Can an agency legally take money from your bank account?

Somebody has asked a creator to sign something that lets money leave their bank account automatically. That is a reasonable thing to be nervous about, and most of the answers they will find are written by people selling them something.

This one is written by people selling something too. So here is the version with the parts that are inconvenient for us left in.

Yes, and it is ordinary

A preauthorized debit from a consumer bank account is the same mechanism behind a gym membership, a phone bill and a mortgage. It is not exotic and it is not a loophole. It is called an ACH debit and it is governed by rules that exist specifically because the person being debited is not in the room when it happens.

What makes a particular debit legitimate is not the technology. It is the authorization.

What a real authorization has to be

Not a clause buried in a contract. The rules require an affirmative act, and a valid one has these properties:

• It is specific. It says who is debiting, roughly how much, how often, and how to revoke it. "Agency may collect its fees" is not an authorization.
• It is retrievable. The party debiting has to be able to produce it later. In practice that means a record of what was on the screen, when, and that the person agreed — not a checkbox with no memory.
• It is revocable, by you, at any time. This is not a courtesy. If revoking is hard, the authorization is weaker, not stronger.

The one that most people do not know about

If the amount varies — and a commission always varies — the person being debited is entitled to written notice of the amount and the date before it happens. That comes from Regulation E, and "written" has a specific meaning: in a form the consumer may keep.

A text message is not that. A push notification is not that. A number that appears in a dashboard if you happen to log in is not that.

So if you are a creator: you should be told, in writing, every single time, before anything moves. If you are not, the arrangement is not compliant, regardless of what you signed.

What you can do if you disagree with one

Three separate powers, and they escalate:

• Question it before it moves. If you were given notice, there is a window between being told and being debited. That is what the window is for.
• Revoke the authorization. Tell the party debiting you. They must stop. You can also tell your bank, which is a stronger instruction because it does not rely on them acting.
• Dispute it after the fact. For a consumer account, an unauthorized ACH debit can be returned — and the window for that is much longer than most people expect, up to 60 days from the statement. The bank does not need the other party's agreement.

That last one is worth understanding from both sides. A creator has a real remedy. And an agency should understand that a debit somebody does not recognize does not just get reversed — it is recorded as unauthorized, counted against a threshold, and enough of them ends the ability to debit anybody.

The questions worth asking before you sign

• Will I be told the amount before every debit, in writing? If the answer is anything other than yes, stop.
• What name will appear on my bank statement? If you will not recognize it, you will dispute your own agency's legitimate debit by accident.
• Does anyone hold my money at any point? The answer should be no. Money should move from your account to theirs, not into a middle account first.
• Am I charged anything? In a well-built arrangement, the answer is no — the agency's software is the agency's cost.
• How do I revoke it, and what happens then? There should be a plain answer that does not involve asking permission.

And the honest limit

None of this makes a bad agency into a good one. An authorization is a mechanism, and a mechanism is neutral. What it does is make the arrangement visible: an amount, a date, a written notice, a record, and a revocation you control.

The version worth worrying about is not the one with a signed authorization and a notice before every debit. It is the one where your payouts are quietly directed into an account somebody else controls and you are sent what is left. That arrangement has no notice, no record, and nothing to revoke.

OnlyFlow charges creators nothing, moves money between the two parties' own accounts without holding it, and refuses to debit at all if the written notice was not confirmed delivered. Those are the things we would want checked if we were the one signing.