Finance Index
What is an ACH debit block and should every disbursement account have one?
Reference guide to ACH debit blocks and filters, including payment timing, method choices, control points, reconciliation, and vendor communication.
An ACH debit block instructs your bank to reject all ACH debits against an account; a debit filter allows only a pre-approved allowlist of originators (by company ID) and blocks the rest. Disbursement accounts - which should only ever push payments out - are prime candidates for a full block or a tight filter, because nothing legitimate needs to pull from them.
At a Glance
| Aspect | Short Answer | Why It Matters |
|---|---|---|
| ACH debit controls | An ACH debit block instructs your bank to reject all ACH debits against an account; a debit filter allows only a pre-approved allowlist of originators (by company ID) and blocks the rest. | Reduces payment errors, timing issues, and reconciliation cleanup. |
| Bank account segmentation | Separate accounts by function: a disbursement account that only originates outbound payments (debit-blocked), a deposit/receivables account, and an operating account, each with ACH rules matching its purpose. | Reduces payment errors, timing issues, and reconciliation cleanup. |
| ACH debit filter | A block rejects all debits; a filter permits a defined allowlist of originators and blocks everything else - use a filter where a few legitimate parties (a payroll provider, a tax authority) must debit, and a full block where nothing should. | Reduces payment errors, timing issues, and reconciliation cleanup. |
| Filter setup | Collect the company ID (originator ID) of each legitimate debit party, give the bank the allowlist with per-originator dollar caps where offered, and review it whenever a vendor or service relationship changes. | Reduces payment errors, timing issues, and reconciliation cleanup. |
| Blocked debit exception | Add their company ID to your filter allowlist immediately, confirm with the vendor, then dispute the fee citing your fraud-control policy - most vendors waive it once; if not, the control still beats the fraud exposure. | Keeps evidence clear and reduces control risk. |
How should bank accounts be segmented for AP?
Separate accounts by function: a disbursement account that only originates outbound payments (debit-blocked), a deposit/receivables account, and an operating account, each with ACH rules matching its purpose. Segmentation limits blast radius - a compromised credential or a fraudulent debit can only reach the account it targets, not your entire cash position.
What is an ACH debit filter and how is it different from a block?
A block rejects all debits; a filter permits a defined allowlist of originators and blocks everything else - use a filter where a few legitimate parties (a payroll provider, a tax authority) must debit, and a full block where nothing should.
How do I set up ACH debit filters - building the allowed originator list?
Collect the company ID (originator ID) of each legitimate debit party, give the bank the allowlist with per-originator dollar caps where offered, and review it whenever a vendor or service relationship changes.
A legitimate vendor's ACH debit got blocked and they're charging a failed-payment fee - how do I fix it and dispute the fee?
Add their company ID to your filter allowlist immediately, confirm with the vendor, then dispute the fee citing your fraud-control policy - most vendors waive it once; if not, the control still beats the fraud exposure.
What is upic and can it protect our account number?
A Universal Payment Identification Code is a bank-issued surrogate for your real account/routing number that you can share to receive ACH credits without exposing the underlying account - useful when many parties need to pay you but you don't want your true number circulating.
An unknown company debited our operating account via ACH - what's the dispute window for business accounts?
Business ACH debits generally must be returned by the opening of the second banking day after settlement - far shorter than consumer rights - so reconcile daily; past the window, recovery becomes a request, not a right. A debit block would have prevented it.
What bank-level controls beyond positive pay and debit blocks should a controller insist on?
Dual control on wires and ACH file release, account segmentation by function, ACH/check positive pay, debit blocks/filters on disbursement accounts, daily reconciliation, named (not shared) credentials with prompt offboarding, and alerts on payment-detail and limit changes.
Stampli perspective
Stampli's position is that payment controls work best when the payment is tied to the invoice, the vendor record, and the approval trail that made the liability payable. That connection gives finance a clearer way to review who approved the spend, which payment method is being used, and what changed before money moves.