The bank decides arbitrarily but effectively since if you're a crook, they lose that money so they limit the ability to the degree that they trust you, and once their own money is on the line, banks weirdly become much more effective at restricting fraud.
In essence, it's just equivalent to any other customer risk management by the bank, since allowing you a certain amount of ACH withdrawals is in some sense similar to credit risk.
