ACH return rate monitoring is the originating bank's daily or periodic measurement of each originator's and third-party sender's debit return rates against Nacha's lines: 0.5% for unauthorized returns, 3% for administrative returns and 15% for all returns, over 60 days or two calendar months. Nacha expects every ODFI to have it in place and to decide for itself what counts as a red flag. It is hard to do well because Nacha sees the same returns through the ACH operators' data, so a bank that only reports monthly can learn about its own originator from Nacha's letter. When that letter comes, crossing an administrative or overall level starts a preliminary inquiry rather than a violation, and what decides the outcome is the evidence the bank already has. Botminds' ACH Returns & NOC Management measures every originator's three rates each morning, finds the cause when one rises, drafts the control and the reply, and keeps every figure tied to its source, so the file exists before anyone asks for it.
Examples come from a fictional sample bank, Tessaly Community Bank, and its fictional fintech partners, in October 2026. The inquiry process is described from Nacha's public rule pages and summary sheets.
“As an ODFI, you should determine how you monitor an Originator’s return rates, and the return rates or changes in return rates that constitute red flags.”
Nacha, ACH Network Risk and Enforcement Topics, FAQ
What does ACH return rate monitoring have to show?
It has to show, for each originator, third-party sender and Company ID, the three rates against their lines, how they are moving, why they moved, and what the bank did about it. Nacha's FAQ is explicit that the method and the red flags are the ODFI's to choose, and adds a practical instruction: "You should consider what you would present as facts and documentation related to the review criteria defined in the rule, should you ever be asked to do so by the industry review panel" (Nacha, ACH Network Risk and Enforcement Topics).
That turns monitoring from a report into a file. A monthly table of rates proves the bank can divide; it does not show that anyone noticed an originator moving from 0.2% to 0.46% in eight weeks, asked why, or changed anything. The FFIEC's examination procedures make the same point from the credit side: rising returns at an originator should send the bank back to its exposure limit (FFIEC, Retail Payment Systems; the procedure is quoted in how to calculate ACH return rates), which means the monitoring has to reach the people who own the relationship, not stop at operations.
The three lines an ODFI monitors, and what crossing each one starts
0.5%
unauthorized threshold: obligations to reduce, under Nacha’s enforcement process
3%
administrative level (R02, R03, R04): a possible preliminary inquiry
15%
overall level, all debit returns except RCK: a possible preliminary inquiry
What happens when an originator exceeds a return rate level?
Nacha may open a preliminary inquiry: it writes to the ODFI, the ODFI answers with its evidence, and Nacha either closes the case or sends it to an industry review panel, which may direct the ODFI to bring the rate down. The level itself is not a breach. Nacha's FAQ draws the line in one sentence:
“The most significant difference is that a return rate above a Return Rate Level will not be considered automatically as a violation of the Rules.”
Nacha, ACH Network Risk and Enforcement Topics, FAQ
Nacha's summary sheet lays out the inquiry for the administrative and overall levels as a sequence, from the operator's data to closure or fines. The ODFI acts at two points: when it answers Nacha's first letter, and, if the panel directs a reduction, when it has 30 days to comply.
The inquiry for an administrative or overall return rate level, step by step
| Step | Who acts | What happens |
|---|---|---|
| 1. Identification | Nacha | Finds an originator or third-party sender “potentially above administrative and/or overall return rate level through ACH Operator-provided return data.” |
| 2. Notice | Nacha | Tells the ODFI there is reason to believe a level has been exceeded. |
| 3. Answer | The ODFI | Admits or denies, with supplemental information. A denial Nacha validates closes the case; no answer, or an incomplete one, sends it to the System of Fines. |
| 4. Staff review | Nacha staff | If the ODFI acknowledges the level, decide on the evidence whether to forward the case to the panel; if not, it closes. |
| 5. Panel decision | Industry review panel | Decides whether to direct the ODFI to reduce the rate; if it declines, the case closes. |
| 6. Reduction | The ODFI | Has 30 days to comply with a directive; Nacha then monitors for 180 more days. Failing either sends the case to the System of Fines. |
The unauthorized threshold runs on a shorter path. An ODFI that acknowledges an originator is over 0.5% must include a plan to get below it within 30 days, with Nacha watching for 180 days after; there is no panel step deciding whether a reduction is needed. Why the unauthorized line sits at 16 times the norm covers that path and the arithmetic behind the line.
