FirstHR

Payroll Direct Deposit: A Guide for Small Employers

How to set up direct deposit for employees: what you need, what it costs, whether you can require it, and the consent rules most employers get backwards.

Nick Anisimov

Nick Anisimov

FirstHR Founder

Payroll•
•
19 min

Payroll Direct Deposit

How to set it up, what it costs, whether you can require it, and the consent rules that are actually a records problem rather than a payroll one

Every guide to payroll direct deposit is written by a payroll company, and every one of them arrives at the same conclusion: use their payroll company. That is not dishonest, but it does mean the parts they gloss over are the parts you most need. This guide walks you through the setup, the timing, and the cost, and then through the two things those guides skip.

The first thing they skip is the single most misunderstood point in this subject: federal banking law does not stop you from requiring direct deposit. What the Electronic Fund Transfer Act (EFTA) actually prohibits is requiring an employee to bank at an institution you choose. The real limits are the Department of Labor's cash or check expectation and state law, and most owners have never looked up either one.

The second thing they skip is where the real work lives. Setting up direct deposit is a payroll task, and it takes an afternoon. Collecting a signed authorization from every employee, storing it somewhere defensible, and still having it years after they leave is a records task, and New York, for one, requires exactly that. It never ends, it is entirely on you, and your payroll provider will not do it.

I wrote this for a small US business with no HR department. FirstHR is not a payroll processor and does not move money; your payroll provider runs the ACH (Automated Clearing House) transfers. I build the layer that collects the authorization forms and keeps signed consents on file for as long as your state requires. General information, not legal advice.

TL;DR
Direct deposit moves wages through the ACH network, settling in one to two business days, so your cutoff sits days before payday. Federal banking law bans only requiring a specific bank, the Department of Labor expects a cash or check option, and states add consent rules. The written consent many states require is a records obligation that outlives employment.

What Direct Deposit Is

Payroll direct deposit is the electronic transfer of wages from your business bank account into your employee's bank account. No paper, no signing, no distributing, no reconciling checks that were never cashed.

Definition
Payroll Direct Deposit
Payroll direct deposit is the electronic payment of wages from an employer's account to an employee's account through the ACH network, which the Federal Reserve describes as a nationwide system for sending batches of electronic credit and debit transfers between depository institutions. It runs under the Nacha Operating Rules. The employer, acting as the originator, submits payment instructions through their bank or payroll provider. The instructions are routed through ACH to the employee's bank, which credits the account on the settlement date. Setting it up requires the employee's bank routing number, account number, account type, and, in many states, a signed written authorization.

The thing worth internalizing early is that you are not moving the money. You are submitting instructions to a network that moves the money on its own schedule, under its own rules, with its own timelines. That distinction explains almost everything that surprises employers about direct deposit, starting with why the deadline is so far ahead of payday, and it interacts directly with your pay schedule.

Payroll EFT, ACH, and direct deposit: what each term means

Payroll EFT stands for electronic funds transfer, and it is the umbrella term for moving wages electronically rather than a separate product you buy. ACH is one rail inside that category. Direct deposit is the specific ACH credit that lands wages in an employee's account. Three words, one payment, described at different levels of zoom.

The distinction shows up in one practical place, which is your bank statement. A payroll debit often posts as an EFT or an ACH entry rather than as anything labeled payroll, which is why an owner reconciling the account cannot always find the run they submitted three days ago. It is there, under the network's name rather than yours.

What a direct deposit voucher is

A direct deposit voucher is the pay statement an employee receives instead of a check: gross pay, hours, each deduction, taxes withheld, net pay, and the account the money landed in. Payroll systems also call it a direct deposit advice. It cannot be cashed, because the money has already moved.

Going paperless does not, on its own, settle whether you still have to hand one over. According to the Department of Labor's FLSA Advisor, its online guide to the Fair Labor Standards Act, federal law requires you to keep accurate payroll records but not to issue a pay stub.

Whether a voucher is mandatory, and whether you may deliver it electronically, therefore comes from state law. Check yours before you switch off paper, and keep the pay stub rules separate in your mind from the payment.

How the Money Actually Moves

Direct deposit passes through four parties, one of which is you, and you control exactly one step.

Where the money actually goes
You, the originatorYour payroll provider submits a file of payment instructions on your behalf. This is the only step you touch.
Your bank (the ODFI)The Originating Depository Financial Institution takes the instructions and pushes them into the ACH network.
The ACH networkA batch clearing system operated under Nacha rules. It sorts payments and routes them to the receiving banks. This is where the one to two day lag lives.
Their bank (the RDFI)The Receiving Depository Financial Institution credits the employee's account on the settlement date.
Notice how little of this you control. You submit a file and wait. The lag is not your payroll provider being slow; it is a batch clearing network doing what batch clearing networks do. Which is why your submission deadline is not a suggestion.

The ACH network is a batch system, not a real-time one. Payments are collected, sorted, and settled in cycles rather than instantly. That design is the reason for the one to two day standard settlement, and it is why your payroll provider imposes a cutoff several days before your pay date.

Same-day ACH exists, and some providers offer next-day or same-day funding, generally at a premium and often with limits. But the default, and what almost every small employer runs on, is the standard batch timeline. Plan around it rather than fighting it, and remember that it sits on top of the lag you already have from paying in arrears.

How an ACH payroll payment clears

Your provider builds an origination file: one batch of credit entries, each carrying a routing number, an account number, and an amount, plus the offsetting debit against your own account. The batch header carries an effective entry date, which is the day you intend the money to land, and your bank passes the file to an ACH operator ahead of it.

The operator sorts the batch by receiving institution and delivers each entry in the next distribution window. The receiving bank posts the credit on the settlement date, and that is the day the money appears. None of it runs continuously, which is why ACH payroll carries a lead time instead of clearing on demand.

Why Employers Use It

The honest answer has three parts, and only one of them is about cost: it is cheaper, it takes payday admin off your plate, and it is what people expect from an employer.

