ACH Payments for CBD Stores: A Backup When Cards Get Cut

On this page 6 sections

1. Where ACH Payments for CBD Fit in a Hemp Business
2. eCheck or Pay by Bank: Picking a Checkout Flow
3. The Nacha Return Limits That Decide Whether You Keep ACH
4. Worked Example: What 300 Bank Orders a Month Really Cost
5. Getting Shoppers and Subscribers to Pay by Bank
6. Set up the Second Rail Before the Termination Letter

Key takeaways

• Nacha caps unauthorized returns at 0.5% of debits over the preceding 60 days. A store debiting 300 orders a month can absorb only about three in that window, and some providers allow fewer.
• Insufficient-funds returns (R01) count only toward the 15% overall limit. The 3% administrative limit covers closed, missing and invalid accounts.
• Online-authorized consumer debits need first-use account validation, and in 2026 Nacha began requiring documented fraud monitoring from merchants that originate ACH debits.
• Apply for ACH while your card account is in good standing, and describe your products the same way on every application.

ACH payments for CBD stores let customers pay straight from a checking account, so a hemp shop can keep taking online orders if its card processor cuts it off. Bank payment is a second rail that sits beside cards. It doesn't replace them: most shoppers still reach for a card, and ACH providers underwrite CBD merchants just as card acquirers do. The stores that get real value from ACH set it up while their card account is still healthy and keep returns well below Nacha's limits. On the bank rail, returns are what get accounts closed.

If you're reading this after a termination letter, deal with the money first. Our guide to getting held funds back after a processor drops your CBD store covers that.

Where ACH Payments for CBD Fit in a Hemp Business

CBD and Delta 8 sellers get reviewed more often than most merchants. Product legality varies by state and can change with federal law, and autoship programs attract disputes. When cards are the only rail, a termination stops checkout and fails every subscription renewal on the same day. Meanwhile, the old processor may hold your funds while it reviews the account.

ACH runs on the same network that moves payroll, so almost any U.S. checking account can be debited through it. It won't rescue a business that can't pass underwriting, though. ACH providers answer to sponsor banks, and those banks want accurate product descriptions and current lab results just as a card underwriter does.

ACH is a second compliant rail, not a hiding place. If a card processor declined you because of your products or your website, fix that first. The bank rail will find the same problems.

eCheck or Pay by Bank: Picking a Checkout Flow

"eCheck" and "ACH debit" describe the same payment. The customer authorizes you to pull funds from their checking account, and the money settles through the ACH network over the next few business days. The two checkout flows differ in how you collect the bank details, and that difference drives most of your return risk.

With manual entry, the customer types a routing number and account number, much like filling out a paper check. It's the easiest option to add through a gateway, but it has the most friction, and every typo turns into a returned debit for a closed or nonexistent account. Nothing proves the person typing owns the account unless you add a verification step.

With pay by bank, the customer logs in to their bank through an account-linking service and picks an account. The service confirms the account exists and, depending on the tool, checks the balance. For Delta 8 and hemp orders, this flow usually converts better than manual entry and cuts bad-account returns. Before you sign, confirm that the linking service's own policies allow hemp-derived products, because some don't.

Pick the flow that fits your customers. If most of your bank payers will be existing subscribers, manual entry plus a validation step can be enough. If you want first-time buyers to pay by bank, account linking is worth the extra cost. Neither flow changes your duties on age verification tools for Delta 8 checkout or blocking banned states at checkout.

ACH suits autoship because bank accounts don't expire the way cards do. Recurring debits still need clear terms, a saved record of the customer's consent and an easy way to cancel. Our guide to billing CBD subscriptions and autoship walks through those terms.

The Nacha Return Limits That Decide Whether You Keep ACH

Nacha writes the operating rules for the ACH Network. It is a private rule-making body, not a government regulator. Its rules bind you through the chain of agreements that runs from you to your ACH provider to the provider's sponsor bank. They are network rules, not law, but breaking them can end your ACH access just as surely.

