Q. (cont.) We reimburse individuals for expenses such as hospitality, travel, business meals, etc. How long is it required to keep the form on file?
Currently we have a paper form requesting bank information and that the individual signs the form. We are working on a project to get this form on a secure site where individuals can complete the PDF version of the form. However, I was asked if the signature is required on the form. Are there IRS regulations on this?
A. Direct deposit regulations vary by state. But it does appear that at least in some states a signature is required on an enrollment/authorization form for direct deposit.
As for electronic forms, provided that an online form can collect a valid, secure electronic signature on an electronic form, online enrollment may be allowed. For example, the U.S. Social Security Administration uses an online form for direct deposit sign up. But again, this may vary by state.
The recommended period to retain the forms is three years after a form is no longer in effect or the last deposit was made. Some sources say two to three years, while the National Archives and Records Administration General Records Schedules say “Direct Deposit Sign-up Form (SF 1199A) – Destroy when superseded or after separation. (N1-GRS-92-4 item 17)”. On the other hand, New York State and Colorado both require you to retain the authorization forms for a minimum of three years, and payroll giant ADP states three years as the retention period.
The payroll records themselves are the critical records, more important than the DD authorization. But you want records to be able to provide evidence that you did pay the particular individual; while electronic payment records document that, the authorization form with signature supports that you made the payments to the account authorized by the payee. We recommend retaining the authorization forms for three years from cessation of payment.
Here is what Rob Unger, NACHA Sr. Director, Project Mgmt. and Strategic Corporate Relations has to say:
“For a direct deposit ACH credit from a company/business to a consumer account, the consumer may provide authorization in writing, orally, or by other non-written means. The Rules do not spell out further specifics on how an authorization should be provided/obtained. Obviously, a recommended practice I think would be to provide a form (electronic or written) where a consumer/employee can instruct the business regarding which account(s) should be credited.
“The notice/form should provide instructions for how the authorization may be revoked, and the time needed for a business to reasonably act on the revocation. There are a number of samples if you do a web search – though we of course can’t attest to any. There is a sample however in the NACHA Rules, Appendix F – page OG295.
“Generally, ACH authorization records must be retained two years beyond the date of revocation. These references here are to the NACHA Rules; it’s possible, as you noted, that states may have additional requirements – but we do not track those.”