ACH Prenote: What It Verifies, How Long It Takes and When AP Still Needs One
An ACH prenote is a zero-dollar test entry sent before the first live ACH payment to confirm that an account and routing number can receive entries. If you send one, the first live payment must be dated at least three banking days after the prenote settles.
Prenotes come up most often when AP adds a new vendor, or when a vendor changes its bank details. They also come up for employees waiting on a first direct deposit. If that's you, the short answer is that your employer's payroll provider usually waits about three banking days after the prenote before the first deposit lands. The longer answer, for the people sending payments, is that a prenote checks less than most teams assume.
Key Takeaways
An ACH prenote is a zero-dollar entry that tests whether an account number is valid and open before real money moves.
Prenotes are optional for most originators. If you send one, the first live entry must wait at least three banking days after the prenote settles.
A prenote confirms that an account can accept ACH entries. It doesn't confirm that the account belongs to the vendor.
Business email compromise is the bigger risk when vendors send new bank details, so ownership checks such as a callback to a known contact matter more than the prenote.
Nacha treats a prenote as one acceptable way to validate an account, alongside micro-deposits, commercial validation services, and API-based checks.
What is an ACH prenote?
An ACH prenote, short for prenotification, is a zero-dollar ACH entry an originator sends to a receiving bank before the first live payment. It tests whether the account number and routing number are valid and the account is open to receive entries.
The prenote travels like any other ACH entry. It sits in the same payment file, carries the same account details as the live payment will, and goes through the same banks. The only difference is the amount, which is zero, so nothing posts to anyone's balance. Most AP teams see prenotes when setting up ACH credits to vendors, though prenotes can precede debits too.
ACH volume makes the setup step worth getting right. According to Nacha's ACH Payments Fact Sheet, the ACH Network carried 35.2 billion payments worth $93 trillion in 2025, with 8.1 billion B2B payments, up 9.9% from 2024.
How does the prenote process work?
The originator sends the prenote, the receiving bank checks the account, and the originator waits. If the account details are wrong, the receiving bank sends back a return or a notification of change. If nothing comes back, the account is treated as valid.
The sequence for a vendor payment looks like this:
AP collects the vendor's routing and account numbers during onboarding.
AP or the payment system includes a zero-dollar prenote for that account in the next ACH file.
The receiving bank checks whether the account exists and can accept entries.
A return comes back if the account is closed or invalid, or a notification of change comes back with corrected details.
If nothing comes back during the return period, AP releases the first live payment.
That last step relies on silence. Nacha's Account Validation Frequently Asked Questions say an originator "can assume that a 'no response' by the end of the return/NOC period means that the RDFI has validated the account number is open."
Are prenotes required?
No, prenotes are optional for most originators. A summary of the Nacha Operating Rules in Nicolet National Bank's Corporate User ACH Quick Reference Guide puts it plainly: "Prenotes are optional." If you do send one, the same summary says the prenote rules must be followed.
Some banks and payment platforms require prenotes as their own policy, and some companies require them internally for every new vendor. Nacha's ACH Developer Guide also recommends sending a prenote "when any changes are made to an account number." Optional under the rules doesn't mean optional under your bank agreement, so check it.
How long does an ACH prenote take?
If you send a prenote, the first live entry must be dated at least three banking days after the prenote settles. The Nicolet guide, citing the 2024 Nacha Operating Rules, states that "the first live entry must be dated at least three (3) banking days after the pre-note is settled."
Nacha's developer guidance points the same way, recommending that prenotes go out "at least three business days prior to initiating a live authorized Entry." In practice, a prenote sent on a Monday usually clears the way for a live payment late that week or early the next, depending on when the prenote settles. For an employee waiting on payroll, the first direct deposit typically follows that same three-banking-day wait, which is why a first paycheck sometimes arrives as a paper check or a pay-card load while the prenote clears.
Why is a prenote taking so long?
A prenote usually feels slow because of banking days, cutoffs, and holidays. Weekends and federal holidays don't count, and a prenote submitted after the bank's daily cutoff goes out the next banking day, which pushes the whole clock back.
If the wait runs well past three banking days, check whether the prenote came back. A return means the account number is invalid or closed, and AP needs corrected details from the vendor before trying again. With a notification of change, the receiving bank accepted the entry but wants a detail updated, such as an account number that changed after a bank merger. Either one deserves a phone call to the vendor at a number you already have on file, since a request for new bank details is exactly when fraud tends to happen.
Is a prenote enough to verify a vendor's bank account?
