ACH and eCheck for High-Risk Merchants: A Real Hedge Against the Card Networks

Every high-risk founder eventually has the same idea. The card account is on a reserve, the ratio is creeping, and someone says the answer is bank debits. No interchange, no chargebacks, no Visa program to fall out of. It is a useful second rail, not an exit, with its own rulebook, its own shutoff thresholds, and its own sponsor bank that can dislike your product as much as any acquirer does. This post covers the Nacha thresholds that decide whether you keep the rail, where bank debit beats cards, how to choose a provider, and the ratio trap.

What ACH actually is

ACH is the US domestic bank transfer network, governed by the Nacha Operating Rules and cleared through FedACH and EPN. When you take an eCheck, you are originating a debit against your customer's checking account through a sponsor bank called the ODFI, and "eCheck" is marketing language for the same thing.

Every transaction carries a three-letter SEC code describing how the authorization was obtained, and ecommerce runs on WEB, the internet-initiated consumer debit. Return rights differ by code, and using the wrong one is a rules violation.

Standard ACH settles in one to two banking days, and Same Day ACH is capped per transaction, with providers applying their own lower limits and cutoff times. When the money reaches you is a separate question, set by your provider's funding schedule and any reserve, and reserves apply on this rail for the reasons in the rolling reserves guide.

There are no chargebacks, but there are returns

This is the part that gets oversold. ACH has no dispute process, no representment cycle, and no chargeback fee schedule. What it has is returns, and unauthorized returns behave a lot like disputes.

The ones that matter day to day:

• R01 insufficient funds. Common on subscriptions and when a pay cycle shifts.
• R02 account closed and R03 no account. Stale data, a typo, or a customer who changed banks.
• R07 authorization revoked and R08 stopped payment. The customer told their bank to stop it.
• R10 originator not known and R29 corporate customer not authorized. The unauthorized ones, and the expensive ones.

Administrative returns come back within about two banking days, so you learn quickly. Unauthorized returns are different. A consumer can sign a written statement of unauthorized debit and have the entry returned within 60 calendar days of settlement, and their bank does not weigh your evidence the way a card issuer weighs a representment. There is no fighting it afterward, so your only defense is the authorization record you captured before the debit, which is why capture discipline is the whole job on this rail.

The thresholds that actually end the relationship

ACH has the Nacha equivalent of the card monitoring programs. Three return rates are the ones your provider watches, measured against your debit volume over the prior 60 days:

Return type	Codes it covers	Threshold
Unauthorized	R05, R07, R10, R29, R51	0.5 percent
Administrative	R02, R03, R04	3 percent
Overall	all debit returns	15 percent

The unauthorized rate is the one that gets accounts closed, and half a percent is tighter than it sounds. A merchant with a recognition problem generates unauthorized returns for the same reason they generate card disputes, a customer who cannot connect the debit on their statement to anything they bought. The fix is the same on both rails, a statement line that names the brand, and the mechanics are in the descriptor optimization guide. ACH statement text is shorter than a card descriptor, so check what your bank renders on a test debit.

Nacha also requires WEB originators to validate a receiving account on first use, and skipping that is both a rules problem and a cause of R03 returns. Broader fraud-monitoring obligations have been phasing in through 2026, so confirm current specifics with your provider rather than treating any list as settled.

One structural difference from cards matters more than the numbers. Card programs publish thresholds and define a remediation window and an exit path, the shape of the Visa monitoring program thresholds. ACH has no public equivalent, so the call belongs to your provider and its sponsor bank, rests on their internal tolerance, and arrives as a termination notice rather than a warning. Treat the Nacha numbers as the outer limit and your provider's tolerance as the real one.

ACH is not a way around underwriting

The most common misconception is that bank debits escape the risk appetite that got you terminated on cards. They do not. Behind every ACH provider is a sponsor bank taking real credit exposure, and it underwrites your product, your fulfillment timeline, and your history the way an acquirer does, sometimes more conservatively because a federal regulator is attached to its balance sheet.