Direct depositPaper check
Cost per paymentCents, and often bundled into your payroll feeCheck stock, printing, signing, envelopes, and postage
Your time on paydayZero, once it is set upPrint, sign, distribute, chase the ones nobody collected
Lost or stolenNot a category. There is nothing to loseA real and recurring problem, with a stop-payment fee each time
Remote employeesTrivially handledMail it, and hope
ReconciliationOne debit from your accountTrack every check individually until it clears, or does not
Employee experienceMoney appears on paydayGet the check, go to the bank, wait for it to clear
Employee expectationThis is normal and expectedReads as a company that has not caught up

Look at the reconciliation row, because it is the one owners underrate. Paper checks create an open item for every payment, and some of those items stay open for months because the employee lost the check, or moved, or simply never cashed it. Direct deposit is one debit. It clears or it does not, and you know immediately.

And look at the last row, which is the one that actually matters at hiring. An employer who offers only paper checks is not seen as traditional; they are seen as behind, and the person deciding whether to accept your offer is doing that arithmetic whether they mention it or not.

The numbers behind that impression are lopsided. In the PayrollOrg Getting Paid in America survey (2025), 92.7 percent of respondents reported being paid by direct deposit and 3.3 percent by paper check. A job offer that promises a paper check is describing something most people have not seen in years.

What You Need Before You Start

You need two lists of things, one from your side and one from each employee, and the second is where every delay comes from.

From your sideSet this up once.
A business bank account that can originate ACH payments
A payroll provider or a direct ACH arrangement with your bank
Your EIN (Employer Identification Number) and business verification, which the bank will ask for
Enough of a funding buffer to cover payroll before the debit clears
From each employeeCollect this before their first payroll run, not after.
Bank name
Account type: checking or savings
Routing number, nine digits
Account number
A voided check or a bank letter, to verify the numbers
A signed authorization form, which in several states is legally required

The employee list is the whole game. Every one of those items has to come from a person who has other things on their mind, and the moment you are collecting them by email, screenshot, and text message, you have created both a data security problem and a delay.

Never Accept Bank Details by Screenshot or Text
This happens constantly and it is a bad idea for two independent reasons. First, a photograph of a check in a message thread is now a permanently stored copy of someone's account credentials, sitting on at least two phones and probably a cloud backup, entirely outside your control. Second, you are the one transcribing the numbers, which means you own the typo. Have the employee enter their own details into a form, and have them verify the account with a voided check or a bank letter. It is faster, it is safer, and the responsibility for accuracy sits with the person who actually knows the number.

How to Set Up Direct Deposit for Employees

Six steps. The first three are one-time setup, the next two repeat for every new hire, and the last one repeats every pay cycle.

1
Confirm your business bank account can originate ACH
Not every account can. You need one that supports ACH origination, which usually means a business account rather than a personal one, and the bank will verify your business before enabling it. Start here, because this is the step with the longest lead time.
2
Choose a payroll provider, or set up direct ACH with your bank
A payroll provider handles the ACH file, the tax deposits, and the pay stubs. Direct ACH through your bank is cheaper and considerably more work. Almost every small business should use a provider; the tax filing alone justifies it.
3
Complete the provider's verification and bank authorization
Your EIN, business documentation, and a bank authorization allowing the provider to debit your account. This takes a few days to a couple of weeks depending on the provider and how quickly your bank responds.
4
Collect each employee's details and signed authorization
Bank name, account type, routing number, account number, voided check, and a signed authorization form. Collect this during onboarding, before their first payroll run, not the week it is due.
5
Verify the account details, ideally with a prenote
A prenote is a zero-dollar test transaction that confirms the routing and account numbers are valid. Some systems use micro-deposits instead, sending two tiny amounts the employee must confirm. Either way, it takes a few business days and it catches a bad account number before payday rather than after, which is the entire point.
6
Run payroll, and respect the cutoff
Submit the file by your provider's deadline, which sits days before the pay date. Miss it and the money lands late, which is a missed payday from the employee's perspective regardless of your intentions.

Steps four and five are the ones that get compressed when you are busy, and they are the two that cause the failures. An employee whose account number was never verified is an employee whose first paycheck bounces, and their first paycheck was already late because you pay in arrears like everyone else.

The Authorization Form

The authorization form is a small piece of paper doing more legal work than most employers realize. In several states it is not optional, and in at least one it has to survive for six years after the last direct deposit payment.

What it needs to contain is straightforward.

FieldWhy it is there
Employee name and identifierSo the authorization can be matched to the right person and the right record
Bank name and addressIdentifies the receiving institution
Account typeChecking or savings. The ACH entry is coded differently for each
Routing numberNine digits, identifies the bank in the ACH network
Account numberThe account itself. The single most important field to get right
Split deposit instructionsIf the employee wants pay divided across accounts, this is where it is specified
Authorization languageAn explicit statement that the employee authorizes the employer to deposit wages, and to reverse an erroneous deposit
Signature and dateThe consent itself. Without this, you have collected data but not permission

The reversal clause in the second-to-last row is the one people skip and later wish they had not. If you overpay someone by mistake, an authorization that explicitly permits correcting an erroneous entry puts you in a materially better position than one that does not.

Full deposit, partial deposit, and deposit order

An employee can send pay to more than one account, and the form is where they say how. A partial deposit is a fixed amount or a percentage routed to one account, usually savings. The full deposit, which some systems label the remainder or balance account, takes whatever is left once the partial ones are funded.

Deposit order is the sequence the payroll system funds them in. Partial deposits are filled first, in the order listed, and the remainder account is paid last. That ordering only becomes visible on a short paycheck: if someone had an unpaid week, the fixed savings transfer still comes out in full and the checking account absorbs the whole shortfall. Say that out loud when someone sets up a split.