No. A prenote confirms that an account can accept ACH entries, but it doesn't confirm that the account belongs to your vendor. That second question is the one that matters when someone sends "updated bank details."
Nacha's FAQ is precise about this. "Transmission of a Prenotification Entry meets the minimum standard of the Rules for validating that an account is open and can accept ACH entries." Open and able to accept entries is the whole claim. A fraudster's account at a real bank passes a prenote just as easily as your vendor's does.
That gap is where most vendor payment fraud lives. According to AFP's 2026 Payments Fraud and Control Survey Report, 76% of U.S. organizations experienced attempted or actual payments fraud in 2025, and 74% were affected by business email compromise. The same survey found paper checks were the payment method most targeted, cited by 58% of organizations, followed by ACH debits at 30% and wire transfers at 25%.
Picture how this plays out. An emailed change request arrives with a vendor's "new" account, AP runs a textbook prenote, and nothing comes back after three days. The team releases a five-figure payment, and the real vendor calls two weeks later asking where its money went. Every control worked as designed, yet none of them asked whether the account belonged to the vendor.
Method | What it confirms | Time to first payment | Fraud coverage |
Prenote | Account is valid and open for entries | At least three banking days | Low, since it doesn't check ownership |
Micro-deposits | Someone with access to the account can see the deposits | Days, plus the vendor's confirmation | Moderate, depending on who confirms |
Account-validation service | Account status, and in some services the owner's name | Often immediate | Higher where name matching is included |
Callback to a known contact | The vendor itself requested the change | Same day | High, if the number comes from your records |
Methods drawn from Nacha's Account Validation FAQ, which lists prenotes, micro-transaction verification, commercial validation services, and API-based validation. Corpay's single-use virtual cards are one way around the problem, because a card payment doesn't depend on vendor bank details.
Protect cash flow with modern AP
Modernize AP to cut costs, speed approvals, and mitigate payment risk — gaining the real-time visibility to protect cash flow and scale with confidence.
Download the whitepaper
What a prenote can and can't tell you
The limits of a prenote are easier to see side by side. A clean prenote tells AP a few useful things:
The routing number points to a real bank that participates in the ACH Network.
The account number exists at that bank.
The account is open and able to accept ACH entries.
It stays silent on the questions that decide whether a payment is safe:
Whether the account holder's name matches your vendor's legal name.
Whether the person who sent the bank details works for the vendor.
Whether the account was opened last week to receive diverted payments.
Silence also cuts both ways. Because Nacha treats "no response" as validation, a prenote the receiving bank never checked properly looks the same as one it did. That's fine for catching typos in an account number, and it's why most AP teams treat the prenote as a data-quality check rather than a fraud control.
How do prenotes compare with account-validation services?
Account-validation services are faster than prenotes and can check more. A prenote takes at least three banking days and confirms only that the account accepts entries, while validation services typically return a result right away, and some match the account owner's name.
Nacha's FAQ lists both as acceptable, along with micro-transaction verification and API-based validation. The choice comes down to speed and what you need to know. For vendor onboarding, a service that matches the name on the account to the vendor's legal name answers the ownership question a prenote can't. Pairing it with the vendor verification and bank validation steps already in your onboarding gives you more than either alone.
What about Nacha's account-validation rule?
Nacha's account-validation rule applies to businesses that debit consumer accounts over the internet, known as WEB debits. It took effect March 19, 2021, and applies to the first use of an account number and to any change, according to Nacha's rule on supplementing fraud detection standards for WEB debits.
Most AP teams pay vendors with credits, so the WEB debit rule rarely applies to them directly. Nacha's newer fraud-monitoring rules do. Phase 1 took effect March 20, 2026, for the largest originators and receiving banks. Phase 2, with a rule date of June 19, 2026, which fell on a federal holiday, so June 22 in practice, extends the requirement to all remaining non-consumer originators "regardless of origination or transmission volume." The rules require "risk-based processes to identify entries suspected of being unauthorized or authorized under False Pretenses," and Nacha's Phase 2 fraud monitoring page makes clear that false pretenses include vendor impersonation and business email compromise.
Do you still need a prenote when adding a new vendor?
Use a prenote when your bank or policy requires one, but don't treat it as your vendor verification. Verify ownership at onboarding first, then let the prenote confirm the account details are technically valid.
A practical onboarding sequence for a new ACH vendor looks like this:
Collect bank details through a secure vendor form or portal rather than email.
Call the vendor at a phone number from your contract or vendor master, never one from the request itself.
