An ACH limit increase is a business client's request to originate more by ACH than its current limits allow: a higher approval limit for one user, a higher daily or per-file origination limit for the company, or larger Same Day ACH payments. The bank can grant the first quickly once the request is verified; the second needs a credit decision, because the Nacha Operating Rules require the bank to set and review an exposure limit for every originator; the third is capped by the network itself. Most of the elapsed time on a request goes not on the decision but on finding the approved limit, reaching the client on a number already on file and getting a second approval. Botminds' Treasury Management Client Services puts the approved exposure limit, its last review date and the highest day actually used beside every request, so a specialist can tell in seconds whether a rise is a maintenance change or a credit question.
The examples come from a fictional credit union running the solution on sample data. The rules come from Nacha, which writes the ACH Operating Rules, and from the bank examiners' own handbook.
One limit request, by hand and with the agents: most of the hours are waiting for a callback
- Reading55 min
- Checks45 min
- Channel check and callback4 h
- Approval40 min
- Reading and checks: 5 min
- Callback40 min
- Make, approve: 10 min
What an ACH limit increase request actually asks for
Clients write "please raise our ACH limit" and mean one of three things, sometimes all three. The specialist's first job is to say which, because each is decided by a different person on different evidence. The sample forged request on the credit union's desk asked to raise one controller's ACH approval limit from $150,000 to $400,000. It read as a user change; it was in fact a request to approve more in a day than the client's whole approved daily exposure.
Genuine requests are usually driven by an event: a payroll that grows with a seasonal hire, a large supplier payment, a tax payment, an acquisition. The event matters, because the examiners' procedures expect a limit to move with the client's activity and credit, and because an event that cannot be named is itself a warning sign. A client that has never paid more than $214,550 in a day asking for $400,000 by Friday deserves a question before it deserves a form.
Approval limit, exposure limit, Same Day ACH cap: three limits called one
Three different limits sit behind the word "ACH limit", set by three different parties. Treating them as one is how a maintenance change ends up granting credit that nobody underwrote.
Three ACH limits, three owners: which one a request is really about
| Limit | What it caps | Who sets it | How it changes |
|---|---|---|---|
| Approval limit, per user | What one of the client's users may approve in a file or a day | The client's administrators, within what the bank allows; the bank on request | A maintenance change: verified, made by one specialist, approved by a second |
| Exposure limit, per client | The most the client may originate, for debits and credits, over a day or several settlement dates | The bank, as a credit decision, reviewed periodically | A credit decision at an originator review, not a maintenance change |
| Same Day ACH cap, per payment | The largest single payment eligible for same-day settlement | The Nacha Operating Rules, for the whole network | Only by a rule change: $1 million today, $10 million from September 17, 2027 |
What is an ACH exposure limit?
An exposure limit is the most a bank will let an originator send into the ACH Network, set from the originator's credit and its normal activity. The examiners' glossary defines it as the ceiling on what an originator may send, sized from its credit standing, its past or expected funding needs and the kind of payment (FFIEC IT Examination Handbook, Retail Payment Systems, glossary); how to calculate an ACH exposure limit works the arithmetic through on a sample originator.
The requirement is Nacha's. Its risk staff summarize the rule this way: every bank must set, apply and periodically review a limit for each originator and each third-party sender it serves, watch origination and returns across several settlement dates and by type of entry, and enforce the limit; a third-party sender owes its own originators the same (Nacha, Why are Exposure Limits So Important?, March 26, 2025). Because the Rules book itself is licensed, that staff restatement is the clearest public text.
"Exposure limits are controls which prevent anomalies from exiting the financial institution or TPS without a review and confirmation by the originating customer."
Nacha Risk Management Advisory Group, March 26, 2025
That sentence explains why a limit request belongs on a verification desk at all. The limit is the point at which an anomaly stops and someone calls the client. A request to raise it is a request to move that point, and it deserves the same scrutiny as the anomaly it would let through.
Same Day ACH limit increase: $1 million now, $10 million from September 17, 2027
The Same Day ACH per-payment cap is a network rule, not a bank or client setting, and it is about to rise again. Nacha announced on April 27, 2026 that its members had approved a rule raising it from $1 million to $10 million: "The increase takes effect Sept. 17, 2027, and will be the third increase in the history of Same Day ACH" (Nacha, April 27, 2026). Nacha moved the date from a proposed March 19, 2027 to September 17, 2027 to give participants more time (rule page).
The Same Day ACH per-payment cap has risen three times; the client's exposure limit still governs
$25,000
the initial Same Day ACH maximum per payment
$100,000
from 2020
$1M
from March 2022: the cap in force today
$10M
from September 17, 2027, approved April 27, 2026
For the desk, the practical point is that a network increase will bring requests. Clients who read that Same Day ACH payments can reach $10 million will ask for higher limits, and some of those asks will be forged. A rise in the cap changes eligibility; it does not change the client's credit, and it should not change a single exposure limit without a review.
Who approves an ACH limit increase?
Who approves depends on which limit moves. An approval limit within the client's existing exposure is a maintenance change: the client's authorized administrator asks through an allowed channel, the bank verifies it by callback, one specialist makes it and a second approves it. A rise in the exposure limit is a credit decision, approved under the bank's credit authority, usually by treasury management credit or the relationship's credit officer, with the documentation any credit change carries.
