CMS-588: How the Medicare EFT Authorization Agreement Actually Works

CMS-588 is CMS's Electronic Funds Transfer (EFT) Authorization Agreement — OMB control number 0938-0626, current revision dated November 2023. CMS-588 authorizes electronic funds transfer: it tells the Medicare Administrative Contractor (MAC) which bank account receives Medicare deposits and gives CMS legal authority to credit that account, and to reverse duplicate or erroneous entries under 31 CFR part 210.

What it is not: a Medicare enrollment. The form itself says so, in a boxed note quoting the Affordable Care Act: "In accordance with section 1104 of the Affordable Care Act, enrollment of electronic fund transfer (EFT) is for electronic fund transfer authorization only. EFT enrollment does not constitute enrollment as a provider or supplier in the Medicare program" (CMS-588 form). Submitting a CMS-588 with no CMS-855 behind it accomplishes nothing. The organization enrolls in Medicare through PECOS using CMS-855B; a practitioner enrolls in Medicare using CMS-855I; the CMS-588 rides alongside as the payment-delivery instruction. If your group has not started that enrollment yet, start with our Medicare provider enrollment service or the CMS-855B guide — the 588 is a passenger, not the vehicle.

And yet the form is not optional in any practical sense. 42 CFR 424.510(e) — the enrollment-requirements regulation — states that providers and suppliers must "(1) Agree to receive Medicare payment via electronic funds transfer (EFT) at the time of enrollment, revalidation, change of Medicare contractors where the provider or supplier was already receiving payments via EFT or submission of an enrollment change request; and (2) Submit the CMS-588 form to receive Medicare payment via electronic funds transfer" (42 CFR 424.510, current as of August 2026). So the honest framing is: the CMS-588 does not enroll you, but enrolling commits you to EFT, and the CMS-588 is the instrument that delivers on that commitment.

One structural fact from the form's Part II instructions worth knowing before you plan anything multi-account: "A provider/supplier may only have one EFT account per enrollment." A group cannot split Medicare deposits across accounts within a single enrollment, whatever its bookkeeping preferences.

The form's Part I offers exactly the reasons the form itself prints — a New EFT Enrollment checkbox and a Change to Current EFT Enrollment checkbox, the latter annotated "e.g. account or bank changes." The instructions say it plainly: "Indicate your reason for completing this form by checking the appropriate box: New EFT enrollment or change to your EFT enrollment account information" (CMS-588 instructions).

The reassignment row deserves a sentence, because it prevents a common redundant filing. When a practitioner reassigns benefits to the group through the CMS-855I, Medicare pays the group, not the practitioner — so the group's EFT account is the one that matters, and the individual physician files no CMS-588 of their own. The mechanics of reassignment live in our CMS-855I guide.

What about revalidation? A provider revalidates enrollment on CMS's cycle — generally every five years, per CMS's revalidation page — and 42 CFR 424.510(e) requires agreeing to EFT at revalidation. But no CMS page we fetched lists the CMS-588 as a standing revalidation attachment; the form's own submission reasons remain new EFT enrollment and banking changes. The operational rule that follows: at revalidation, submit a CMS-588 only if your banking information has changed or you were never on EFT — not reflexively.

The CMS-588's most consequential sentence is in its Part V instructions: "The EFT authorization form must be signed and dated by the same Authorized Representative or a Delegated Official named on the CMS-855 Medicare enrollment application which the Medicare contractor has on file" (CMS-588 instructions). The signature block enforces it — "Must be signed and dated to process."

Read the sentence as a database constraint, not as etiquette. The MAC compares the CMS-588 signer against the officials recorded on the enrollment the MAC has on file. A practice manager's signature, an owner not listed on the 855, the new administrator whose delegation was never reported — any of these produces a development request or a return, and because the CMS-588 typically travels inside a larger enrollment packet, the mismatch surfaces weeks after everyone thought the paperwork was done. In our experience this signer mismatch is the most common purely-preventable reason an EFT authorization stalls.

Who these officials are, in CMS's own definitions from its provider-enrollment training deck (PE 101, Aug 2024):

• Authorized Official (AO) — "An appointed official with the legal authority to enroll, make changes and ensure compliance with enrollment requirements (CEO, CFO, partner, chairman, owner, Administrator, President)." On enrollment applications, the Authorized Official (AO) signs.
• Delegated Official (DO) — appointed by the AO, must be an owner, control-interest holder, or W-2 managing employee. Under 42 CFR 424.510(d)(3)(ii) as amended effective December 2, 2025, a DO may sign updates and changes reported outside the initial-enrollment and periodic-revalidation processes — initial and revalidation applications themselves are signed by an Authorized Official (42 CFR 424.510).

Two sharpening details from the regulation: 42 CFR 424.510(d)(3)(ii) requires each delegation of authority to be assigned by the AO on file and reported to CMS through the enrollment application — a DO the MAC has never been told about is, for signature purposes, nobody. And individual practitioners and sole proprietors "cannot delegate signature authority" at all; the enrolling individual signs personally (42 CFR 424.510).

A terminology note as of August 2026: the Identity & Access (I&A) Management System's current Quick Reference Guide (dated January 2026) uses the role name "Access Manager" for the individual the AO delegates system authority to, while PECOS itself and the CMS-588 still say Delegated Official — live PECOS system notices from August 2026 still reference "delegated officials (DOs)." Same concept, two vocabularies, and the form follows the PECOS vocabulary.

What a third party can and cannot do here: a surrogate works on the provider's behalf through the Identity & Access (I&A) Management System — I&A defines a surrogate as an organization with a business relationship allowing it "to access, view, and modify information within CMS computer systems on their behalf" (I&A Quick Reference Guide). A surrogate connection lets a billing partner prepare and manage the submission; it does not transfer the signature. The AO still signs, and nobody should be asking for your login instead — the I&A system's own terms state "Sharing of login information is strictly prohibited!" (I&A login). MedPrecision works exclusively through an approved I&A surrogate connection and never asks for CMS or PECOS usernames or passwords; your AO retains control and signs.