The Form Is a Record, Not a Transaction
The authorization form is not part of paying someone; it is part of documenting that you were allowed to. Your payroll provider stores the account number because it needs it to send money. It does not maintain your legal record of what this person consented to, on what date, having been given what notice. Those are different obligations, held by different parties, and one of them is unambiguously yours.
Still Using Spreadsheets for Onboarding?
Automate documents, training assignments, task management, and track onboarding progress in real time.
See How It Works

Timing and Cutoffs

The single most common operational failure with direct deposit is a missed cutoff, and it is entirely preventable.

Typical timingWhat it means for you
Standard ACH settlement1 to 2 business daysThe money is not instant. It is a batch network
Provider submission cutoffCommonly 2 to 4 business days before paydayThis is your real deadline, and it is not negotiable
Same-day ACHSame business day, with cutoffsAvailable, usually at a premium, often with caps
Bank holidaysAdd a day, sometimes twoACH does not settle on federal holidays. This is where people get caught
Prenote verificationA few business daysDo this well before the first real payment, not the day before
A new hire's first depositOften the slowestVerification plus arrears plus a possible prenote. Communicate the date

The bank holiday row deserves a moment. Your payroll calendar has a payday on it. The ACH network has a holiday calendar. Those two things do not consult each other, and if your pay date falls just after a federal holiday, your submission deadline moved and nobody told you.

Do direct deposits go through on holidays and weekends?

No. ACH settles only on banking days, so nothing posts on a Saturday, a Sunday, or any of the eleven holidays on the Federal Reserve holiday schedule. Thanksgiving, Labor Day, Memorial Day, Juneteenth, and the rest each remove a settlement day, and the effect on a payday is that it slides later rather than arriving early.

The employer version of that question is the one that matters. If a pay date lands on a holiday or a weekend, decide in advance whether the money moves to the business day before or the business day after, write it into your pay policy, and tell people which it is. The usual choice is to pay early, because a payday that drifts later is the version employees notice.

Then count backward from the new date. A holiday sitting inside the settlement window pushes your submission deadline a day earlier, sometimes two when it falls next to a weekend. Put the Federal Reserve holiday dates on the payroll calendar in January, when it costs nothing, rather than working it out during the week of Thanksgiving.

Same-day ACH, and how long a prenote takes

Same-day ACH is a faster settlement window rather than a separate network, and it is capped. Under the Nacha Operating Rules, the ceiling is $10 million per payment from September 17, 2027 ($1 million until then), far above anything a small payroll run needs. What constrains you instead is a much earlier cutoff and a fee per run, so it works as an exception rather than a standing arrangement.

A prenote runs on the opposite timeline. Under the same rules, a prenotification must precede the first live entry to that account by at least three banking days, so a verification started on Monday is not clear until late in the week. Start it when you collect the account details, not when payroll is already due.

Your own account has to be funded

Your payroll provider debits your own account to fund the payments, usually a day or two before payday, and that step is easy to overlook because it is invisible until it fails. If the money is not there, the debit is returned for insufficient funds, the payroll does not go out, and you have a returned-item fee plus a team that did not get paid.

That failure is entirely yours. The bank did nothing wrong and the provider did nothing wrong. Know when the debit hits your account, not just when the money hits theirs, and keep a buffer for the pay period that lands on a bad week for cash.

Hitting Submit Is Not the Same as Paying
An owner submits payroll on Wednesday for a Friday payday, having missed a Tuesday cutoff, and the money lands Monday. From their perspective they ran payroll on time. From the employee's perspective, and from the perspective of a state labor agency, the payday was Friday and they were not paid on Friday. The intent does not matter. Build a calendar with the submission deadlines on it, not just the paydays, and put a reminder two days before each one.

What It Costs

Direct deposit is cheaper than paper checks, which is why this question rarely decides anything. The components are still worth knowing, so that none of them surprises you.

CostTypical shapeNote
Per-transaction ACH feeCents per paymentOften bundled into your payroll provider's base fee at no visible charge
Bank setup feeA one-time charge at banks that levy oneNot universal. Many providers and banks waive it
Per-employee monthly feeCommon with payroll providersThis is usually the bulk of what you actually pay, and it covers far more than direct deposit
Same-day or expedited ACHA premium per runWorth it occasionally, not as a standing arrangement
Failed or returned paymentA small fee per returnAvoidable, and the way you avoid it is verification
Paper check, all inMeaningfully more per paymentStock, printing, signing, distribution, reconciliation, and reissues

The comparison that matters is not the ACH fee against the price of a check. It is the ACH fee against the fully loaded cost of a check, which includes the twenty minutes someone spends printing and signing them, the stop-payment fee when one goes missing, and the reconciliation of the ones that never cleared. Priced honestly, direct deposit is cheaper at almost any headcount above one, and the time it frees is the kind that otherwise disappears into HR admin.

Is free direct deposit real?

Mostly, with one caveat worth understanding. Plenty of payroll providers fold standard ACH into the base subscription and charge nothing per payment, and some banks waive the origination fee once you hold a minimum balance. What is free in those offers is the transaction fee, not the subscription underneath it.

So read free payroll direct deposit as a bundled cost rather than an absent one, and check where the charge reappears. It is usually attached to speed: expedited or same-day funding, an off-cycle run, or a returned payment you have to send again. None of that makes the offer dishonest. It makes the headline incomplete.

Can You Require Employees to Use Direct Deposit?

Under federal banking law, yes, as long as the employee chooses the bank. The real limits come from wage law and, above all, from your state. Almost everyone has this backwards, so start with exactly what the federal statute says, because it is narrower than the folklore.

What the EFTA Actually Prohibits
Per 15 U.S.C. 1693k, the compulsory use provision of the Electronic Fund Transfer Act, no person may "require a consumer to establish an account for receipt of electronic fund transfers with a particular financial institution as a condition of employment or receipt of a government benefit." Read that carefully. It does not say you cannot require direct deposit. It says you cannot require an account at a particular financial institution. As long as the employee chooses their own bank, the federal statute is satisfied.

