ACH debit authorization / SEPA Direct Debit mandate
The customer's recorded permission for a business to pull one or more payments from their bank account.
See it
What it is
Before pulling money from a bank account, record the customer's permission. In the US that record is an ACH debit authorization; in Europe it is a SEPA Direct Debit mandate. Each rail has its own wording, notice, recordkeeping, and revocation rules.
Reach for one before initiating a bank debit. Store who agreed, the scope of the permission, the account reference, when and how consent was captured, and the exact terms shown so you can prove the debit was authorized.
Gotcha: authorization is permission, not a funds guarantee, and the clawback windows are long. A SEPA Core direct debit can be refunded on request for eight weeks and up to thirteen months if unauthorized; a US consumer ACH debit can be returned as unauthorized well after settlement. A mandate for one rail is not universal bank-debit consent, so model ACH and SEPA separately and stop future pulls the moment permission is revoked.
Ask AI for it
Implement ACH and SEPA Direct Debit mandates with Stripe SetupIntents using us_bank_account and sepa_debit payment methods. Create an immutable mandate record with customer, rail, one-time or recurring scope, Stripe payment-method token, consent text version, capture method, timestamp, IP or signed-document reference, status, and revocation time. Require an active mandate before creating a Stripe PaymentIntent, process return and dispute webhooks idempotently, and block every future debit immediately after revocation.