The form runs five parts. Here is each one with the requirement that actually causes returns, all drawn from the current instructions (CMS-588, Rev. 11/2023):

The name-match discipline in Parts II and III is one continuous thread, and it is the same thread that runs through the whole Medicare enrollment: the legal business name on the IRS CP-575, the name on the CMS-855, the account holder name on the CMS-588, and the name printed on the bank's confirmation letter or voided check must be the same string. The account itself must bear that name — the certification in Part V has the signer attest "that the account is drawn in the Name of the Physician or Individual Practitioner, or the Legal Business Name of the person or entity" and that the entity "has sole control of the account." A group that banks under a dba while its CP-575 says something else has a mismatch to resolve with the bank before filing, not after the development request arrives.

Two more facts from the instructions that answer the questions coordinators actually ask. Timing: "All EFT requests are subject to a pre-certification period in which all accounts are verified by the qualifying financial institution before any Medicare direct deposits are made" — CMS publishes no day-count for that verification, so treat any specific number you read elsewhere as a third-party estimate. Duration: the authorization "is to remain in full force and effect until CMS has received written notification" of termination — a CMS-588 is not periodically renewed; it lives until you change it.

Before any submission, run the packet against our provider enrollment checklist — the CP-575, the bank letter, and the 855-official roster are all on it.

The form's instructions give the routes without ceremony: "Upload this form to PECOS or mail this form to the Medicare contractor that services your geographical area" (CMS-588 instructions). There is no third path — no email, no fax instruction on the current form, and mailing it to CMS in Baltimore is explicitly warned against in the Paperwork Reduction Act notice ("DO NOT MAIL THIS FORM TO THIS ADDRESS").

Two practical notes on the mail route. First, "your" MAC means the Medicare Administrative Contractor for your geographic jurisdiction — the same contractor that holds your enrollment. The form's instructions point to CMS's fee-for-service contact list for mailing addresses; your MAC's own site (National Government Services for Jurisdiction K, Novitas for JL/JH, and so on) publishes its provider-enrollment mailing address. Second, remember the per-contractor rule from Part V: a practice billing more than one Medicare contractor files a separate CMS-588 with each one.

On "how long does EFT take": the only thing CMS's form publishes is the bank pre-certification sentence quoted in the previous section. The MAC processing goals you may have seen — National Government Services states that all MACs have a goal to finalize an internet-based PECOS application within 15 days and a CMS-855 paper application within 30 days when all required information is available (page reviewed September 2025), and Novitas publishes CMS-defined timeframes such as 95% of no-site-visit PECOS initial enrollments completed within 15 calendar days — are published for enrollment applications, are framed by the MACs themselves as goals and CMS timeliness standards rather than guarantees, and are not EFT-specific commitments. If the CMS-588 travels inside an enrollment packet, the enrollment clock is the clock that matters; the walkthrough of that system is in our PECOS enrollment guide.

For a new group practice, the CMS-588 is never filed in isolation — it is one document in a sequence, and its dependencies run backward through the whole stack. The order that works:

1. NPPES assigns the NPI. The group's Type 2 (organizational) NPI comes first; the CMS-855B itself notes that applicants require a Type 2 NPI, and the CMS-588 cannot process without an NPI in Part II.
2. I&A access is established. The Authorized Official's Identity & Access account is what unlocks PECOS — and, if a billing partner is helping, the surrogate connection is approved here.
3. The organization enrolls in Medicare through PECOS using CMS-855B. This is the submission the 588 supports.
4. CMS-588 authorizes electronic funds transfer, uploaded into the same PECOS submission with the bank-letterhead confirmation or voided check attached.
5. The practitioner enrolls (CMS-855I) and reassigns benefits to the group — both parties "must be currently enrolled (or concurrently enrolling via submission of the CMS-855B for the eligible organization/group and the CMS-855I for the individual practitioner)" before a reassignment can take effect (CMS-855I). Because payment flows to the group, the group's CMS-588 is the only one needed.
6. The MAC processes the application and issues the PTAN, communicated in the approval letter. What that number is and why it is not your NPI is covered in our PTAN guide.

Notice why the regulation's timing language fits this picture: 424.510(d)(2)(iv) puts the EFT agreement "at the time of enrollment" — CMS expects the payment instruction to arrive with the enrollment, not as an afterthought once claims are ready to go out. A packet submitted without its CMS-588 invites exactly the kind of development request that stops the MAC's processing clock.

One money detail that surprises new groups pleasantly: the Medicare application fee is not the 588's concern, and for most readers of this page it is nobody's concern — CMS's MLN provider-enrollment publication states that physicians, non-physician practitioners, and physician organizations "don't pay a Medicare enrollment application fee"; the 2026 fee of $750 applies generally to institutional providers and suppliers such as DMEPOS suppliers (CMS MLN, Medicare Provider Enrollment, as of August 2026).

And the reason to get the sequence right the first time is the billing math at the end of it: 42 CFR 424.521 lets physicians, non-physician practitioners, and physician organizations retrospectively bill for services furnished up to 30 days before their effective date when circumstances precluded earlier enrollment (42 CFR 424.521) — a window that absorbs a short processing tail but not a packet bounced twice over a signature or a bank-name mismatch. MedPrecision's Medicare group-enrollment packages include CMS-588 preparation alongside the 855B and the reassignments, with kickoff within one business day and submission about five to seven business days after a complete document package; MAC processing time is the MAC's, and we track it rather than promise it.