The ACH return process is how a bank sends back an ACH entry it cannot or should not post: the receiving bank (the RDFI) picks a return reason code, puts the return in a file inside the Nacha deadline, and the originating bank (the ODFI) charges it back to its customer and watches that customer's return rates. Most returns must reach the ODFI by the second banking day after settlement; a consumer's unauthorized debit can come back for 60 days, but only with the customer's signed statement. The work is hard because one return touches four people with different clocks and different authority, and a miss in any seat becomes the bank's loss. Botminds' ACH Returns & NOC Management has agents prepare each return, claim and notification of change with its code, rule and deadline, so each person decides only what is theirs to decide.
The examples on this page come from a fictional sample bank as it runs through the solution: Tessaly Community Bank, a community bank with a sponsor-bank fintech program, on Thursday, October 22, 2026. Rules and figures from regulators and Nacha are linked where they appear.
Why one return needs four people
35.2billion
ACH Network payments in 2025, worth $93 trillion; any debit among them can come back
Nacha, January 2026
2banking days
for most returns to reach the originating bank after settlement
FFIEC Retail Payment Systems booklet
60days
for a consumer’s unauthorized debit, with a signed statement, and the originating bank’s exposure for as long
FFIEC Retail Payment Systems booklet
How does the ACH return process work, from one file to the next?
The process starts when an entry lands on the receiving bank's books and cannot post, or when a customer disputes it later. The FFIEC's glossary defines the result plainly: a return is "any ACH entry that has been returned to the ODFI by the RDFI or by the ACH operator because it cannot be processed," and "the reason for each return is included with the return in the form of a 'return reason code'" (FFIEC, Retail Payment Systems). Everything that follows is a decision about which code, by when, and on what evidence.
For an authorized entry that simply cannot post, the clock is short. "If the transaction is properly authorized, returns must be made no later than the second banking day following settlement," the same booklet says. That covers the bulk of the work: insufficient funds (R01), a closed account (R02), no account found (R03). The core system usually flags these overnight as posting exceptions, and a specialist works them the next morning.
The second stream arrives through the customer. A consumer who says a debit was not authorized, or not as authorized, has a longer window, but the bank may only use it once the customer has signed a written statement of unauthorized debit. That claim travels from whoever took the call to the specialist who codes it. The third stream runs the other way: notifications of change and returns on entries the bank itself sent, which land with the ODFI side of the house.
One debit return, from the posting exception to the originator's rate
Agent
Read the filesReads the overnight return and correction files and the core’s posting exceptions, and puts each item in the tray for its own deadline.
Never: posts or returns anything.
Agent
Propose the codeChecks balance, status, stop payments and claims for each entry, and proposes the code the evidence supports with each check cited.
Never: proposes a code below 95% confidence; it asks the specialist instead.
A person decides
ACH Operations SpecialistApproves in-window returns, changes a code with a reason, and works the items that need judgment.
A person decides
Whoever takes the claimGets the customer’s signed statement of unauthorized debit, on paper, online or by phone, before an extended return can go.
A person decides
ACH Operations ManagerSigns late returns, suspected-fraud returns, dishonors and anything over the bank’s dollar line.
Agent
Measure the originatorOn the ODFI side, counts returns against each originator’s debits over 60 days and forecasts the next eight days.
Never: restricts an originator.
A person decides
Fintech Partner Risk ManagerCo-signs any control or restriction on an originator heading toward a Nacha line.
What is an RDFI, and what is an ODFI, in a return?
The RDFI is the receiving bank, whose customer's account the entry was sent to; the ODFI is the originating bank, which sent the entry for its customer, the originator. A return flows from RDFI to ODFI. Nacha's own definition makes the chain explicit: an originator is "a Person that has authorized an ODFI (directly or through a Third-Party Sender) to Transmit...an entry to the Receiver's account at the RDFI," and since June 2024 the definition also names the originator as the party the receiver authorized (Nacha, Minor Rules Topics 2024).
Almost every bank is both at once. The same operations team receives returns on the debits its fintech partners and business clients send, and sends returns on debits that hit its own depositors. The two sides carry different risk. The FFIEC calls an RDFI's credit risk "minimal because it has the right to return items it is unable to post to customers' transaction accounts within NACHA guidelines and timeframes," while "ODFIs that generate debits have a credit exposure of 60 days due to the potential for returns." The RDFI's risk is missing a deadline; the ODFI's is an originator whose debits keep coming back.