Run an account-validation check that matches the account owner's name to the vendor.
Send a prenote if your bank or policy requires one.
Hold any bank-detail change for review by someone other than the person who entered it.
That last step is the one that fails most often, because one person can enter a change and release a payment in the same afternoon. Splitting those duties is basic vendor management, and the vendor due diligence checklist covers the rest of what belongs in onboarding. The same discipline protects against ACH credit fraud more broadly.
Manual onboarding is where these controls tend to slip. According to Yooz's 2025 Leaders vs. Ledger survey of 600 U.S. finance professionals, finance staff naming manual data entry as a barrier rose from 57% to 63% year over year.
According to The Hackett Group's 2025 Digital World Class Matrix for Accounts Payable, the 15 AP providers it evaluated averaged 60% touchless invoice processing. Companies where at least three in ten invoices were touchless averaged 3.5 times higher AP productivity. Automation helps most when it removes the manual handoffs where verification steps get skipped. Fewer manual touches on invoices leave more staff time for the step that can't be automated away, which is a person confirming with a known contact that a change of bank details is real.
Payroll teams face a lighter version of the same problem. An employee who updates direct deposit details through a self-service portal is usually authenticated already, so the main risk is a typo, and a prenote catches that well. Vendor changes come from outside the company, often by email, and that's where an ownership check earns its place. Corpay pays suppliers by virtual card, ACH, or check from one approval flow, so a bank-detail change gets the same review as any other change to how a vendor is paid.
What should AP do when an existing vendor changes bank details?
Treat a bank-detail change as a new onboarding, not a routine update. Fraudsters rarely try to create a fake vendor from scratch. It's easier to impersonate a real one with a history of paid invoices and ask for payments to go somewhere new, which is the pattern described in the guide to social engineering fraud.
A change request that arrives by email should trigger the same callback, the same validation check, and the same second approval as a brand-new vendor. Nacha's developer guidance recommends a fresh prenote when an account number changes, and many banks require one. The prenote confirms the new account works. The callback confirms your vendor asked for it.
Timing is worth watching too. Requests that arrive right before a large scheduled payment, or that come with pressure to skip the usual steps, deserve the most scrutiny. Putting a short hold on the first payment to any changed account gives the real vendor time to notice if something is wrong.
How Corpay handles vendor payment setup
Most of the risk in ACH vendor payments sits in the setup step, when bank details arrive and someone decides whether to trust them. With Corpay's fully managed AP, supplier enrollment is part of the service, so your team isn't collecting bank details by email or running prenotes one vendor at a time.
Corpay payments automation pays each supplier by virtual card, ACH, or check from one workflow. Card payments use single-use virtual cards, which carry no reusable bank details for a fraudster to redirect, and Corpay pays its customers more than $800M in rebates each year. Corpay AP automation connects through 100+ ERP integrations, including NetSuite, Sage Intacct, Business Central, and Acumatica, and most customers are live in weeks.
The shift to electronic payments makes this setup step more important every year. The Federal Reserve Bank of Cleveland's September 2026 brief on B2B payments found checks fell from 32% of B2B payments by number in 2015 to 13% in 2024, while ACH rose from a quarter of payments to 41%. Nacha's report on the ACH Network in the second quarter of 2026 counted 2.2 billion B2B payments that quarter and 4.3 billion in the first half of the year, up 10.3%.
Frequently Asked Questions
How long does it take before the first payment after a prenote?
At least three banking days after the prenote settles, if you send one. Weekends, federal holidays, and missed bank cutoffs extend the wait. If a return or notification of change comes back, the clock restarts after the account details are corrected.
Does a prenote show up on a bank statement?
Usually not in any way that matters. A prenote is a zero-dollar entry, so it doesn't change the account balance. Some banks list it as a zero-dollar item, but most account holders never notice it.
Can you skip the prenote?
Yes, under the Nacha Operating Rules prenotes are optional for most originators. Your bank, your payment platform, or your own policy may still require one. If you skip it, verify the account another way, ideally with a check that confirms who owns it.
What happens if a prenote is returned?
A returned prenote means the account details are invalid or the account is closed. Don't send the live payment. Contact the vendor at a phone number already in your records, get corrected details, verify them, and send a new prenote if your process requires one.
Switch to Corpay
Discover how making the move to Corpay streamlines payments and strengthens your business.
Talk to an ExpertSmarter payments. Stronger growth. Keep business moving.
Corpay powers payments for 800,000+ businesses worldwide. Let’s build what’s next for yours.