ACH Debits Between Businesses in 2026: CCD Entries, Authorization, and Return Windows

This article is general information, not legal, financial, tax, or compliance advice. Bridge Capital Partners does not provide advice on your specific situation. Consult qualified counsel and your financial institution about your agreements and your ACH program.

When one business pulls money from another’s bank account by ACH, the rules that apply are not the ones most people picture. Much of the public conversation about unauthorized ACH debits centers on consumers, whose accounts come with extended return rights. Business accounts follow a different track. This article walks through what Nacha’s own materials say about corporate ACH entries, how return windows differ, and which questions are worth raising with your bank.

What a CCD entry is

ACH entries carry a Standard Entry Class (SEC) code that tells the receiving bank what kind of transaction it is handling. Nacha’s ACH Developer Guide describes the CCD code as “a single or a recurring ACH credit or debit originated to a corporate account,” and lists common uses such as paying vendors, concentrating funds, and funding payroll or disbursement accounts. The same guide labels CCD as corporate-to-corporate, while PPD and WEB are labeled corporate-to-consumer. It also says the SEC code generally indicates whether a transaction is consumer or corporate in nature, meaning which kind of account sits at the receiving bank.

For a company that collects from other companies by ACH debit, such as recurring service invoices or distributor billing, CCD is the code family that fits. For a company that pays its suppliers by ACH credit, CCD is also commonly the right code. Which code applies to a given payment depends on the receiver and the application, and your bank or processor can confirm the correct one.

Authorization on a corporate debit

Nacha’s Originator Essentials guide states that originators must receive permission to debit or credit receivers’ accounts and that “the burden of proof for Authorization is on the Originator.” The developer guide’s description of CCD says an agreement is required for transfers between companies. In practice, that means the paper trail for a business debit is typically a written agreement between the two companies, not a consumer-style authorization form.

Two practical points follow from that language. First, the originating company should be able to produce the agreement if its bank asks for it. Second, the receiving company should know which debits it has agreed to, by whom, and for what amounts or schedules. Whether a specific agreement is sufficient is a legal question for counsel, and Nacha’s materials do not substitute for the full Nacha Operating Rules or for your bank’s own requirements.

Return windows: two days versus 60 days

Return windows are where corporate and consumer entries diverge most visibly. Nacha’s Originator Essentials guide says that corporate SEC codes allow a standard right of return, described as “two days,” while consumer SEC codes allow an extended right of return of 60 days. In a separate FAQ on a different return code, Nacha describes the standard two-day return period as requiring the return to be made available to the originating bank no later than the opening of business on the second banking day after the settlement date of the original entry. That is the general shape of the short window that applies to non-consumer accounts.

The difference matters for planning. A business that originates CCD debits generally faces a much shorter period during which the receiving company can send back an unauthorized entry through the ACH Network than a company originating consumer debits. A shorter network window does not remove other avenues. Contract claims, account agreement terms, and legal remedies sit outside the ACH return mechanism and are determined by the documents and the law that apply to the parties. Ask counsel how those interact in your situation.

The return codes to recognize

Nacha’s page on differentiating unauthorized return reasons explains how the codes are split. It says R10 and R11 “will both be used for consumer Receivers or for consumer SEC Codes to non-consumer accounts,” and that “R29 will continue to be used for CCD & CTX to non-consumer accounts.” The page describes R10 as the customer advising that the originator is not known to the receiver and, in the fuller definition, that the originator is not authorized to debit the account. R11 covers an entry that does not follow the terms of an authorization that exists, such as a wrong amount, and the page gives its return timeframe as 60 days.

Nacha’s Originator Essentials guide lists R05, R07, R10, R11, R29, and R51 as unauthorized returns and says this “means the Originator does not have authorization to debit the account.” For a business originator, the takeaway is that an R29 is a signal that the receiving company says the debit was not authorized, and that it deserves a prompt internal review rather than a reflexive resubmission.

Why the unauthorized return rate matters

The same Nacha guide states that an originator’s unauthorized entries may not exceed 0.5% of its originated entries. It also says Nacha assesses fines to financial institutions and that institutions may contractually pass fines on to originators. The page on differentiating unauthorized return reasons notes that R11 returns count toward the Unauthorized Entry Return Rate, and Nacha publishes a separate resource on how that rate is calculated. Your bank may apply its own monitoring on top of the network rule, so it is worth asking how your bank tracks returns and what its agreement says about pass-through of fines.

Reversals are a separate topic

Businesses sometimes try to fix a mistaken debit by sending a reversing entry. Nacha’s reversals page explains that reversals are limited to permitted reasons, must keep the same company ID, SEC code, and amount as the original entry, and must reach the receiving bank within five banking days of the erroneous entry’s settlement date. An improper reversal can be returned; for non-consumer accounts the page names return code R17 with a two-day window. We discuss recall mechanics across payment types in our article on recalling a B2B payment, and the broader network framework in our article on Nacha fraud monitoring rules.

Questions to bring to your bank

• Which SEC code will our debits to other businesses carry, and how does the bank confirm it is correct for each receiver?
• What authorization or agreement documentation does the bank expect us to keep, and for how long?
• How will we be notified of R29 and other unauthorized returns, and how quickly?
• How does the bank monitor our unauthorized return rate, and what does our agreement say about fines or fees passed through?
• On the receiving side, how does the bank help us review incoming debits, and what is the cutoff for sending an unauthorized entry back?

Sources

• Nacha, ACH Guide for Developers: ACH File Details
• Nacha, Risk Management Advisory Group: Originator Essentials
• Nacha, Differentiating Unauthorized Return Reasons
• Nacha, ACH Network Rules: Reversals and Enforcement
• Nacha, Risk Management Topics (October 1, 2024)

Disclaimer: This content is educational and based on publicly available Nacha materials as of the date of publication. Rules change, and the full Nacha Operating Rules and your own agreements control. It is not legal, financial, or compliance advice, and it is not a recommendation to take or avoid any action.