Recurring ACH Authorization Records for Studio Memberships

Every month, your studio pulls membership dues straight from a member’s bank account. It feels automatic. It feels safe. Then one day a member disputes a charge, their bank asks for proof, and you scramble through folders and inboxes trying to find the form they signed eighteen months ago. If you can’t produce it fast, the money goes back, and your studio eats the loss.

This is what makes recurring ACH authorizations so important. They are the proof that a member approved automated billing. For any fitness studio, yoga studio, or gym running automated membership billing, these records are the difference between clean, compliant billing and an expensive dispute you cannot win. This guide covers what a recurring ACH authorization must contain, how long to keep it, and how to build a workflow that keeps you compliant.

What Are Recurring ACH Authorization Records?

ACH is short for Automated Clearing House. This system is the core method of electronically sending money to and from bank accounts within the United States. When a member allows you to withdraw funds from their bank account, this is called ACH Authorization. The documentation you retain that provides proof of this authorization is called a recurring ACH authorization record.

ACH authorization provides your company with the right to collect payments from a member for your product and/or service at a predetermined interval. Since authorization is a legal contract, you must retain a record. A record may be a signed paper form, an online form with a timestamp, or an audio recording of the consent. A record must state authorization, the payment schedule, and the method by which the member retains the right to revoke authorization.

Think of it as a receipt for consent. The charge itself lives on the ACH network. The proof of permission lives with you.

Why Recurring ACH Authorization Records Matter for Your Gym

Missing or sloppy paperwork is one of the fastest ways to lose money and, eventually, your ability to process payments at all. Strong recurring ACH authorization records gym owners keep on file protect the business on three fronts.

First, they protect against disputes. In the case of a member submitting a Written Statement of Unauthorized Debit to their bank, you may have to provide valid proof of authorization to the bank in a matter of days. If you fail to provide proof, the bank will return the funds on the basis that the funds were withdrawn without authorization.

The second reason is they protect your processing relationship. Banks and payment services impose threshold return rates, and excessive return rates may have consequences such as charging non-compliance fees, placing a hold on disbursement, reviewing your account, and terminating your ability to process ACH transactions. Solid authorization records are what keep that return rate low in the first place.

The third reason is they protect your members. Proof of authorization helps to reduce fraud and gives customers control. When customers understand the agreement, disputes will decrease and customer trust will increase. In a membership-based business such as a studio, it’s essential to build and maintain customer trust.

What a Compliant Authorization Must Include

A valid recurring authorization goes beyond a mere signature on a blank line. It must articulate relevant terms using simple and clear language. At a minimum, the record must obtain authorization to debit the account, and it must specify that this is not a one-time charge. It must also show the charge and the frequency. It must show to the member that a specific charge will be debited from their account at a specific time. It also must include clear instructions to the member on how to revoke this charge, and state the notice period required to revoke this charge.

Along with these terms, you must include the record itself. For online sign-ups, this means including a timestamp showing the date and time along with the record of the exact language of the charge, and information that connects the charge to the signatory. You must also provide the member with a copy of the agreement irrespective of the means through which the agreement was signed.

The correct SEC code is determined by the means through which consent is obtained. A written consumer agreement signed in person or in paper format uses the PPD code. A signed agreement in the form of an online membership sign-up uses the WEB code. This code also requires account validation and fraud controls. Consent obtained via a phone agreement uses the TEL code, which requires a recording or an approved script along with written confirmation.

How Long Must You Keep Recurring ACH Authorization Records?

Here is the number every studio owner should memorize. You must retain each authorization for at least two years after the authorization is revoked or terminated, or after the last transaction processes, whichever comes later.

The timer doesn’t begin upon member sign-up. It begins on the conclusion of the relationship. In the example of a member who trains with you for 4 years and cancels, you hold that record for 2 additional years after the final charge. Deleting the record earlier is a compliance failure, even if the relationship ended positively.

Storage method is important as well. In most cases, digital storage is the appropriate method, as it is searchable, survives disasters that happen in the office, and can be retrieved in seconds if you get into a dispute. If you choose to store records digitally, use access-controlled, encrypted systems that maintain audit logs, so only appropriate employees can view sensitive banking information. Paper storage is allowed, but it means locked cabinets, restricted access, and a documented chain of custody, all of which get unwieldy once you have a lot of records.

