ACH authorizations

ACH authorizations help you control which vendors can pull funds from your Mercury account using ACH debits (also called ACH pulls). While most ACH transactions involve strong verification (like microdeposits or Plaid), some banks may accept less robust verification methods—such as a voided check—which can carry a small risk of fraud.

To help prevent unauthorized debits, we recommend enabling ACH authorization in your Mercury account. 

How ACH authorizations works

When ACH authorization is enabled by admins:

• ACH pulls from unauthorized vendors will be flagged for review
• Pulls that exceed your set limit for an authorized vendor will also be flagged
• You’ll have a chance to approve or decline flagged transactions before they’re processed
• If you take no action during the review window, the pull will be approved automatically. Admins can change this default behavior in the Controls settings
   

Enabling ACH authorizations

1. Go to your ACH Authorizations page
2. Click Get Started from the box in the middle of the screen
3. You’ll be prompted to authorize your first vendors immediately. You can also do this later if you don’t have the vendor info handy just yet
4. Follow the prompts to complete setup and enable ACH authorization

If you no longer want to require ACH authorization, you can disable the feature from your Controls settings.

When setting up this feature, we recommend authorizing all of your most crucial vendors to ensure critical payments are processed quickly and correctly. Note that while you'll usually have about 1 business day to review and action pull requests, the approval window for same-day ACH pull requests can be much shorter (less than an hour) in some cases.

Authorizing vendors

1. Go to your ACH Authorizations page
2. Select the vendor from your list of recent ACH pulls, or add a new vendor
3. You’ll also be asked for a few additional details:
   1. ACH Company ID (also known as ACH Originator ID or Vendor ID) : This is usually either provided by the vendor or found on their website/portal. Some vendors may have more than one ACH Company ID
   2. Pay-from account: Select the account(s) you want your vendor to pull from
   3. Transaction limit: You can set an optional limit to control how much a vendor can pull in a single transaction. If no limit is set, they’ll be authorized to pull any amount
4. Review the authorization details, then click Authorize
    

Some vendors, like Stripe, may use one or two Company IDs for all of their merchants. Because these IDs are not unique to individual merchants, authorizing one may allow ACH pulls from multiple businesses using those platforms. Stripe Company IDs: 1800948598, 4270465600

Managing ACH authorizations

You can view a list of all currently active ACH authorizations on your ACH Authorizations page. From here, you can edit authorization details like: changing limits, adding company IDs, and authorizing vendors for multiple bank accounts. To remove an ACH authorization, click on the trash can icon.

If the ACH authorizations feature is enabled but no vendors are added, every ACH pull will be flagged for your review.

Reviewing flagged ACH pulls

When an unauthorized vendor initiates an ACH pull—or when an authorized vendor exceeds the transaction limit you've set—the payment will be flagged for review.

You’ll be notified through:

• Email: Includes vendor names, amounts, and the number of flagged transactions. Multiple transactions may be grouped.
• Tasks: Flagged pulls appear here on both desktop and mobile.
• Flagged tab in ACH Authorizations: Shows all pending reviews and the remaining time to take action.

You can action flagged payments from the Tasks page, the Flagged tab, and your ACH Authorizations page. If no action is taken before the review window ends, the payment will be automatically approved or rejected based on your default settings (visible in the Flagged tab).

To allow future payments from the same vendor, you can quickly authorize the vendor by clicking on the flagged transaction and selecting Authorize vendor for future pulls.