Home → Blog → Payment Processing for Nonprofits in 2026: Donation Acceptance, Recurring Giving, and PCI Scope Control

Payment Processing for Nonprofits in 2026: Donation Acceptance, Recurring Giving, and PCI Scope Control

Call 866-305-6454 to review nonprofit payment acceptance, online credit card processing, ACH donations, recurring giving, and PCI scope control.

1. Treat nonprofit payment processing as a control system

Nonprofit payment processing is not only a checkout function.

It connects:

Retail e-commerce usually focuses on product selection, authorization, fulfillment, and returns.

Nonprofit payment operations add different controls.

A donor may select a restricted fund. A volunteer may handle an event terminal. A board member may require a monthly report by campaign. A development team may manage recurring donors without a dedicated payments department.

The payment record must preserve the donor’s intent.

The organization must also control access to card data. It must maintain usable authorization records. It must distinguish a refund request from a card dispute. It must preserve evidence when a donor does not recognize a transaction.

Use a payment system that connects the donor-facing experience to settlement, reconciliation, and reporting.

Start with the organization’s operating model:

Assign each task to a named role.

Do not assign unrestricted access to every employee, volunteer, or board member.

2. Compare donation channels before selecting the account

A nonprofit may accept gifts through several channels. Each channel creates different operational and security requirements.

Graphic novel illustration showing online donation forms, peer-to-peer fundraising, text-to-give, event card acceptance, phone donations, and mailed checks connected to one nonprofit payment system

Online donation forms

Online forms support direct giving from the nonprofit website.

Use a hosted payment page or a properly configured embedded form. Confirm where card data is collected. Confirm which party operates the payment page. Confirm how the gateway handles tokens, recurring billing, refunds, and receipts.

Capture:

Do not place card numbers in the nonprofit’s content management system.

Do not ask donors to email card information.

Do not save card information in a spreadsheet.

A hosted page can reduce the systems that touch payment data. It does not eliminate the need to understand PCI DSS scope. Confirm the applicable Self-Assessment Questionnaire and validation requirements with the acquirer or payment provider.

Peer-to-peer and crowdfunding pages

Peer-to-peer pages allow supporters to solicit donations for a nonprofit campaign.

The nonprofit should identify:

Crowdfunding structures can receive elevated underwriting attention. This does not mean that a nonprofit or campaign is automatically high risk.

Underwriters may need to understand:

Keep these details consistent across the campaign page, processor application, donor receipt, and accounting records.

Text-to-give

Text-to-give programs can reduce donor friction.

They can also create reconciliation challenges.

Confirm how the text keyword maps to:

The nonprofit should know whether the provider operates as a payment facilitator, technology provider, or service provider connected to the nonprofit’s merchant account.

Review settlement reports. Match the provider’s deposit to the underlying gifts. Identify fees, refunds, returned payments, and failed recurring transactions.

In-person and event card acceptance

Events often use volunteers.

Provide a short operating procedure before the event.

The procedure should cover:

Assign each terminal to a responsible person.

Do not allow volunteers to photograph cards. Do not write card information on paper. Do not allow shared passwords when individual logins are available.

If a donor wants to designate a gift to a specific program, capture the designation in the transaction or donor-management workflow. Do not rely on handwritten notes that must later be interpreted.

Phone donations

Phone donations are card-not-present transactions.

Use a virtual terminal or secure payment link. Limit the number of employees who key transactions. Train staff to avoid recording full card numbers in call notes.

Capture donor consent and fund designation in the approved system.

A phone donation may create a dispute months later. Keep the transaction record, receipt status, call notes that do not contain sensitive authentication data, and any donor correspondence.

Review Bridge’s payment gateway integration options for hosted pages, virtual terminal access, tokenization, recurring billing, and ACH or eCheck support.

Mailed checks converted to ACH or card

Do not convert a mailed check into an electronic debit or card transaction without a processor-approved and legally compliant process.

A check contains payment information. It does not automatically create authorization for a recurring ACH debit.

