If your systems have visibility to the sensitive account data, your negligence could be responsible for any breach or fraud. So by merely collecting the data, you expose yourself to these risks.
These risks are magnified if the sensitive data is durably stored "at rest" in your custody- whether on servers you control or at a provider you contract with- rather than just passing through your systems "in transit."
There are plenty of services that will store data for you, but they will not take any custodial responsibility, particularly in the heightened form that storage of sensitive data implies. Custody remains with you.
So- because your systems have visibility, risk remains with you and you cannot expect to shift that risk onto another provider. Therefore there will not be services that work in precisely the desired fashion in the ACH space.
Services, like Stripe, collect customer payment information and then use that information to request transfers of money from customer accounts to your account. You can safely utilize these services with minimal risk because you never see the sensitive account data. Stripe bears the risk, in exchange for taking a 2-3% cut.
The rules in this arena are much clearer in the credit card domain, where PCI has over the years developed a relatively high degree of sophistication for classifying participating organizations, developing roles and standards, building an audit and compliance ecosystem, and handling enforcement. It is not perfect, and credit card fraud occurs every day, but it is managed and the requirements and consequences are much clearer.
The ACH system, whose counterpart to PCI is NACHA, is much older and arguably less well organized than the credit card system. The machinery is much less mature. This risks that arise from the lack of maturity are offset by the pace at which the ACH system works, in which the minimum transaction time is days rather than the seconds that can be achieved in the credit card system. But NACHA still expects that billers utilizing ACH must have clear evidence both of the identity of the customer initiating the payment and of their assent to any particular transaction. These responsibilities begin with the parties who collect this information.
