ACH origination credit risk is the risk that an originating bank advances money on a business client's ACH file and cannot recover it. For a credit file, such as a payroll, the bank is exposed from the moment it sends the file until the client funds it at settlement. For a debit file, such as a subscription business collecting from members, the exposure starts when the bank makes the collected money available to the client and lasts until the debits can no longer be returned, which for consumer entries returned as unauthorized can be weeks later. The exposure is therefore a window, not a file, and a limit that measures only the day's file misses most of it. Botminds' ACH Originator Risk Assessment measures each originator's returns nightly and sizes that window, and the reserve behind it, from the client's own history.
The example used throughout is a fictional sample originator, Pinecrest Membership Clubs, at a fictional bank, Corvane; its figures are sample data from the solution.
One debit file's open window: four phases after the bank releases it
1
Release to settlement
Hours to a day or two
The bank sends the file and settles with the ACH Operator, crediting its client for the debits.
2
The ordinary return window
Two banking days after settlement
Receiving banks can return any entry for routine reasons such as insufficient funds or a closed account.
3
The unauthorized window
To sixty days after settlement
Consumer debits the receiver says it never authorized can still be returned.
4
The warranty tail
One year for business accounts; up to two years for consumer accounts
Claims against the originating bank's authorization warranty, outside the return system.
What is ACH credit risk for an originating bank?
It is the gap between the bank paying and the bank being sure it will not have to pay again. The OCC describes both sides. On credits: "For ACH credit entries, the originating bank (ODFI) incurs credit risk upon initiating the entries until its customer funds the account at settlement." On debits: "For ACH debit entries, the ODFI incurs credit risk from the time it grants its customer funds availability until the ACH debit can no longer be returned by the RDFI" (OCC Bulletin 2006-39).
The FFIEC's handbook adds the point that makes this a bank's problem rather than its client's: "Returns are another source of credit risk for all forms of retail payment systems" (FFIEC IT Handbook, Credit Risk). When a debit comes back, the receiving bank takes the money back from the originating bank through settlement. The originating bank then has to recover it from its client. Most of the time that is a charge to the client's account; the credit risk is the time it is not.
Why is ACH debit origination risky for banks?
Because the bank pays first and finds out later. A debit originator's money arrives at settlement and is usually available to it then; the returns arrive over the following days and weeks, and for unauthorized consumer debits, for up to sixty days. Meanwhile the originating bank stands behind every entry: the FFIEC's handbook reminds banks that the originating bank warrants the validity of each entry, including that the receiver authorized it, even when a service provider transmitted it (FFIEC, Third-Party ACH Processing). If the client's account is empty, closed or frozen when the returns come in, the loss is the bank's.
Nacha's Risk Management Advisory Group lists this exposure among the reasons banks must set limits even when they prefund credits: "Credit exposure from Returns on originated debits" (Nacha RMAG, March 2025). The risk scales with the network. Nacha counted 35.2 billion ACH payments worth $93 trillion in 2025 (Nacha, January 2026), and every debit among them that settled into an originator's account carried some open window behind it.
ACH debit origination vs ACH credit origination
The two carry credit risk at opposite ends of the payment. A credit file is risky before settlement, until the client funds it; a debit file is risky after settlement, until the returns stop. The difference decides which tool fits each.
ACH credit origination and ACH debit origination carry risk at opposite ends
Credit origination: Payroll, vendor and tax payments pushed out by the client.
Debit origination: Subscriptions, loan payments, utility and membership bills pulled in by the client.
Credit origination: From sending the file until the client funds it at settlement.
Debit origination: From making the funds available until the debits can no longer be returned.
Credit origination: Typically about three days, in the FFIEC's description.
Debit origination: Days for ordinary returns; up to sixty days for unauthorized consumer debits.
Credit origination: The client cannot fund the file; a fraudster sends credits from a compromised account.
Debit origination: Unauthorized or failed debits come back after the client has spent the money.
Credit origination: Prefunding, and a credit exposure limit.
Debit origination: A debit exposure limit sized for returns, a reserve, and holds on debit proceeds.
That is why prefunding, the standard answer for credit originators, does little for a debit originator. The money a debit originator would prefund is the very money its debits brought in. When to require prefunding, and when a limit is enough, is set out separately; for a debit originator, the reserve and the hold are the tools that reach the window.
How long can an ACH debit be returned?
For most returns, two banking days after settlement; for consumer debits the receiver did not authorize, up to sixty days after settlement; and beyond the return system, a warranty claim for longer still. The FFIEC's handbook describes the first two windows, and Nacha's rule on warranty claims, in force since June 30, 2021, sets the outer edge: "For an entry to a non-consumer account, the time limit is one year from the settlement date of the entry," while for consumer accounts the limit is two years, with the first ninety-five days after the first unauthorized entry always covered (Nacha, Limitation on Warranty Claims).
The warranty rule changed the shape of the tail. The OCC's 2006 bulletin, written before it, warned that an originating bank's warranty liability was limited only by the statute of limitations for breach of contract; Nacha's own summary of the 2021 rule lists greater certainty about long-term returns and their credit risk as a benefit to originating banks. The window is still long, but it now has an end. The full set of return clocks is covered in the ACH return time frame guide.
Drawing the window for one debit file
Take the sample originator's largest file of the quarter, a $1,842,400 internet-authorized debit file that settled on October 1. On that day the bank credited Pinecrest with the collected funds. For two banking days, any of those debits could come back for ordinary reasons; for sixty days, any consumer member could say it never authorized the debit and have it returned. Behind that file, $124,600 of earlier debits were still in flight, already settled and still returnable.