Confirm:

If the nonprofit instead keys a card transaction from mailed information, protect the paper record. Limit access. Securely destroy the record when retention is no longer required.

3. Build recurring giving around authorization and service

Recurring giving can support predictable fundraising operations.

It also creates a continuing payment relationship.

A monthly sustainer plan should show:

Make the recurring option clear.

Do not hide recurring enrollment below a one-time donation button.

Do not use unclear language such as “continue support” when the donor is authorizing repeated debits.

A donor should receive confirmation after enrollment. Store a copy of the authorization and confirmation. Make cancellation easy to locate.

For recurring card gifts, use tokenization rather than storing raw card numbers. The gateway should maintain the payment credential or token. The nonprofit should retain the donor relationship, token reference, schedule, and transaction history.

For recurring ACH gifts from consumer accounts, Regulation E applies to preauthorized electronic fund transfers. The Consumer Financial Protection Bureau’s 12 CFR §1005.10 states that authorization must be in writing or similarly authenticated. The person obtaining the authorization must provide a copy to the consumer.

The authorization should be readily identifiable. The terms should be clear and understandable.

Provide a copy electronically or on paper.

Give the donor a practical cancellation method. Coordinate the cancellation workflow between the nonprofit, gateway, processor, and donor-management system.

If the payment amount will vary, review the notice process. Regulation E §1005.10(d) addresses notice for varying preauthorized transfer amounts. Configure notices through the payment platform and verify the timing with the processor.

Retention mechanics

Recurring giving retention is an operational process.

Use:

Do not continue a recurring debit after the donor has revoked authorization.

Do not treat a failed payment as permission to change the amount or date.

Review recurring reports every month. Separate:

Graphic novel illustration of recurring nonprofit giving with donor authorization, monthly calendar, tokenized payment vault, ACH bank rails, and a development manager monitoring payment status

4. Understand underwriting attention without labeling the nonprofit

Some nonprofit payment models may receive additional underwriting questions.

That review does not mean the organization is automatically high risk.

The processor or acquiring bank may need more information when the payment flow involves:

The common issue is uncertainty.

The underwriter may need to understand who receives the money, what the donor expects, how quickly funds are distributed, and what happens if the campaign changes.

Prepare a written explanation.

Describe:

Disaster relief campaigns require special clarity. State whether funds are restricted to a named response. State how unused funds are handled. Keep campaign language aligned with board-approved policies and donor communications.

Association and membership billing require a different review. Explain membership terms, renewal dates, cancellation rules, member benefits, and the distinction between dues and optional donations.

Cause-based campaigns with deferred or indeterminate fulfillment should explain what donors receive, if anything. If there is no exchange of goods or services, state that clearly in the acknowledgment workflow. If there is an event, membership benefit, ticket, or other benefit, route the record to the appropriate receipting process.

For organizations that need specialized underwriting, review Bridge’s high risk merchant account resources. Use accurate information. Approval terms depend on underwriting.

5. Select the right ACH entry type

ACH donations and dues require an authorization model that matches the transaction.

Common Standard Entry Class codes include:

Do not select a code only because a payment was collected through a particular device.

Confirm the correct code with the processor and originating depository financial institution. The payment channel, account type, authorization method, and transaction structure all matter.

PPD for recurring consumer donations

PPD may be relevant when a consumer authorizes a recurring donation through a written or electronically authenticated agreement.

Keep:

CCD for organization dues

CCD may be relevant for payments involving a business or organization account.

An association collecting dues from a corporate account should confirm whether CCD is appropriate. Keep the commercial authorization and payment terms.

Do not assume that a business email address means the account is a corporate account. Confirm the transaction structure.

WEB for online consumer giving

WEB is associated with internet-initiated consumer ACH entries.

Use a secure form. Display the payment amount, frequency, and authorization terms. Record affirmative assent. Provide a copy of the authorization.

Do not rely on an account-linking event alone. The donor must authorize the debit.

TEL for phone donations

TEL may apply to a telephone-initiated consumer ACH entry.

Use a processor-approved call workflow. Record the required information. Follow the processor’s requirements for call recording, confirmation, authorization retention, and notice.