That distinction is not a technicality. It is the whole answer under the banking statute, and it means federal banking law is not the thing standing in your way. What may be standing in your way is your state, which is true of a surprising amount of employment law.

The rule that implements the EFTA is Regulation E, issued by the Consumer Financial Protection Bureau (CFPB) and codified at 12 CFR Part 1005. It is worth knowing the name, because most of the specific obligations around electronic wage payments, including error resolution procedures and the rules on payroll cards, live there rather than in the statute.

What you can and cannot do
Require direct deposit as far as federal banking law goes, because the EFTA does not prohibit it. The Department of Labor still expects a cash or check option, and states add their own limits.
Ask every employee to complete an authorization form as part of onboarding.
Offer direct deposit as the default and make opting out a deliberate choice.
Require that the account be at a bank you choose. This is what the EFTA actually prohibits, and it is the part employers get backwards.
Mandate direct deposit in a state that requires consent, which is a substantial number of them.
Impose fees that reduce the employee's pay below minimum wage. The FLSA requires wages to be paid free and clear.
Pressure, coerce, or threaten anyone into consenting. New York expressly prohibits obtaining consent this way.
Condition hiring or continued employment on accepting direct deposit in a state that prohibits it.
The federal banking rule is narrower than almost everyone believes. It does not stop you requiring direct deposit. It stops you telling people where to bank. The real constraints live in the Department of Labor's cash or check position and in state law, and that is where you should be looking.

There is one more federal constraint worth knowing, and it comes from the wage laws rather than the banking ones. Per the Department of Labor Field Operations Handbook at 30c00(b), direct deposit is an acceptable method of payment provided employees have the option of receiving payment by cash or check.

Wage law layers a second condition on top of that. The FLSA requirement that wages be paid free and clear means any arrangement whose fees eat into employee pay, particularly for anyone near minimum wage, is a problem regardless of how the payment is delivered.

The Texas Workforce Commission maintains a useful summary of the federal framework that walks through the interaction between the EFTA and the Department of Labor position, and it is worth reading even if you are not in Texas.

State wage payment laws diverge sharply, and the law that applies is the law of the state where the employee works, not where you are incorporated. This is where the real rules are, and where you should actually be looking.

Broadly, states fall into three groups. Some allow mandatory direct deposit with few conditions. Some allow it but require that the employee be given a genuine alternative, typically a check. And some require the employee's written consent before you can pay by direct deposit at all, which effectively makes it voluntary in that state no matter what your policy says.

Mandatory direct deposit by state

Beyond the federal cash or check baseline, whether you can require direct deposit is decided state by state, and the three groups have real examples sitting behind them. The table below takes one state from each, then adds New York as the strict extreme. The point is not to memorize these four; it is to see how far apart they sit before you write a policy meant to cover everyone.

StateWhat the law requiresWhere it comes from
KansasAn employer may pay wages only by electronic transfer, provided the employee designates the account, an alternative payment method is offered as the default for anyone who does not, and the employer runs employee education at least 30 days before the switchKansas Statutes 44-314
TexasNo consent needed, provided the employer gives at least 60 days of advance written notice of the direct deposit system and the employee has a suitable accountTexas Payday Law, per Texas Workforce Commission guidance
CaliforniaVoluntary. Wages may go only into an account of the employee's choosing, and only where the employee has voluntarily authorized the depositCalifornia Labor Code section 213
New YorkVoluntary, with written notice before consent, written consent, a copy back to the employee, and retention for six years after the last direct deposit paymentNew York Department of Labor guidance for employers

Two of those rows are worth reading in the original. California Labor Code section 213 permits a deposit only into an account the employee chooses, and only where the employee has voluntarily authorized it. Kansas Statutes 44-314 runs the other way, allowing electronic transfer alone so long as a default method stays open to anyone who designates no account.

Three things follow from that spread. A multi-state employer cannot run one rule, because the same policy is lawful in Kansas and unlawful in California. A state that permits mandatory direct deposit still attaches conditions, whether notice periods or a fallback method. And the law that applies is the law of the state where the person works, which for a remote hire is not yours.

New York sits at the strict end and is worth walking through, because it shows what a maximal version of these obligations looks like.

The Strictest Version, and What It Demands
Per the New York Department of Labor guidance for employers, to pay by direct deposit you must give the employee a written notice before obtaining consent, containing a plain-language description of all payment options, a statement that they are not required to accept direct deposit, and a statement that they cannot be charged fees to access their wages in full. You must obtain written consent, provide the employee with a copy of it, and keep a copy on file for as long as they work for you and for six years after the last wage payment made by direct deposit. An employee may withdraw consent at any time.
What a compliant consent process actually involves
Written notice, given before consentIn the strictest states, you must give the employee a plain-language notice of all payment options before you ask them to consent, including a statement that they are not required to accept direct deposit.
Written consent, freely givenSigned and dated. Not obtained through pressure. New York does not accept consent given under coercion or fear of adverse action.
A copy back to the employeeThey keep one, you keep one. New York makes this a requirement, not a courtesy.
The employee picks the bankFederal law. Nonnegotiable everywhere.
The right to withdraw consentAn employee can revoke it. You typically have a short window, often no more than two pay periods, to switch them back to a paper check.
Retention, for years after they leaveNew York, for example, requires you to keep the consent for the duration of employment and for six years after the last direct deposit payment. That is a records obligation, and it outlives the employee.
Read the last row again. The obligation that survives the employment relationship is a filing obligation, not a payroll one. Your payroll provider will not do it for you, and if you have been storing signed forms in a folder on someone's laptop, you do not have a records system.

Now look at what that actually is. Notice, consent, copy, retention for six years past the last direct deposit payment. Not one of those is a payroll function. They are document management, and they are your problem, and a payroll provider that processes the ACH beautifully will do nothing for you here.

