6.4 Authorization Retention (2 Years) & Copy Provision Rules
Key Takeaways
- Originators must retain the original or an accurate electronic copy of each ACH authorization for a minimum of two (2) years from the date of revocation or termination of the authorization.
- The 2-year retention clock begins upon termination or revocation of the authorization, NOT upon initial signing or individual transaction execution.
- When an RDFI requests proof of authorization in writing, the ODFI must provide an accurate copy of the authorization to the RDFI within ten (10) banking days.
- Electronic authorization records must satisfy rigorous evidentiary criteria: complete visual reproduction, demonstrable consumer assent, metadata integrity, and tamper-evident storage.
- Failure to produce authorization copies constitutes a breach of ODFI warranty, triggering full indemnification liability, forfeiture of return dishonor defenses, and severe Nacha compliance fines.
6.4 Authorization Retention (2 Years) & Copy Provision Rules
Core Principle: Originating an ACH entry is legally contingent upon obtaining authorization, but defending that entry requires maintaining verifiable proof. The Nacha Operating Rules establish a strict record retention mandate: Originators must retain the original or an accurate, reproducible copy of every authorization for a minimum of two (2) years following the termination or revocation of the authorization. Furthermore, when an RDFI challenges an entry on behalf of a Receiver, the ODFI and Originator must execute a formal, time-sensitive copy provision workflow within ten (10) banking days.
1. The Two-Year Retention Rule: Trigger Clock & Scope
Under Nacha Operating Rules (Article Two, Subsection 2.3.2.7 - Retention and Provision of the Record of Authorization), an Originator must retain the original or an accurate copy of each Receiver authorization.
+---------------------------------------------------------------------------------------------------------+
| THE 2-YEAR RETENTION CLOCK: CRITICAL DISTINCTION |
+---------------------------------------------------------------------------------------------------------+
| INCORRECT Interpretation: | Retain for 2 years from the date the authorization was signed. |
| INCORRECT Interpretation: | Retain for 2 years from the date of each monthly debit transaction. |
| CORRECT RULE (Nacha Rules): | Retain for TWO (2) YEARS from the REVOCATION OR TERMINATION of the auth! |
+---------------------------------------------------------------------------------------------------------+
Practical Implications for Long-Term Recurring Authorizations
- Example 1 (30-Year Mortgage): A consumer authorizes recurring monthly ACH debits for a 30-year residential mortgage in 2026. The loan is paid in full and the account is terminated in 2056. The Originator must retain the authorization record for 32 total years (the active 30-year duration of the agreement PLUS two full years after termination, until 2058).
- Example 2 (Multi-Year Subscription): A consumer signs up for an ongoing streaming subscription in January 2024 and cancels (revokes) the subscription in June 2026. The Originator must retain the electronic authorization audit trail until June 2028.
- Single-Entry Authorizations: For a one-time single-entry payment (e.g., a one-time TEL or WEB debit), the authorization terminates immediately upon the completion of that single transfer. Therefore, the retention period is two (2) years from the settlement date of that single entry.
2. Authorization Copy Provision Workflow & Timelines
When a Receiver notices an unfamiliar debit on their periodic statement and notifies their bank, the RDFI has the right under Nacha Rules to demand proof of authorization from the ODFI.
+---------------------------------------------------------------------------------------------------------+
| AUTHORIZATION COPY REQUEST & PROVISION TIMELINE |
+---------------------------------------------------------------------------------------------------------+
| Step 1: Receiver Disputes Entry | Receiver informs RDFI of disputed or unauthorized ACH debit. |
| Step 2: RDFI Written Request | RDFI sends written request for proof of authorization to ODFI. |
| Step 3: ODFI Requests Originator | ODFI immediately demands copy from Originator (contractual SLA). |
| Step 4: Originator Produces Copy | Originator retrieves record & transmits copy to ODFI. |
| Step 5: ODFI Delivers to RDFI | ODFI MUST provide copy to RDFI within TEN (10) BANKING DAYS! |
| Step 6: RDFI Evaluates Proof | RDFI provides copy to Receiver or initiates return (R10/R11). |
+---------------------------------------------------------------------------------------------------------+
Detailed Breakdown of Network Responsibilities
- The RDFI Written Request:
- The RDFI may send a written request to the ODFI requesting a copy of the Receiver's authorization for any debit entry.
- The request must specify the transaction details: Trace Number, Settlement Date, Dollar Amount, Account Number, and Company Name.
- The 10-Banking-Day Mandate on the ODFI:
- Under Nacha Operating Rules Subsection 2.3.2.7 (Retention and Provision of the Record of Authorization) — the RDFI's right to ask is Section 3.1.4 (RDFI May Request Copy of Receiver's Authorization of Entry from ODFI) — upon receiving the RDFI's written request the ODFI must provide an accurate copy of the authorization to the RDFI within ten (10) banking days.