The same bank, two roles: what each side of the return owes
| As the RDFI (receiving bank) | As the ODFI (originating bank) | |
|---|---|---|
| What arrives | Posting exceptions from the core; customers’ claims of unauthorized debits | Returns and notifications of change on entries the bank sent |
| The decision | Which return code, in which file, on what evidence | Whether a return arrived on time and complete, and what the originator must fix |
| The clock | Two banking days for most returns; 60 days for consumer unauthorized debits with a signed statement | The originator’s rolling 60-day return rates; Nacha’s fixed correction deadlines |
| The risk | A missed window leaves the item with the bank | Credit exposure for as long as debits can come back, and a Nacha inquiry if rates run high |
The specialist who picks the code
The ACH operations specialist owns the RDFI decision: for each exception, the right code, in the right file, before the deadline. On a busy morning that is hundreds of small judgments. At the sample bank, the overnight run left 286 returns for tomorrow's file worth $412,880.47, seven of them due in today's 4:00 p.m. file, plus 41 unauthorized-debit claims inside the 60-day window.
Most of those are not hard. Owen Haverford's $1,860.00 PPD debit from CORLISS AUTO LOAN settled on October 21 against an available balance of $212.40, and the overdraft transfer from savings was declined. R01, insufficient funds, due at the originating bank by opening of business on Friday, October 23. The hard part is that the easy item and the hard item arrive in the same list, in the order the core printed them, so the one due today can sit below one due in sixty days.
The specialist's seat: each return with its code, its checks and its clock
The specialist also decides which code the evidence supports when a customer's account of events and the claim form disagree. That choice has consequences downstream, because an R11 lets the originator correct and resend while an R10 tells it the customer never authorized it at all; how to check whether each return code was right takes that judgment code by code.
The person who takes the customer's statement
The second seat is often not in operations at all. A consumer disputing a debit calls the contact center, writes through online banking or walks into a branch, and the person who answers has to get a written statement of unauthorized debit signed before the bank can send an extended return. Since 2021 Nacha has said that statement may be taken electronically or orally, and since October 2024 it may be signed as soon as the debit is presented, even before it posts.
What that seat does with the statement varies widely. Nacha reported in July 2026 that some receiving banks review each claim and decline to return a debit when it is not credible, while others return on the signed statement alone (Nacha, July 2026). The person who takes the claim either asks those questions or hands the specialist a form and a hope. The written statement of unauthorized debit, element by element covers what that form must carry.
The analyst who watches the originator's returns
The third seat sits on the ODFI side and looks at returns in aggregate. Every return that comes back on a debit the bank sent is also a data point about the originator who sent it: its unauthorized rate against Nacha's 0.5% threshold, its administrative rate against the 3% level, and its overall rate against 15%. Nacha's position is that "ODFIs should already have monitoring in place regarding their Originators and Third-Party Senders unauthorized debit return rates" (Nacha, ACH Network Risk and Enforcement Topics).
In a bank with a fintech program this seat is often the partner risk manager, and the work is forecasting more than reporting. At the sample bank, the bill-pay partner Plumline Pay had 848 unauthorized returns on 184,300 debits over 60 days, 0.46%, up from 0.21% on August 27. The same seat also follows corrections through: a notification of change is only finished when the originator stops using the old account number, and the treasury management implementation manager is often the one who has to tell a business client. What a bank's return rate monitoring has to show follows that seat into a Nacha inquiry. Whether an originator should be onboarded at all, and on what exposure limit, is a separate review covered by ACH Originator Risk Assessment.
The manager who signs what moves money late
The fourth seat is the ACH operations manager, who signs the exceptions to the routine: returns sent after their window by agreement, returns of suspected fraud under R17, dishonors of returns the bank received late or twice, and replies to Nacha. At the sample bank the manager's queue that morning held three R17 credits that looked fraudulent and Martin Ellery's $1,240.00 claim, which arrived after the network's 60-day window had closed on October 13 but inside Regulation E's 60 days from his August 31 statement.
That last case shows why the seat exists. The specialist cannot return the debit through the network any more; the bank still owes the customer under Regulation E. The decision to credit him, ask the originating bank to accept a late return or indemnify, and book the loss as pending recovery is a money decision, and it is the manager's.
Four seats at the sample bank: what each person's morning held, and what it holds now
Today
Works the core’s exception report top to bottom, typing a code per item, and spends half the morning working out which code a customer’s complaint really is.
With agents
Opens three trays ordered by deadline with each action proposed, approves the sure ones at once, and spends the morning on the 18 that need judgment.
Still theirs: Every in-window return and correction, approved or changed with a reason code.
Today
Signs the late ones and is the one Nacha writes to; the answer to an inquiry is assembled from email and exports.
With agents
Gets each late claim, code change and dishonor prepared and cited, with the deadline shown.
Still theirs: Late returns, R17s, dishonors, Nacha replies, and anything over $25,000.
Today
Sees a partner’s return rate a month after it went wrong, from a monthly report.
With agents
Sees every originator’s three rates against the lines each morning, with a forecast and the cause.
Still theirs: The co-signature on any control or restriction on a partner.
Today
Business clients hear about a notification of change from their employees, not from the bank.
With agents
Sees the clients who kept paying an old account after a correction, with a notice drafted.
Still theirs: The conversation with the client, and the client’s consent to automatic corrections.