Two more details catch people. In New York, consent obtained through intimidation, coercion, or fear of adverse action is not valid consent, which means a manager telling someone that direct deposit is how things are done here may have voided the very form they just collected.

In the strict states, employees can also withdraw consent, and the employer typically gets a short window, often no more than two pay periods, to move them back to a check. Both details are worth stating explicitly in your company policy rather than leaving to a manager to improvise.

Storing the Bank Data and the Forms

You are now holding two things you did not have before: the bank account credentials of everyone who works for you, and a set of signed legal consents you may be required to produce years from now. Neither belongs where most small employers put them.

Ask yourself where the signed authorization forms actually are right now. If the honest answer is a shared drive folder, an inbox, or a physical drawer that only one person can find, you do not have a records system. You have a pile, and a pile is not something you can produce on demand for a labor agency six years after somebody left.

What you are holdingWhy it is sensitiveWhat it needs
Routing and account numbersDirect financial credentials for every employeeAccess control. Not everyone in the company needs to see these
Voided checks and bank lettersSame data, in image form, often in emailA place that is not an inbox
Signed authorization formsYour legal proof of consentDurable storage, retrievable years later, by someone who is not you
Notice given before consentRequired in strict states, and easy to forget you gaveA record that the notice was delivered, not just that consent was signed
Withdrawal of consentAn employee changing their mind is a legal eventA dated record, and a process to act on it within the window

The last two rows are the ones that no payroll system tracks and that almost no small employer thinks about. Consent is not a checkbox; it is a sequence of events with dates, and the sequence is what you may one day have to demonstrate.

So keep the sequence in a register rather than in a folder. One row per employee, the dates in the order they happened, and a column for the year you are allowed to stop keeping it. This is the artifact that answers the question a state agency asks, which is not whether you have the form but when the notice went out and what happened after.

Direct Deposit Consent and Retention Register
ABCDEFGHIJK
1EmployeeState where the employee worksNotice of payment options given onHow the notice was deliveredConsent signed onCopy given back to the employee onWhere the signed form is storedConsent withdrawn onMoved back to check onRetain untilChecked by
2Replace this row with your first employeeThe state where the work is performed, which is the law that appliesIn the strict states this has to come before the consent, not with itRequired in New York, not a courtesyNot an inbox and not one person's laptopYou typically have a short window to act on thisCheck your own state. New York, for example, runs six years from the last direct deposit payment rather than from the hire date
3
4
5
6
7
8
9
10
11
12
13
This Is the Gap, and It Is a Records Gap
Your payroll provider is excellent at moving money and it will store the account number it needs to do that. What it will not do is maintain your compliance record: the notice you gave, the consent you obtained, the date, the copy you handed back, and the retention of all of it for years after the person has gone. That is an HR records function, not a payroll function. It is exactly the seam that FirstHR sits in, and it is why the two things are not competitors.

Fitting It Into Onboarding

Direct deposit setup is an onboarding task masquerading as a payroll task, and treating it as the latter is why it goes wrong.

Think about the timing. A new hire needs to provide bank details, sign an authorization, have the numbers verified, possibly wait out a prenote, and clear the payroll cutoff, all before their first pay date, which is already late because you pay in arrears. There is not much slack in that.

1
Ask for it before day one, not after
Bank details, authorization, and voided check should be part of the preboarding pack, alongside the I-9 and the W-4. By their first morning it should already be done.
2
Let the employee enter their own details
Self-service beats email for both accuracy and security. The person who knows the account number should be the one typing it, and you should not be transcribing it out of a photo.
3
Give the notice before you ask for consent, if your state requires it
The order matters in strict states. Consent obtained before notice was given is not compliant consent, and getting the sequence right is free if you build the sequence once.
4
Collect the signature electronically
A signed authorization is a signed authorization. E-signature is faster, it timestamps itself, and it lands in a system rather than in a drawer.
5
Verify before you rely on it
Prenote if you can, voided check at minimum. Discovering a bad account number on payday is an entirely avoidable way to ruin someone's first month.
6
Tell them the first pay date
Give the actual calendar date. Arrears plus verification plus a possible prenote means the first paycheck is later than they think, and being surprised by an empty account in week three is a bad way to start a job.
7
File it properly, immediately
The moment it is signed, it belongs in the employee record. Not in an inbox, not on a laptop. This is the step everyone defers and nobody comes back to.
What worked for me
For our first few hires I collected bank details over email, which I did not think twice about at the time. Then I went to actually find one of them, about a year later, because we were tidying up records, and I could not. It was in an email thread somewhere, probably, along with a photo of a voided check that was now sitting in my mail archive and my phone's camera roll indefinitely. Nobody had done anything wrong. There was no incident. But I was holding the bank credentials of everyone who worked for me in a place with no access control, no retention policy, and no way to prove what anyone had consented to. The fix was to move the whole thing into onboarding: they enter it themselves, they sign electronically, it files itself, and I never touch a routing number again. That took an afternoon and removed a category of risk I had been carrying without noticing.
Companies Using FirstHR Onboard 3x Faster
Join hundreds of small businesses who transformed their new hire experience.
See It in Action

Security and Fraud

Once you hold the bank credentials of everyone who works for you, you are a target: there is a criminal industry built specifically around getting them out of you. Almost no small-business guide to direct deposit mentions this, which is remarkable given that the FBI has issued repeated warnings about it.

Payroll diversion fraud

The attack is simple and it works. Someone emails your HR or payroll contact, appearing to be an employee, asking to update their direct deposit account. The request looks routine. It gets processed. On payday, the wages go to an account controlled by the criminal, usually a prepaid card, and the money is gone before anyone notices.