Nacha sorts debit returns into three buckets. Its risk and enforcement page notes that it lowered the unauthorized threshold from 1.0% to 0.5%. Each rate is measured against debits originated over the preceding 60 days or two calendar months, as Nacha's unauthorized return rate worksheet explains. A single month is not the measurement period.

Nacha has also said that R11 returns, where the customer says a debit didn't match the terms they agreed to, count toward the unauthorized rate. If you go over a level, the sponsor bank can add monitoring, review your entries more closely or suspend your ability to originate debits, and Nacha can open an investigation. Providers can also set tighter internal limits or measure over different windows, especially for high-risk merchants. Ask for the exact numbers in writing.

Insufficient Funds Is Not an "Administrative" Return

People often lump insufficient-funds returns in with administrative ones, but they're separate. The 3% administrative bucket covers bad account data: accounts that are closed (R02), can't be found (R03) or have an invalid number (R04). Insufficient funds (R01) counts only toward the 15% overall level.

The distinction tells you which tool fixes which problem. Account validation shrinks the administrative bucket. Balance checks and sensible debit timing reduce NSF returns. Clear descriptors and honest subscription terms shrink the unauthorized bucket, and that bucket has the least room.

Timing matters too. Returns for bad accounts or insufficient funds usually come back within a few business days. Consumers get a much longer window, often weeks, to claim a debit was unauthorized, so confirm the current timeframes with your provider. A card chargeback can be disputed through representment, but an unauthorized ACH return has no such process inside the network. You have to settle it with the customer directly. If you ship the moment an order lands, a late return can cost you both the product and the money. Many hemp sellers hold fulfillment briefly for first-time bank payers, or ship right away only when account validation passes.

Validation and Fraud Monitoring Are Required

Since March 19, 2021, Nacha's WEB debit account validation rule has required originators to validate a consumer's account the first time they debit it for a payment authorized online. The rule doesn't dictate a method. Account-linking flows usually satisfy it, while manual entry needs a separate check, such as a validation service.

Nacha's 2026 fraud monitoring rule goes further. It requires non-consumer originators, a group that includes merchants, to keep risk-based processes designed to spot entries initiated by fraud. Phase 1 took effect March 20, 2026, for organizations that processed more than 6 million ACH payments in 2023. Phase 2 covers everyone else regardless of volume and has a practical compliance date of June 22, 2026.

For a hemp store, that means screening you can document. Match the shipping name to the account holder, flag rushed orders and repeated failed attempts, and use a billing descriptor customers recognize. Unrecognized debits drive unauthorized claims the same way they drive card disputes, so the approach in our guide to CBD chargebacks and unrecognized charges carries over.

Worked Example: What 300 Bank Orders a Month Really Cost

These numbers are illustrative only. They are not quotes or typical rates. Assume a CBD store moves a steady 300 orders a month to bank payment, with a $90 average order and $35 in product cost per order. Its hypothetical high-risk card pricing is 5% plus $0.30. Its hypothetical ACH pricing is $1.00 per debit and $10 per return, and 2% of bank orders come back after the product has shipped.

Even before counting card chargeback costs, ACH comes out $870 cheaper here. A fulfillment hold for new bank payers would cut the $210 product loss further.

Now run the returns through Nacha's buckets, using its 60-day window. At a steady 300 debits a month, the window holds about 600 debits and 12 returns. That's 2%, far under the 15% overall level. The unauthorized bucket is much tighter, because 0.5% of 600 is three. Two unauthorized returns in the window put the store at 0.33%. Three put it right at the line, and a fourth takes it to 0.67%, over the limit.

Provider limits can be stricter still. Some ACH providers set their own unauthorized limits below Nacha's 0.5%, so this store could cross its provider's line before it ever reaches Nacha's. Lower volume also shrinks the denominator. At 150 debits a month, two unauthorized returns over 60 days already equal 0.67%. A backup rail often carries modest volume, so a couple of confused customers can be the difference between a cheap second rail and a warning letter. Ask your provider which window and limits it uses, and track your own numbers weekly.