The supervisory guidance treats it as credit in so many words. The OCC tells banks to underwrite ACH origination as they would any other extension of credit (how examiners apply OCC Bulletin 2006-39 sets out the full list), and says underwriting standards should "Provide guidelines for setting exposure limits, including requirements for pre-funding or collateral requirements" and "Establish overlimit monitoring and approval" (OCC Bulletin 2006-39). The bulletin remains active; in March 2025 the OCC struck only its references to reputation risk.
Does an ACH limit increase need a credit review?
An increase in the exposure limit does; an approval limit that stays inside the existing exposure usually does not. Examiners check both halves. Their procedures direct them to "Determine whether the ODFI reviews exposure limits periodically," whether rising debit returns prompt the bank to look at the limit again, and whether the limit makes sense against everything else the bank has extended to the same client, from loans to foreign exchange (FFIEC IT Handbook, Retail Payment Systems, Appendix A). The return trigger is traced in ACH return rate calculation; the whole-relationship test in the ACH exposure limit guide.
That last test is why the check has to happen where the request arrives. The approval limit lives in digital banking administration; the exposure limit and its review date live in credit or the payments hub; the client's loans live somewhere else again. A specialist who cannot see all three cannot tell whether a "small" approval-limit change has quietly taken the client past what credit approved. Return activity is part of the same picture; the unauthorized return rate threshold sets out the network level at which an originator's returns become a rules problem.
The sample client's limits: room to spare on every one, until the request
A limit cannot rise above what was underwritten: the request, against the limits of record
Where the hours go on one request
On Botminds' estimate for one maintenance request handled by hand, roughly four of six hours are elapsed time on the channel check and the callback: finding the right number, reaching the client, and waiting for them to call back. The remaining two hours are work: reading the request, finding the agreement and the limits in different systems, deciding whether the requester may ask, checking the exposure, making the change, getting a second approval and writing it up for audit.
The agents compress the work, not the callback. Reading, document retrieval, the authority check and the limits check fall to minutes because the agents do them before a specialist opens the request, and cite what they found. The callback still takes a person and a client; it shrinks only because the number, the script and the read-back are prepared, and because the client is called once rather than chased through a switchboard. That is why the design target is four hours from arrival to a verified, approved change, not four minutes.
The order matters as much as the speed. Checking the exposure limit before the callback means the specialist does not ask a client to confirm a change the bank cannot make as maintenance. On the forged request the limits check failed independently of the channel and the callback, so even a genuine controller would have been told that a $400,000 approval limit needs an originator review first. What the callback must prove covers the other half of the request.
How long does an ACH limit increase take?
An approval-limit change inside the existing exposure can be verified and made the same day: the sample credit union responds within four business hours and escalates at 80% of that clock. An exposure-limit increase takes as long as the bank's credit process takes, because it needs current financials, an updated view of the client's other exposures and a credit approval. Telling the client which of the two they have asked for, on the first reply, saves most of the frustration.
Two things lengthen both. A request from a channel the agreement does not allow must be confirmed through one it does, and a client who cannot be reached on the number on file cannot be verified. Neither is a reason to skip a step; both are reasons to tell the client early what the bank needs.
Why the limit is the last line when an account is taken over
When a fraudster controls a client's login, the exposure limit is often the only control left that does not depend on the login. Nacha's advisory group gives the example of a vendor in "an account takeover situation with a fraudster": "If only prefunding is required and money is in the account, the fraudster may drain the account with large fraudulent credits leaving the financial institution before the Originator is aware" (Nacha RMAG).
The FBI sees the same pattern at scale. Its 2025 report describes account takeovers that fire fifty or more ACH payments at once to accounts at several banks (FBI IC3, 2025 Annual Report; payment recovery software follows what happens after them). Against fifty simultaneous credits, a daily limit is a ceiling the fraud hits in minutes; a raised limit, granted on a forged email the week before, removes the ceiling. The FFIEC's 2021 guidance names the same family of controls for digital banking: "Transaction controls, such as transaction value limits, restrictions on devices for adding payment recipients, limits on the number of transactions allowed per day, and allowable payment windows" (FFIEC, Authentication and Access, 2021).
The ACH Network carried 35.2 billion payments worth $93 trillion in 2025 (Nacha). At that scale a bank's protection is not the network but its own limits, set per client and moved only on evidence. How limits ride on entitlements explains why one user's approval limit and the client's exposure are checked together, and where client services software fits among a bank's treasury systems covers the systems the check has to read. To see a limit request run end to end, start from Treasury Management Client Services.
Questions people ask
How do I increase the ACH limit for a business account?
Ask through a channel your treasury agreement allows, such as the secure message center or an authorized administrator's email on file, and say which limit and why: one user's approval limit, the company's daily origination, or Same Day ACH. Expect a callback on the number the bank already holds, and expect a credit review if the rise exceeds your approved exposure.
Can the bank raise my ACH limit the same day?
Often, if it is a user's approval limit inside the company's existing exposure and the request verifies cleanly. A higher exposure limit is a credit decision and runs on the bank's credit timetable.
Does the Same Day ACH limit increase raise my company's limit?
No. The Nacha cap of $1 million per payment, rising to $10 million on September 17, 2027, decides which payments may settle the same day. Your bank's exposure limit for your company still caps what you can originate.
Why does a limit increase need a callback if I sent it from my own email?
Because the bank cannot tell from the email alone that you sent it, and a raised limit is valuable to anyone who has taken over an email account. The callback goes to a number the bank held before your request, which an impostor cannot answer.
What is an ACH approval limit?
A per-user ceiling on what that user may approve, set as part of the user's entitlements. It sits under the company's exposure limit; a user's approval limit above the company's exposure, as in the sample request, cannot be granted as a maintenance change.