Do not label a phone authorization as WEB merely because the donor record is later entered into an online dashboard.

Same-day ACH

Same-day ACH may be useful for urgent gifts, campaign deadlines, or time-sensitive dues.

The Federal Reserve’s FedACH processing schedule lists same-day transmission deadlines of 10:30 a.m. ET, 2:45 p.m. ET, and 4:45 p.m. ET, with settlement at 1:00 p.m., 5:00 p.m., and 6:00 p.m. ET.

These are operator schedule times.

A processor may impose earlier internal cutoffs. Confirm the actual cutoff before promising same-day settlement to donors or staff.

The Nacha Operating Rules provide a $1,000,000 per-entry same-day ACH limit in 2026. Confirm eligibility, transaction limits, and funding treatment with the processor.

Same-day ACH does not remove authorization requirements. It does not remove return risk. It does not guarantee that funds are immediately available to the nonprofit.

Review Bridge’s ACH payment processing for small business resources when evaluating ACH donations, dues, recurring payments, and settlement schedules.

6. Assign ACH return ownership

A small development team may not have a payments department.

Assign ownership anyway.

Track returns by:

Nacha identifies an unauthorized debit return rate threshold of 0.5%. Nacha identifies an administrative return rate level of 3.0% for R02, R03, and R04. Nacha also identifies an overall debit return rate level of 15.0%, excluding RCK entries. These figures come from Nacha’s ACH Network Risk and Enforcement resource.

These are risk-monitoring thresholds and levels. They are not fundraising targets. Exceeding a return rate level does not automatically establish a rules violation. It may trigger review.

Use a return workflow:

  1. Identify the code.
  2. Stop future debits when authorization is revoked.
  3. Contact the donor through the approved channel.
  4. Correct account information only after donor confirmation.
  5. Obtain new authorization when required.
  6. Confirm whether reinitiation is permitted.
  7. Record the action.
  8. Reconcile the returned amount.
  9. Escalate unusual patterns to the processor.

Do not re-submit an unauthorized return automatically. Nacha rules limit reinitiation. The Nacha risk and enforcement resource explains that unauthorized debits cannot simply be remedied through reinitiation.

Create a responsibility matrix:

7. Separate refunds from disputes

A donor may contact the nonprofit for several reasons.

The donor may:

These events are not identical.

A refund is a nonprofit-approved reversal. A dispute is a card-network process initiated through the donor’s issuer. An ACH return follows ACH rules and a return code.

Respond quickly.

Check:

For card disputes, assemble evidence that explains the transaction.

Useful evidence may include:

Do not include full card numbers. Do not include sensitive authentication data. Use the processor’s secure dispute portal.

A receipt does not guarantee a favorable dispute outcome. It helps establish what the donor authorized and how the transaction was described.

If the donor requests a refund, process the request under the nonprofit’s policy. Record the decision. If the donor has already opened a dispute, coordinate with the processor before issuing a separate refund. Duplicate credits can create reconciliation problems.

8. Build receipts that support recordkeeping

Receipts serve donors, finance teams, auditors, and dispute operations.

The IRS Publication 1771 addresses charitable contribution substantiation and disclosure requirements. For a single contribution of $250 or more, the publication describes a contemporaneous written acknowledgment from the charitable organization.

The acknowledgment should contain:

This article does not provide tax advice. Use the IRS source and qualified professional advice for tax treatment.

For operational purposes, send receipts for every gift.

A receipt should show:

Keep the receipt tied to the gateway transaction.

Do not let a donor-management system overwrite the original designation. Do not let an accounting import remove the campaign name. Preserve the original transaction record and any later correction.

Receipts also support dispute defense.

They can establish:

9. Preserve restricted and unrestricted designations

A payment record must carry the donor’s designation from the donation page to the general ledger.

Use a controlled data map.

The map should connect:

Do not rely on staff memory.

Do not place a restricted-fund designation only in a free-text note.

Do not combine restricted and unrestricted gifts into one undifferentiated import if the accounting workflow cannot separate them.