- ODFI-to-Originator Operational SLA:
- To ensure the ODFI meets its 10-banking-day network obligation, prudent ODFI Origination Agreements contractually require Originators to deliver the copy to the ODFI within 3 to 5 banking days of notification.
- No Charge / Fee Restrictions:
- An ODFI or Originator cannot charge the RDFI a fee for providing a copy of an authorization requested in accordance with Nacha Rules.
3. Electronic Image Retention Standards & Evidentiary Criteria
Under Nacha Rules and federal/state electronic evidence laws, Originators are not required to store physical paper documents in file cabinets. Authorizations may be retained in electronic format (scanned TIFF/PDF, optical disk, cloud database, secure imaging system) provided they satisfy four core evidentiary criteria:
+---------------------------------------------------------------------------------------------------------+
| FOUR PILLARS OF ELECTRONIC RECORD RETENTION |
+---------------------------------------------------------------------------------------------------------+
| 1. Visual Reproduction & Fidelity | Must accurately reproduce all original terms, disclosures, text, |
| | and formatting without omission or distortion. |
| 2. Proof of Assent / Signature | Must display the handwritten signature, digital signature certificate|
| | or electronic click-through acceptance confirmation. |
| 3. Metadata & Audit Integrity | Must retain timestamp (UTC), IP address, session ID, user profile, |
| | and authentication method (e.g., MFA logs). |
| 4. Tamper-Evident Security | Must be stored in a WORM (Write-Once-Read-Many) or cryptographic |
| | tamper-proof environment preventing unauthorized alteration. |
+---------------------------------------------------------------------------------------------------------+
Standards for Specific SEC Codes
- PPD (Written / Scanned): High-resolution digital scan of signed paper authorization showing signature and date.
- WEB (Electronic): Complete electronic audit log including: consumer's user profile, screenshot or exact text of disclosure displayed at time of signing, timestamp, IP address, device identifier, and verification method.
- TEL (Oral): Complete digital audio recording file (MP3/WAV/flac) preserving audible disclosures and explicit verbal consent, OR a copy of the written confirmation letter/email with proof of mailing/transmission date prior to settlement.
4. Consequences of Non-Compliance & Inability to Produce Copy
When an Originator fails to maintain authorization records or cannot produce a legible copy within the required timeframe, severe financial, operational, and regulatory liabilities ensue across the ACH Network:
| Failure Vector | Immediate Network Consequence | Financial & Legal Liability |
|---|---|---|
| Inability to Produce Copy | ODFI breaches Nacha Warranty of Authorization (Article Two). | ODFI must fully indemnify the RDFI for all losses, fees, and legal damages. |
| Late Copy (>10 Banking Days) | RDFI is entitled to initiate immediate unauthorized return. | ODFI loses right to challenge or dishonor the unauthorized return (R10/R11/R05). |
| Systemic Record Failures | Nacha National System of Fines (Appendix Nine) enforcement. | Escalating monetary penalties: Class 1 (progressive on recurrence: $1,000 / $2,500 / $5,000), Class 2 (up to $100,000/mo), Class 3 (up to $500,000/mo). |
| Originator Non-Compliance | ODFI terminates ACH Origination Agreement. | Suspension of origination privileges, loss of processing capabilities, reputational harm. |
5. Summary Matrix: Record Retention & Copy Provision Benchmarks
| Operational Parameter | Exact Nacha Rule Benchmark | Key Reference / Authority |
|---|---|---|
| Mandatory Retention Period | 2 years from revocation or termination of authorization | Nacha Rules Subsection 2.3.2.7 |
| ODFI Copy Provision Deadline | Within 10 banking days of RDFI's written request | Nacha Rules Subsection 2.3.2.7 & Section 3.1.4 |
| Permissible Storage Formats | Original writing, microfilm, microfiche, optical disk, or electronic image | Nacha Rules Subsection 2.3.2.7 |
| Fee for Copy Provision | $0.00 (ODFI/Originator cannot charge RDFI for authorization copies) | Nacha Operating Rules Guidelines |
| Consumer Dispute Window (WSUD) | Within 60 calendar days from transmittal of account statement | Regulation E § 1005.11 & Nacha Rules |
What is the mandatory timeframe within which an ODFI must provide an accurate copy of an authorization to an RDFI after receiving the RDFI's written request under Nacha Rules?
For how long must an Originator retain the original or an accurate electronic copy of a consumer's ACH authorization under Nacha Operating Rules?
A consumer authorized monthly recurring ACH debits for a 5-year auto loan in 2021, and the loan was paid in full and terminated in 2026. Until what year must the Originator retain the authorization record to comply with Nacha Rules?
What is the primary legal and financial consequence to an ODFI if its Originator fails to produce a valid copy of an ACH authorization requested by an RDFI within the mandatory timeframe?