What do examiners check in ACH returns?
Examiners check that returns are controlled, aged and reported to management, and that the people who handle them are not the people who post and reconcile them. The FFIEC's ACH examination procedures ask examiners to judge how well the investigation unit answers customer inquiries and controls returns, unposted items and differences, a test the payment investigator's job is built around, and to determine "whether exception reports (e.g., rejects, return items, and aging of open items) receive appropriate management attention" (FFIEC, Retail Payment Systems, Appendix A).
The next item is the one the four-seat model answers. Examiners "assess the adequacy of separation of duties throughout the ACH process including origination, data entry, adjustments, internal reconcilement, preparing general ledger entries, posting to customer accounts, investigations, and reconcilement with ACH operators." A process where one person codes a return, approves it and books the loss on a late one fails that test even if every code was right.
What an examiner will ask to see in the ACH return process
- An aging report of open return items and claims
FFIEC procedure 12 expects the investigation unit to report the age of every open item to management at regular intervals.
- Exception reports that reach management
Procedure 14: rejects, return items and aging "receive appropriate management attention", with evidence that someone read them.
- Separation of duties across the return path
Procedure 15: origination, adjustments, posting, investigations and reconcilement held apart.
- Separate accounts for holdovers, adjustments and returns
Procedure 11: "separate accounts to control holdovers, adjustments, return items, rejects, etc." and their periodic reconciliation.
- Return-rate monitoring on the ODFI side
The booklet: "An ODFI should monitor and research frequently the returns, particularly unauthorized returns."
- The annual Nacha Rules compliance audit
Nacha requires one every year; OCC guidance says the bank’s own audit "should also check for completion" of it, and that it is no substitute for a risk-based ACH audit.
The booklet also gives the reason any of this matters to the bank and not only to the examiner: a bank that breaks the Nacha rules takes on contractual liability and fines, which is why the rules bind like law without being a regulation. Each seat is a place where that exposure is either caught or created.
How the seats share one screen in ACH Returns & NOC Management
The solution keeps the seats separate by letting each role press only its own buttons, and joins them by giving everyone the same evidence. Seven agents read the overnight files before anyone signs in; at the sample bank the run took 22 minutes, from 06:40 to 07:02, and covered 668 returns and 264 notifications of change on entries the bank sent, the core's 286 posting exceptions and 1,114 originators' return rates.
ACH Returns & NOC Management’s morning run: what each agent read and handed to which seat
A button a role may not press says who may. The approver can never be the preparer: when the specialist prepares the late claim, the approval waits for the manager; when the threshold agent drafts a control on an originator, it needs the partner risk manager's co-signature and the manager's approval. Every override needs a reason code, and the agent's original proposal stays beside the decision, so an examiner can see where people disagreed with the machine and why.
One audit trail for all four seats, exportable by audience
The design target is that the morning's returns, claims and corrections are worked the same day, before the bank's 4:00 p.m. file. To see the trays, the agents and the governance together, start from ACH Returns & NOC Management.
Questions people ask
Who handles ACH returns at a bank?
An ACH operations team handles the RDFI side, usually specialists who code and send returns and a manager who signs exceptions. Customer claims often start in the contact center or a branch, where the customer signs the written statement of unauthorized debit. On the ODFI side, return rates are watched by ACH risk or, in banks with fintech partners, by a partner risk function.
Why would an ACH be returned?
Most returns are routine: insufficient funds, a closed account, or no account found, all of which must normally reach the originating bank within two banking days of settlement. A smaller share are unauthorized claims by the account holder, which a consumer can make for 60 days with a signed statement. A Federal Reserve study of 2006 FedACH data found insufficient funds behind about 70% of returned consumer debits.
What does an ACH operations specialist do?
The specialist works the morning's posting exceptions and customer claims, chooses the return reason code each one supports, sends returns in the right file before their deadline, and posts notifications of change. In most banks the specialist approves routine in-window returns and escalates late ones, suspected fraud and large items to a manager.
Who approves a late ACH return?
Bank policy decides, and most banks give it to the ACH operations manager because a late return needs the originating bank's agreement and may end in a loss. Under Nacha's 2021 rules an ODFI may agree to accept a return instead of providing proof of authorization, but it is not obliged to. What a missed return window costs sets out the three ways forward.
Can a third-party processor send returns for the bank?
Many banks use a processor to build and transmit return files, but the decision and the liability stay with the bank. On the Federal Reserve's FedLine Web return function, "only receiving depository financial institutions (RDFIs) are permitted to process these items" (Federal Reserve Financial Services).
How fast must a business account's unauthorized return go back?
Quickly: corporate debits do not get the consumer's 60 days. Nacha's risk group summarises it as "Corporate SEC codes allow for standard right of return (two days)," which is why a business customer's dispute has to reach the specialist the same day it is raised (Nacha RMAG, 2024).