The gateway should pass a stable designation value. The donor-management system should preserve it. The accounting export should retain it. Finance should reconcile the designation against the deposit.

Board reporting should show:

Payment technology does not determine the legal classification of funds. Board policy, donor communications, organizational documents, and applicable law govern that analysis.

The payment system must preserve the information required for the organization to apply those controls.

10. Reduce PCI scope for volunteer-run fundraising

PCI DSS applies to entities involved in payment processing, regardless of organization size or transaction volume. The PCI Security Standards Council’s merchant resources emphasize people, process, and technology.

Volunteer-run fundraising requires a simple control model.

Use:

A hosted page can reduce the systems that receive cardholder data. It does not automatically remove the nonprofit from PCI DSS responsibilities. The organization remains responsible for understanding its environment and completing applicable validation.

Do not assume encryption alone makes a system out of scope. PCI SSC states that encrypted cardholder data and systems involved in encryption or decryption may remain in scope.

Requirement 6.4.3

PCI DSS v4.0.1 Requirement 6.4.3 addresses payment page scripts loaded and executed in the consumer’s browser.

The organization should maintain:

Use the official PCI SSC Document Library for the PCI DSS v4.0.1 standard and testing procedures.

Review every script that can affect the payment page.

Remove unnecessary analytics, advertising, chat, and tag-management scripts from the payment path. If a script is needed, document why. Review vendor changes. Restrict who can add scripts to the nonprofit website.

Requirement 11.6.1

PCI DSS v4.0.1 Requirement 11.6.1 addresses change- and tamper-detection mechanisms for payment pages.

The control should alert responsible personnel to unauthorized changes to:

Use the PCI DSS v4.0.1 testing procedures to confirm the frequency and scope of monitoring. A targeted risk analysis may affect the monitoring approach.

Volunteer access

Volunteers should not need access to the merchant account’s full administrative console.

Create separate roles for:

Remove access when a volunteer leaves.

Review terminal inventory after every event.

Do not allow volunteers to use personal devices for card entry unless the solution is approved, secured, and within the nonprofit’s documented payment environment.

Graphic novel illustration of PCI scope control for a volunteer-run nonprofit fundraiser, showing hosted payment pages, secure card terminals, tokenization, script monitoring, role-based access, and a security shield

11. Assemble underwriting documents before applying

A complete application reduces avoidable delays.

Prepare:

Explain unusual volume changes.

A seasonal nonprofit may have a predictable year-end or disaster-response increase. State the reason. Provide historical evidence when available.

Describe settlement needs.

State whether the nonprofit needs:

For transparent cost review, compare the full account structure. Bridge’s pricing page states that its pricing model uses interchange-plus pricing. The page lists a Bridge-published 0.30% Starter markup, 0.20% Growth markup, and $25 per month Growth platform fee, plus interchange. The same page lists Bridge-published $0.25 ACH/eCheck pricing. Confirm current terms in the written proposal.

Review transparent credit card processing pricing before comparing providers.

12. Choose the gateway and merchant account together

A gateway is not the same as a merchant account.

The gateway connects the donation form, virtual terminal, recurring billing engine, and payment data. The merchant account and acquiring relationship support authorization, settlement, risk controls, and funding.

Evaluate both.

Confirm:

Use merchant account features to review features such as recurring billing, reporting, virtual terminal access, ACH or eCheck support, fraud screening, and chargeback management.

Do not select a provider based only on the lowest advertised rate.

Compare:

Ask for a written fee schedule.

13. Launch with a controlled checklist

Complete the following checklist before accepting live donations.

Payment flow

Authorization

PCI controls

Finance and reporting

Underwriting

Final test

Run test transactions for:

Do not launch until the full transaction record reaches the donor record, gateway, settlement report, receipt, and general ledger workflow.

Call 866-305-6454 to review online credit card processing, ACH donations, recurring giving, payment gateway integration, and nonprofit merchant account requirements.

Need Help With Payment Processing?

Talk to our team about rates, gateways, and solutions for your business.

Get a Free Quote →