Building a Compliant Authorization Workflow for Studio Memberships

A reliable workflow turns compliance from a scramble into a habit. It starts the moment a member enrolls and runs quietly in the background for the life of the account.

Nacha

Nacha, formerly the National Automated Clearing House Association, writes and enforces the rules that govern the ACH network in the United States. All gyms, studios, banks, and payment processors that use ACH must adhere to the Nacha Operating Rules. Most conversations about “ACH compliance” come back to Nacha. Since Nacha updates these rules yearly, it’s best to review the official Nacha rules resources at least once a year to avoid your studio operating on outdated assumptions.

Collecting the Authorization Cleanly

Capture consent at sign-up, not after the first charge. Present the full billing terms before the member agrees, and record their agreement with a timestamp and identity evidence. Send the member a copy right away. If you enroll members online, validate the bank account on first use to catch typos and reduce failed or fraudulent debits. This upfront care is where most disputes are quietly prevented.

Storing and Retrieving Records

Store all authorizations in a single repository on the same day they’re created. Each record should note the member’s name, enrollment date, and the SEC code. Create calendar alerts for retention period deadlines. The challenge is how quickly you can retrieve the authorizations. When a bank or payment processor requests that you to provide proof, you are often working with only a few banking days to submit. A repository you can search in seconds is significantly better than a filing cabinet. Many studios utilize Plaid’s ACH services or the billing system’s audit logs to maintain this level of organization.

Handling Changes, Cancellations, and Disputes

Memberships change. Prices go up, a member switches plans, or someone freezes their account. Your records have to keep pace.

If the amount of a scheduled debit changes, Nacha’s rules dictate that advance notification to a member must occur ten calendar days prior to the change. For changes of scheduled payment dates, notice must be given at least seven days prior. Failure to give the required notice transforms a scheduled payment to an unauthorized return.

Upon receipt of a member’s request to cancel, all scheduled debits must be stopped. Further payment instructions cannot be given. Documentation must be maintained to show the payment authorization has been canceled. Keep both the original authorization and the cancellation record for the full two-year retention window. If a member asks for a copy of the authorization or a disputed transaction, produce it promptly. Separately, Regulation E sets the federal error-resolution timelines that banks must follow on consumer electronic transfers; the Consumer Financial Protection Bureau publishes those consumer protections in full.

2026 Nacha Rule Changes Every Studio Should Know

Changes to regulations in 2026 mean that studios with automated billing will need to take special care. Nacha has increased expectations for fraud monitoring across its network. Larger originators must document risk-based processes to detect both unauthorized transactions and payments that were deceptively authorized. In addition, they are required to assess these processes at least on an annual basis.

Smaller studios have a much more straightforward takeaway. With the new regulations, there are more obvious consequences for not obtaining compliant authorizations. There will be increased rates of both unauthorized and administrative returns, as well as monetary penalties for failing to provide proof of authorization, and increased fraud risk. There is more focus than ever on keeping the unauthorized return rate within Nacha’s acceptable range. The best way to protect yourself against the three risks is to have a complete set of ACH authorizations.

Common Mistakes Studios Make

The most common compliance error is treating consent as a one-time transaction and having no evidence to justify repeated charges when questioned by a member. Another is deleting information when a member cancels and ignoring the two year rule that starts from the last transaction. Studios also violate the law by hiding cancellation terms within fine print. This makes the authorization appear to be deceptive and invites disputes. Finally, many studios scatter records across separate systems, which makes fast retrieval nearly impossible. Fixing these four issues would solve most of the compliance issues a small studio would ever face.

Conclusion

Recurring ACH authorization records are quiet, unglamorous, and essential. They are the proof that a member agreed to be billed, the shield against costly disputes, and the reason your studio keeps its ability to process payments. The core rules are refreshingly simple to follow. Collect clear consent at sign-up. Give the member a copy. Store the record securely. Keep it for two years after the relationship ends. Notify members before amounts or dates change.

Build those steps into your enrollment process once, and compliance mostly runs itself. Your future self, staring down a member dispute with the exact signed record ready in seconds, will thank you.

Frequently Asked Questions