The FBI Has Been Warning About This for Years
Per an FBI Internet Crime Complaint Center public service announcement (2019), HR and payroll representatives received emails appearing to be from employees and asking to update their direct deposit information for the current pay period. The new account details generally lead to a prepaid card. The Internet Crime Complaint Center (IC3) logged 1,053 of these complaints between January 1, 2018 and June 30, 2019, carrying a reported loss of $8,323,354. Some companies reported phishing emails, with a spoofed log-in page, before the change requests arrived. An earlier IC3 announcement (2018) adds that criminals put rules in the mailbox to stop the alerts about direct deposit changes, so nobody notices until payday.

Sit with the shape of that attack. Nothing about it requires breaking into your systems. It requires only that a person in your company processes a plausible email without picking up the phone. At a small company, that person is probably you, and you are probably doing it between two other things.

How to not fall for it

1
Verify every account change out of band
This is the whole defense and it costs a phone call. An email asking to change bank details gets confirmed by voice, on a number you already had, not one supplied in the email. Never verify an emailed request by replying to the email.
2
Never accept a change request by email at all
Better still, take email off the table. Account changes go through a self-service portal with authentication, or they do not happen. If the only route in is a channel a stranger can spoof, you have no control.
3
Require authentication and approval for changes
A change to bank details should require the employee to authenticate, and it should be flagged for approval rather than applied silently. Two conditions, both cheap.
4
Notify the employee when their account changes
An automatic alert to the employee, and ideally to a second address or channel, gives them a chance to say that was not me before payday rather than after.
5
Watch for urgency
The requests almost always carry time pressure: needs to be in before the next run, do not want to miss a bill. Urgency exists to stop you verifying. Treat it as a signal rather than a reason to hurry.
6
Tell your team the scam exists
Employees are the ones being phished for credentials in the first place. Five minutes explaining the attack is the cheapest security control you will ever deploy.

Per FBI guidance on business email compromise, the recommended defense is to use secondary channels or two-factor authentication to verify requests for changes in account information. If a fraudulent transfer does go out, contact the originating financial institution immediately to request a recall, and file a complaint with the IC3.

Write the call down. A verification that leaves no record is indistinguishable, three months later, from a verification that never happened, and the person covering for you needs to see that the step exists. One record per account change, filed with the signed authorization for that change. There is a form for it in the payroll security guide, which also covers the schemes that come at you from inside rather than through the inbox.

The data itself

Separately from fraud, you are holding sensitive personal financial data, and how you hold it matters.

PracticeWhat it means concretely
Access controlNot everyone in the company needs to see routing numbers. Most people need to see none of them
Encryption at rest and in transitBank details should not sit in plaintext in a spreadsheet, an inbox, or a shared drive
No bank data in emailEmail is not a secure channel and it is not a storage system, and yet it is where most of this data ends up
Audit trailWho changed what, and when. Without this you cannot investigate a diversion after the fact
Retention and disposalYou must keep consents for years. You should not keep raw account numbers longer than you need them
A written policySo that the person covering for you while you are away does not process the fraudulent email you would have caught

The third row is the one to act on today. If bank details are currently in your inbox, they are in a system that was never designed to hold them, that you cannot audit, and that is the single most commonly compromised surface in any small business.

When Things Go Wrong

Six situations catch employers here. The first two are payments that never reach the employee, and the other four are rules employers tend to learn the hard way.

The payment is returned

The account was closed, or the number was wrong in a way the bank could detect. The money comes back, you find out, and you reissue. Annoying, recoverable, and the employee is paid late. This is what a prenote is designed to prevent.

The money went to the wrong account

Considerably worse, because the account was valid, just not the right one. A transposed digit in an account number can land your employee's wages in a stranger's account.

The Nacha Operating Rules permit an originator to request the reversal of an erroneous entry, provided the reversal reaches the receiving bank within five banking days of the settlement date of the entry it corrects. Miss that window and the standard route closes.

A reversal is also a request rather than a guarantee. The funds may already have been withdrawn, and the receiving bank cannot simply seize money from a customer's account on your say-so. If the recipient does not cooperate, recovery becomes a legal matter, and meanwhile your employee has not been paid.

Which is the entire argument for the boring steps. The voided check and the prenote look like bureaucracy right up until the moment they are the only thing between you and this.

Deductions come out before the ACH, not after

Garnishments, child support withholding, taxes, and benefit deductions are all applied to gross pay before the payment file is created. What goes into the ACH is net pay. Employers get this order wrong often enough that it is worth stating.

You do not send the full amount and reclaim the difference afterward. That is not how any of this works, and if you have an active income withholding order for someone, the withheld amount never enters the direct deposit in the first place.

You overpaid someone

Correcting an overpayment through a payroll deduction is restricted by state law, often requires written employee authorization, and in some states is simply not permitted without one. This is where the reversal clause earns its place: an authorization form that explicitly permits reversal of an erroneous deposit puts you in a much stronger position, even though nobody reads that clause when they sign.

The state limits are what catch employers who read the Nacha rules and stopped there. California Labor Code section 221 makes it unlawful to collect back wages already paid, so a unilateral reversal or payroll offset is not available in California.

New York allows recovery of an inadvertent overpayment only under 12 NYCRR 195-5.1, and that recovery can reach back no further than the eight weeks before the notice.

In New York, the notice you owe depends on the size of the overpayment. One that fits inside the next check's net pay comes out whole on three days' notice; a larger one needs three weeks' notice and a cap of 12.5 percent of gross wages per deduction. Asking for a repayment plan is usually faster than either route.

The final paycheck may be too fast for ACH

This one is a scheduling problem rather than an error, and it catches employers at the worst moment. Several states require final wages to be paid immediately on an involuntary termination, or within a day or two. Standard ACH takes one to two business days and your provider's cutoff sits ahead of that.

Do the arithmetic and you will find that in a strict state, you cannot meet the deadline with a normal direct deposit run. The answer is either an off-cycle payment with expedited funding, or a paper check handed over on the day. It is one more reason to keep the ability to cut a check, and one more thing to know before you need it rather than during the termination conversation.