That means the same document pack and the same reserve conversation, so send the pack assembled in the high-risk underwriting checklist rather than a lighter version of it. Bank debit belongs in the redundancy plan alongside a second card MID rather than in place of one, the case made in the backup processor strategy post.

Where bank debit genuinely wins

High ticket. At a 2,000 dollar program or a 5,000 dollar wholesale order, card processing costs real money and card limits cause declines, while ACH pricing is typically a flat fee or a capped percentage, so the economics improve as the ticket rises.

Recurring billing with an engaged customer. A member who consciously connected a bank account and understands the schedule returns less often than a card that expires or gets reissued. Involuntary card churn is a real cost, and the retry and updater mechanics are in the authorization rate guide.

Payment plans. Splitting a purchase across months on a card exposes you to a dispute on every installment, while on ACH it is one authorization for a defined schedule.

Volume that never needed cards. Wholesale, invoiced orders, and repeat B2B belong on ACH by default, and moving them off cards is pure margin.

The honest cons: no confirmation of good funds, R01 returns you learn about days later, a 60-day unauthorized window, US-only reach, and a first-time buyer who converts worse on a bank link than a card field.

Choosing a provider

Providers come in three shapes. A mainstream fintech gateway offers the cleanest integration and the least appetite, and offboards restricted categories the moment a review flags them. A high-risk ACH specialist underwrites your category deliberately and will not drop you for being what you said you were. Direct origination through your own bank is the most durable and the hardest to get, because no intermediary absorbs the exposure.

Whichever shape you pick, ask these before signing.

• Who is the sponsor bank, and has it approved your category in writing rather than by silence?
• What return rate tolerance will they enforce, as distinct from the Nacha thresholds?
• What is the funding delay, the reserve, and what changes either?
• Do they report return rates daily, or do you find out at the monthly statement?
• Can you export authorization records and customer bank tokens if you leave?

Token portability is rare, so a provider change can mean re-enrolling your whole base.

The ratio trap

Here is the mistake that turns a hedge into a worse position.

A merchant with a chargeback problem moves their best customers to ACH first, because those are the people who agree to it. Repeat buyers, subscribers who never dispute, the loyal base. What is left on cards is cold traffic and the refund-prone cohort.

Your chargeback count did not change. Your card transaction count fell. The ratio is a fraction, and you just shrank the denominator, which is how a merchant lands in a monitoring program the month after doing something they believed was risk reduction.

Do it the other way. Offer ACH where it wins on economics, meaning high ticket, payment plans, and B2B, and keep ordinary retail volume on cards so the denominator stays healthy. If the card account is genuinely unstable, the answer is another card MID and deliberate routing, which is what the payment orchestration explainer is for.

Rolling it out

Capture and store the authorization exactly. The debit terms, amount or amount range, frequency, start date, and cancellation method belong on screen, affirmatively agreed to, and retained with a timestamp and IP. Confirm every enrollment by email, because a customer who reads that email does not file an unauthorized return in week six.

Keep retry discipline on R01 returns instead of hammering the account, because Nacha permits only a limited number of reinitiations. Stop when the code is not a funding code. An R02 or R03 needs new account data, and retrying it only piles administrative returns against your 3 percent line. Watch the unauthorized rate weekly, because half a percent of a small volume is very few returns, and a monthly review only tells you why you were terminated.

Practical takeaway

The path that fails is treating ACH as an escape hatch. It gets adopted in a panic, the best customers move first, the card ratio worsens, the authorization records are thin, unauthorized returns climb past half a percent, and six months later the merchant has lost both rails.

The path that lasts adds bank debit deliberately, while the card account is still healthy. Put it where the economics are better rather than where the fear is loudest, capture authorizations like you will have to prove them, and keep enough card volume flowing to keep the ratio math on your side. If you want a look at whether ACH belongs in your stack and where it should sit, apply for an architecture review.