For the card side of this math, see CBD credit card processing fees, reserves and hidden costs. ACH providers can also hold reserves or delay funding for new high-risk merchants, and how rolling reserves work applies on either rail.

Getting Shoppers and Subscribers to Pay by Bank

Put bank payment next to the card fields with a plain label like "Pay from your bank account." Don't hide it behind a "more options" link.

Some merchants offer a small discount or loyalty points for paying by bank. Frame it as a discount for bank payment, not a surcharge on cards. Confirm the setup with your provider and an attorney, because card network rules and state laws both govern how you price card payments.

Subscribers are your best candidates. Invite them to switch before you need them to, and explain that it keeps shipments coming if anything changes with card processing. If first-time bank orders ship only after validation, say so at checkout and in the confirmation email. Use the same business name on bank statements, receipts and your website. Expect most new customers to keep choosing cards, since bank payment does best with repeat buyers and larger orders.

Set up the Second Rail Before the Termination Letter

Approval and integration take time, so apply for ACH while your card account is in good standing. Describe your products, hemp sourcing and THC compliance the same way on every application, and keep your certificates of analysis that processors expect current. The website claims that get CBD merchant accounts shut down will sink an ACH application just as fast, so remove health and efficacy claims. For the permits to have on hand, see our guide to hemp retail licenses processors ask for by state.

Never route around a decline. Running sales through another company's account, splitting orders or describing hemp products as something else breaks network and bank rules and can put you on industry termination lists. Reconcile each rail separately, since ACH deposits, returns and fees arrive on their own schedule.

Hemp law affects both rails. Legality varies by state and under federal law, so read what the federal hemp THC ban means for your merchant account and confirm your situation with a qualified attorney. Nothing here is legal or tax advice. If you sell hemp beverages, see our guide to payment processing risks for THC seltzers and hemp drinks. If you sell at a fuel counter, see selling Delta 8 at a gas station and the risk to your card account. For in-store sales, see our guide to choosing a POS system for CBD and Delta 8 shops.

This week, pull your last 90 days of orders and count the repeat buyers and subscribers you could move to bank payment. Then ask each ACH provider you're considering three things in writing: its unauthorized and administrative return limits and the window it measures them over, how it validates first-use accounts, and what it holds in reserve. MannyPay offers CBD and Delta 8 merchant accounts, high-risk payment processing and payment gateway options including Authorize.net and NMI. Request a free quote and a MannyPay specialist will respond within one business day. Approval depends on underwriting.

Sources

1. Nacha: ACH Network Risk and Enforcement Topics
2. Nacha: Calculate Unauthorized Return Rate
3. Nacha: Supplementing Fraud Detection Standards for WEB Debits
4. Nacha: Account Validation Resource Center
5. Sila: ACH Returns
6. Sumsub: Nacha Operating Rules: A Guide for Businesses Using the US ACH Network
7. Eco: ACH Return Codes: The Complete R01 to R85 List Explained
8. Plaid: ACH Return Codes: A Complete Guide for Businesses
9. Bottomline: 2026 Nacha Compliance: The Rules, the Risks, and How to Prepare
10. Stampli: Nacha Operating Rules: How AP Teams Should Prepare for 2026
11. Kyriba: Nacha 2026 Fraud Monitoring Rule Changes FAQs
12. Oscilar: NACHA Rules Explained: What Changed in 2026

MB

About the author

Marcus Bennett

Marcus Bennett is Payments Risk & Compliance Analyst for Beyond the Swipe, covering high-risk processing, chargebacks, rolling reserves, frozen merchant accounts and fraud prevention.

This article is for general educational purposes and is not legal, tax or financial advice. Card network rules and state laws change; confirm current requirements for your business.