Contractors are a different arrangement

You can and probably should pay 1099 contractors by ACH as well, but understand that it is not the same thing. They are not employees, so the wage payment laws, the consent requirements, and the EFTA employment protections that govern paying your staff do not apply in the same way. What governs it is your agreement with them.

The practical difference is that a contractor payment is a vendor payment, and it belongs in accounts payable rather than in payroll. Running contractors through your payroll system because it is convenient blurs a line you generally want to keep sharp.

The Employee Without a Bank Account

It will happen, and most small employers have no plan for it. Some people are unbanked because of cost, some because of past account problems, and some because they have chosen to be.

The group is smaller than it used to be and it has not disappeared. According to the FDIC National Survey of Unbanked and Underbanked Households (2023), 4.2 percent of US households, about 5.6 million of them, held no account at a bank or credit union. The survey reports that rate as little changed from the 4.5 percent it measured in 2021.

You cannot direct deposit into an account that does not exist. Under the Department of Labor's position in Field Operations Handbook 30c00(b), an employee must be able to take cash or a check instead, so you cannot make having an account a condition of being paid. You need an answer, and there are two.

OptionHow it worksThe catch
Paper checkThe fallback that always worksYou need to be able to produce one, which means never fully abandoning the capability
Payroll cardA prepaid card loaded with wages each pay periodHeavily regulated. Fees must be disclosed before the employee accepts the card, and state rules on free access to wages vary

Payroll cards are a legitimate option and they solve a real problem, but they come with strings. Per CFPB guidance, an employer cannot require an employee to accept a payroll card, and employees must be given at least one alternative to choose from. Several states go further, requiring that the employee be able to withdraw their full net wages at least once per pay period without any fee.

The practical upshot is that the paper check never fully goes away. You may pay 100 percent of your team by direct deposit today, and you should still know how you would cut a check next week if you had to, because at some point you will have to.

Common Mistakes

These recur, and the first two are the expensive ones.

The Recurring Failures
Believing the EFTA bans mandatory direct deposit, when what it bans is requiring a specific bank. Mandating direct deposit in a state that requires consent, which makes the whole arrangement unlawful regardless of how well the payments run. Obtaining consent without giving the required notice first, which in strict states means the consent does not count. Collecting bank details over email or text, creating a data exposure and owning the typo. Skipping the prenote and discovering a bad account number on payday. Missing the submission cutoff and treating it as a technicality, when from the employee's side it is simply a missed payday. Storing signed authorization forms in an inbox or a drawer, and being unable to produce them years later when a state requires you to. Having no plan for the employee without a bank account. Processing an emailed request to change someone's bank details without picking up the phone, which is the single most common way small businesses lose payroll to fraud. Forgetting that your own account gets debited before payday, and not having the funds there. Assuming a final paycheck can ride a normal ACH run in a state that requires payment within 24 hours. And leaving out the reversal clause in the authorization form, then trying to recover an overpayment without one.

The unifying error is treating this as purely a payments problem. Half of it is a records problem, and the records half is the half with obligations that outlive the employee, that no payroll provider handles for you, and that you will only discover you got wrong at the exact moment someone asks you to produce a document from six years ago.

Key Takeaways
Direct deposit moves wages through the ACH network, a batch system that settles in one to two business days, which is why your cutoff sits days before payday.
The EFTA does not prohibit mandatory direct deposit; it prohibits requiring an account at a bank you choose.
Whether you can actually mandate it depends on wage law, because the Department of Labor expects a cash or check option and many states require written employee consent before you may pay this way.
In New York you must give written notice before obtaining consent, provide a copy, and retain it for six years after the last direct deposit payment.
That retention obligation is a records function rather than a payroll one, and your payroll provider will not handle it for you.
Verify every request to add or change a bank account by phone, on a number you already had, because payroll diversion fraud arrives as a plausible email.

Frequently Asked Questions

What is payroll direct deposit?

Payroll direct deposit is how an employer pays wages electronically, moving money from the business bank account into the employee's account over the ACH (Automated Clearing House) network instead of issuing a paper check. On payday, the money appears in the employee's account without anyone handling a physical check. Behind the scenes, the employer sends payment instructions through a bank or payroll provider, the network sorts and routes them in batches, and the money posts to the employee's account on the settlement date. In PayrollOrg's Getting Paid in America survey (2025), more than nine in ten respondents said this is how they get paid, and it is what most employees expect from any employer.

How do I set up direct deposit for my employees?

Six steps. Open or confirm a business bank account that can originate ACH payments. Choose a payroll provider, or set up direct ACH with your bank, and complete their onboarding and verification. Collect each employee's bank details and a signed authorization form. Verify the numbers, ideally with a voided check and a prenote test transaction. Enter the details into your payroll system. Then run payroll, submitting the file before your provider's cutoff so the money settles on payday. The setup itself usually takes a few days to a couple of weeks, mostly waiting on bank verification.

What information do I need from an employee for direct deposit?

Five things: the bank name, the account type (checking or savings), the nine-digit routing number, the account number, and a signed authorization. Most employers also ask for a voided check or a bank-issued letter, not out of formality but because a single transposed digit in an account number sends the money somewhere else and getting it back is slow and unpleasant. Have the employee provide the numbers themselves rather than reading them off a phone photo, because you are the one who will be liable for the typo.

Can an employer require direct deposit?

Under the federal banking statute, yes, which surprises most employers. The Electronic Fund Transfer Act forbids only one thing here: making an account at a financial institution you pick a condition of employment. A policy of paying everyone electronically is fine under that law, provided each employee decides where the money goes. Two other layers can still get in the way. The Department of Labor's Field Operations Handbook accepts direct deposit where employees can still choose cash or a check. And a substantial number of states will not let you pay this way at all without the employee's written consent, which in practice turns direct deposit into an option rather than a requirement there. The state that matters is the one where each employee works.

Do I need written consent for direct deposit?

