How it works
The company registers approved originators — payroll provider, tax authority, key vendors — with per-originator caps. Anything else becomes an exception for same-day review, and unknown debits default to return.
Setting the rules well
- Start from 12 months of ACH history to build the allowlist.
- Cap each originator slightly above its normal maximum.
- Review the list quarterly alongside vendor-master changes.
- Treat a request to add a new originator with the same callback verification as a bank-detail change.
Limits
It stops unauthorized pulls, not authorized mistakes — a debit you approved under false pretenses sails through, which is a verification problem, not a filtering one.