What was exposed when one file settled
| Component | Amount | How long it stays open |
|---|---|---|
| The October 1 debit file | $1,842,400 | Until its returns stop: two banking days for ordinary returns, sixty days for unauthorized consumer returns |
| Earlier debits still returnable | $124,600 | Each until its own window closes |
| Peak measured need | $1,967,000 | 98% of the $2,000,000 limit then in force |
| Return reserve approved October 20 | $210,000 | Held at the bank under the October 20 decision |
Most of that $1.97 million will never come back; Pinecrest's overall return rate was 4.90%. The question for the bank is not the whole amount but how much of it could return, and whether the client could cover that if it did. That is a question the client's own return history can answer.
Sizing the window from the client's own returns
Size it from what the client's debits actually do. The overall return rate gives the share of a file likely to come back for any reason; the unauthorized rate gives the share that can come back late; and the trend says which way both are moving. Pinecrest's unauthorized rate had been rising for six months.
One originator's unauthorized return rate, month by month, against two lines
A reserve converts the rate into money. The sample bank's method is simple and visible: the average settlement day, $862,000, times the overall return rate, 4.90%, gives about $42,238 of expected returns a day; five settlement days of that is $211,190, held as $210,000. Five days is a policy choice, not a rule. A bank worried about the sixty-day tail on an unauthorized-heavy book might size a second layer from the unauthorized rate over a longer period.
The cause matters as much as the size. Of Pinecrest's 2,560 unauthorized returns in the sixty days to October 16, 84% were R10s, consumers saying the entry was not authorized, and 1,673 came through the trial. Members who joined before the trial returned at 0.11%. The window was wide because one product had widened it, which means one change could narrow it.
The rates, ninety days of files and the limits on one page
The debit window is a liquidity question too
Uncollected debits are not only credit exposure; they are money the bank has advanced and may have to fund. The FFIEC's handbook says "Financial institutions should consider the volume of their uncollected ACH transactions as part of their liquidity risk management practices" (FFIEC, ACH risk management controls). Its examination procedures ask whether the bank "treats deposits resulting from ACH transmitted debits on other accounts as uncollected funds until there is reasonable assurance the debits have been paid by the institution on which they were drawn" (FFIEC, Appendix A).
For a debit originator that is the hold: proceeds of its debits treated as uncollected, and therefore not available, for a period the bank chooses. A hold shortens the window directly, because the bank has not yet released what it might have to take back. It is also the control a client feels most, which is why it belongs with the tier and the client's own return history rather than applied to everyone.
What shrinks the window: holds, reserves, limits and better authorizations
Four tools act on the window from different sides. Two cover it, one caps it, and one closes it at the source.
Four ways to shrink an originator's debit window, and what each does
- Hold debit proceeds as uncollected
Shortens the time the bank is exposed by delaying availability. Strongest effect, most felt by the client.
- Hold a return reserve
Covers expected returns with the client's own cash, sized from its return rate. Pinecrest: $210,000.
- Cap the debit exposure limit
Limits how much can be open at once; files above it are prefunded or held. Pinecrest: $2,000,000 to $1,200,000.
- Fix the authorizations that produce the returns
Closes the window at the source: a second authorization when a trial converts, account validation before the first WEB debit, faster handling of revocations.
The fourth is the only one that makes the risk smaller rather than better covered, and it depends on the originator. Pinecrest's own controls answers explain its returns: no second authorization when a trial converted, about 14% of new accounts debited before validation completed, and a median of nine business days to honour a revocation. The remediation plan the agents drafted, and a person approved, targets exactly those. The account validation step has been required of WEB debit originators since March 19, 2021.
The controls that widened the window, each quoted against the rule
When the client cannot cover its returns
The loss case is the one the window exists to prevent. Returns arrive; the originating bank charges them to the client's account; the account does not have the money, has been closed, or has been frozen in a bankruptcy or other legal action. The FFIEC's handbook names those three outcomes as the ways an originating bank ends up holding a returned debit itself. A debit originator whose business is weakening can show it in its returns, as customers cancel and accounts close, which is why a rising return rate is a credit signal, not only a compliance one.
That is the case for measuring every originator's returns every night rather than at review time, and for tying the measurement to the limit. At the sample bank the unauthorized rate crossed the bank's own 0.35% warning on September 2 and Nacha's 0.50% line on October 19, and the limit, prefunding and reserve were in force at the payments hub on the morning of October 21. To see the window sized for your own originators, start from ACH Originator Risk Assessment; how the limit itself is calculated is in the ACH exposure limit guide.
Questions people ask
What is ACH exposure?
It is the money a bank has committed on an originator's behalf and not yet secured: credit files not yet funded and debit files still open to return. It is usually measured as the largest settlement day plus the debits still returnable behind it; for Pinecrest that was $1,967,000 against a $2,000,000 limit.
Is ACH credit origination risky for a bank?
Briefly but sharply. The FFIEC describes a typical exposure of about three days on a credit file, until the client funds it, and the amounts can be large. The main risks are a client that cannot fund its payroll and a compromised account sending fraudulent credits, which is why limits apply even when credits are prefunded.
Can a bank lose money on a debit after the sixty days?
Through a warranty claim, yes, within limits. Since June 30, 2021 Nacha limits claims against the originating bank's authorization warranty to one year from settlement for business accounts and two years for consumer accounts, with the first ninety-five days after the first unauthorized entry always covered.
Does Same Day ACH change the window?
It moves the start, not the end. A same-day debit settles sooner, so the client may have the money sooner, but the return windows run from settlement in the same way. Nacha counted 1.4 billion Same Day ACH payments in 2025, which is why exposure monitoring works by settlement date rather than by the day a file was sent.
Why use the overall return rate to size a reserve?
Because any return, not only an unauthorized one, takes money back from the bank. The unauthorized rate matters for Nacha's 0.50% line and for how late returns can arrive; the overall rate is the better measure of how much of a typical day comes back at all.