In many states, yes, and it is not a formality. New York, for example, requires you to give a plain-language written notice of all payment options before asking for consent, obtain that consent in writing, give the employee a copy, and retain it for the duration of employment plus six years after the last direct deposit payment. The consent must be freely given, and consent obtained through pressure or fear of adverse action is void. Even where consent is not legally mandated, collecting a signed authorization is standard practice and protects you if a payment is later disputed.

How much does direct deposit cost a small business?

Less than paper checks, which is the entire economic argument. Individual ACH transactions typically cost cents rather than dollars, and many payroll providers bundle direct deposit into their base fee at no additional charge. Some banks levy a one-time setup fee and some add a small per-transaction or per-employee charge, though plenty waive both. Compare that against the fully loaded cost of a paper check, which includes stock, printing, signing, distributing, reconciling, and reissuing the ones that get lost, and direct deposit wins comfortably at almost any headcount.

How long does direct deposit take?

Standard ACH settles in one to two business days, which is why your payroll submission deadline sits several days before payday rather than on it. Your provider will have a cutoff, often two to four business days before the pay date, and missing it means the money lands late even though you did everything else correctly. Faster routes do exist, such as same-day ACH or next-day funding from some providers, and they usually cost extra. The practical rule is to know your cutoff, treat it as a hard deadline, and build a buffer for the pay periods that end near a bank holiday.

What is a prenote in direct deposit?

A prenote is a zero-dollar test transaction sent to the employee's bank to verify that the routing and account numbers are valid before you send real money. It typically takes a few business days, and if the account details are wrong, the prenote fails and you find out before payday rather than after. Not every provider uses prenotes and not every employer bothers, but for a new hire whose first paycheck is already delayed by an arrears schedule, catching a bad account number in advance is worth the few days it takes.

What happens if a direct deposit goes to the wrong account?

It is recoverable but it is not simple, and the timeline is not in your control. The Nacha Operating Rules give the originator five banking days from the settlement date to get a reversal in front of the receiving bank, and after that the standard route is gone. Even inside the window the recipient may have taken the money out already, and the receiving bank is under no obligation to hand back what has left the account. If the wrong recipient will not cooperate, recovery turns into a legal matter, which is why the voided check and the prenote earn their place.

Can I pay employees by direct deposit if they do not have a bank account?

Not directly, and this is the case that most employers have never thought about until it arrives. Some workers are unbanked by circumstance and some by choice. Your options are a paper check, which you must always be able to fall back on, or a payroll card, which is a prepaid card loaded with wages each pay period. Payroll cards carry their own rules: federal rules require the fees to be disclosed before the employee accepts the card, and several states add conditions such as at least one free withdrawal of the full net wages each pay period. You may not force a payroll card on someone.

Where should I store employee bank details and authorization forms?

Somewhere access-controlled, auditable, and durable, which for most small employers means somewhere other than where they are currently storing them. Bank details and signed authorizations are sensitive employee records, not payroll transactions, and the obligation to retain them can outlast the employment relationship by years. Your payroll provider holds the account numbers it needs to make payments; it does not maintain your compliance record of what each employee consented to and when. That gap is a records problem, and it is yours.

Can an employee change their direct deposit account?

Yes, and they will. The important thing is that a change follows the same process as the original setup: a new authorization, verified numbers, and enough lead time to take effect before the next payroll run. It should also be verified out of band, because an emailed request to change bank details is the exact shape of a common fraud. Treat an account change as a small formal process with a phone call attached, not an informal request you act on from your inbox.

What is payroll diversion fraud?

It is a scam in which a criminal poses as one of your own people and asks payroll to redirect that person's wages. The FBI Internet Crime Complaint Center has issued public service announcements on it in both 2018 and 2019, and its 2019 announcement counted 1,053 complaints and $8,323,354 in reported losses between January 2018 and June 2019. Some companies saw a phishing email first, and the 2018 announcement describes criminals using stolen log-ins to change the deposit themselves, then quietly adding inbox rules that hide the alert. The money generally lands on a prepaid card, and payday is when anyone notices. One phone call, to a number you already had, stops all of it.

What happens if my business account does not have enough money on payday?

The payroll fails, and the fault sits with you rather than with the bank or the provider. To fund each run, your provider pulls the total from your business account, typically a day or two before the pay date. When that pull comes back unpaid, none of the payments leave, your employees open their banking apps to find nothing there, and you will usually pay a returned-item fee as well. The fix is planning: put the debit date on your payroll calendar next to the payday, and hold enough cash to cover a run that falls in a lean week.

Can I pay a final paycheck by direct deposit?

Sometimes, and in strict states often not. Several states require final wages after an involuntary termination to be paid immediately, or within a day or two. A normal ACH run cannot meet that: settlement alone needs one to two business days, and the submission cutoff at your provider comes before settlement even starts. When the deadline is that tight, you have two practical routes. Run an off-cycle payroll with expedited funding, or write a paper check and hand it to the employee on the day. Look up your state's final pay deadline well ahead of time, and keep some way to issue a check for exactly this situation.

Do garnishments come out before or after direct deposit?

Before, always. Every deduction, whether a garnishment, a child support order, tax withholding, or a benefit contribution, comes out of gross pay while payroll is calculated, and only after that is the ACH file created. The amount that travels by direct deposit is the net figure. Nothing is paid out in full and clawed back later. When an income withholding order is active for an employee, the withheld portion is carved out before the deposit is built and never reaches the employee's account at all.

Can I pay 1099 contractors by direct deposit?

Yes, and for most businesses it is the practical choice, but it is a separate arrangement from paying staff. Because a contractor is not your employee, the rules that apply to wages, including state wage payment laws, state consent requirements, and the EFTA's employment protections, do not reach them in the same way. The terms come from your agreement with them. On your books, the payment is a vendor payment handled through accounts payable, not a payroll item, and keeping those two flows separate is generally worth more than the convenience of running contractors through payroll.

Ready to transform your onboarding?

7-day free trial No credit card required
Start Your Free Trial