount monthly, or a range for variable-amount monthly (e.g. utility-style billing). The authorization copy explicitly names the frequency and amount range; the mandate then covers every scheduled debit until the customer revokes it.
A recurring ach payment authorization form typically falls under WEB (internet-initiated) or PPD (prearranged payment / deposit) for consumer accounts, and CCD (corporate credit / debit) for business accounts. topropay picks the correct SEC code at debit time based on the account type and origination channel; the merchant doesn't need to select it manually.
Yes — a recurring payment authorization form that meets NACHA rules for WEB, TEL, PPD or CCD is a legally binding standing authorization for debits under those rules. Consumer accounts have additional consumer-protection windows (60-day dispute for unauthorized debits, 15-day for authorised-but-billing-error under WEB/PPD); topropay's mandate storage preserves the evidence needed to defend a disputed debit within those windows.
ach payment authorization in practice means the customer has granted the merchant permission to debit their bank account for a specific amount (or range) at a specific frequency (or on-demand). The authorization must be captured before the first debit; the merchant retains the evidence for the required period; the customer can revoke the authorization at any time and the mandate must then be flagged as revoked.
The 'free ach payment authorization form' framing typically refers to blank template PDFs floating around the web. topropay doesn't offer a downloadable blank template as a standalone product — the value is the mandate-capture flow, mandate ID, evidence retention and debit engine that ride on top. Merchants using the platform get a hosted authorization form as part of their subscription; standalone PDF templates without an underlying mandate engine won't produce a mandate ID or preserve evidence for disputes.
Yes — the sales team can share a sample ach payment authorization form during onboarding, showing the platform's default consent language, the branded surface, the mandate-metadata capture, and the merchant-configurable fields. The final form is templated per merchant with their name, contact details and specific debit terms filled in.
The form ships in three shapes: a hosted URL (per-customer link the merchant sends via email / SMS / portal), embedded hosted-field iframes (the merchant renders the form inline inside their own billing portal), and PDF plus e-signature capture (for merchants whose customers prefer paper-style authorization). All three produce the same mandate ID the debit engine uses.
Customers can revoke their mandate at any time via the merchant's customer-facing portal, by contacting the merchant, or via their bank's stop-payment mechanism (R07 / R08 return codes). Merchant-side revocation writes back to topropay via API or dashboard and stops future debits; bank-side revocation via R-code auto-flags the mandate as revoked based on the return processing.
The mandate is valid until the customer revokes it or until the merchant's own policy expires it. NACHA rules require that consumer standing authorisations remain valid until revoked or until the merchant has cancelled the underlying billing relationship; topropay's mandate storage retains the mandate plus consent-language version for the life of the debit relationship plus 2 years for audit / dispute purposes.
If a debit is disputed (via ACH return R05 / R10 / R11 or via consumer-protection window claim), topropay surfaces the dispute in the unified queue with the mandate evidence pack pre-filled: capture timestamp, IP, consent-language version, mandate ID, all prior debits against the mandate. That evidence flows into the return-management workflow with the partner ACH processor.
Yes — for merchants operating in higher-risk verticals, the authorization form can gate mandate creation on account verification via micro-deposits (2 small deposits + return-count challenge) or via a partner bank-verification integration (Plaid, MX or similar). Verified accounts carry a lower R-code rate at first debit.
Variable-amount recurring debits (utility-style billing) capture an amount range at authorization time and require pre-notification to the customer for each debit that varies from the previous one, per NACHA rules. topropay automates the pre-notification (email or in-portal) and records delivery evidence as part of the debit's audit trail.
Yes — the mandate ID plus a copy of the signed authorization (PDF export of the captured form) can be pushed to popular accounting systems (Xero, QuickBooks, NetSuite, Sage) as an attachment on the customer record. The mandate ID also travels with every debit's reconciliation row so finance can trace back to the source authorization.
ACH connectivity on topropay is delivered via licensed partner ACH processors (ODFI relationships) in the US. topropay owns the mandate capture, storage and orchestration layer; the partner processor owns the ACH network relationship and the settlement flow. Merchants sit as sub-merchants under the partner's ODFI, or as direct originators where they hold their own ODFI relationship.
Related