What is a Nacha inquiry, and how long does an ODFI have to answer?
A Nacha inquiry is Nacha's written request to an ODFI for the information behind an originator's return rate, and Nacha's 2015 implementation checklist told ODFIs to have procedures ready because the "response is required within 10 days" (Nacha, DFI Checklists, 2015). Ten days is not long to assemble two months of returns, a cause and a plan from email and exports, which is the argument for keeping them assembled.
For the levels it is called preliminary for a reason. "It is called 'preliminary' because it is a new step taken prior to the beginning of an enforcement action, if one is started at all. The outcome of a preliminary inquiry could be that a review is closed with no enforcement action." Nacha describes it as "an opportunity for the ODFI to present, and for Nacha to consider, specific facts related to the Originator's or Third-Party Sender's ACH origination practices and activity" (Nacha). The ODFI's answer is its case.
Nacha also set the levels so they would not sweep up whole industries. The rule "does not ban the use of the ACH Network by any industry," the levels "are not industry-based," and low volume is a defined factor, so that "low-volume Originators currently are, and would continue to be, largely excluded from being encompassed within these processes except for the most egregious cases." A high overall rate with a clear business reason, such as a lender whose customers often run short, is something to explain with evidence, not to hide.
Who is the industry review panel, and can Nacha fine a bank?
The panel is a group of practitioners, and yes, fines are possible, but only at the end of a process the ODFI has several chances to close. Nacha describes the panel as "composed of ACH experts from large and small financial institutions, Payments Associations, and the ACH Operators," meeting regularly to review risk and enforcement cases. On fines it is categorical: "Fines are a possible outcome only at the conclusion of an enforcement proceeding," and "in all cases, the industry review panel is the final authority in deciding and assessing fines for violations of the Nacha Rules" (Nacha).
Fines land on banks, not on originators directly. Nacha's risk advisory group puts it plainly: "Nacha assesses fines to FIs. FIs may contractually pass on fines to Originators" (Nacha RMAG, 2024). The ceiling is high for the worst cases. Since 2021, an egregious violation, willful or reckless and involving at least 500 entries or $500,000, can be treated as Class 3, and "the sanction for a Class 3 violation can be up to $500,000 per occurrence and a directive to the ODFI to suspend the Originator or Third-Party Sender" (Nacha, Reversals and Enforcement). Nacha may also report Class 3 violations to the ACH operators and industry regulators.
The review criteria, kept as a file
The panel's criteria are published, so the file an ODFI needs is knowable in advance. Nacha lists what the panel can consider in deciding whether to direct a reduction, and its 2015 checklist listed what ODFIs should document for an inquiry; together they are a specification for monitoring evidence.
What to keep for each originator near a line, before Nacha asks
- Total volume of forward and returned debits
The panel’s first factor; low volume is a defined consideration.
- The three rates, their trend and the returns behind them
Numbers, rates and reasons for returns, at Company ID and originator or third-party sender level.
- The unauthorized rate, even when the inquiry is about another level
The panel considers it in every case.
- Evidence of rules compliance, especially reinitiation
Including “evidence of compliance with reinitiation rules” and any rules violations or RDFI complaints.
- Legal or regulatory actions, and complaints
Any investigations, and “the number and materiality of consumer complaints,” including complaints alleging fraud, deception or abuse.
- The originator’s business and history
Length of time in business and as the ODFI’s customer, and the business case that drives its return rates.
- For a third-party sender, its Rules compliance audit
Whether its annual audit has been completed.
- What the bank did, and when
Notices to the originator, controls, holds or caps, and their measured effect. The panel may consider "any other relevant information submitted by the ODFI."
The last item is the one most banks cannot produce on demand, because actions live in email. A control signed in the system, with its date, its signers and its expected effect, is evidence; a recollection that someone spoke to the originator in September is not.
The action on file in ACH Returns & NOC Management: a control signed before the line
What should an ACH return report show the board?
The board should see return rates by originator, unauthorized returns over its own thresholds, and any Nacha notices, in trend, not just this month's snapshot. The OCC's guidance on ACH risk lists what such reports "generally include," and three of its lines are about returns.
Board reporting on ACH, as the OCC describes it, and what return monitoring supplies
| OCC: board reports generally include | What return rate monitoring supplies |
|---|---|
| Metrics and trend analyses on ACH volume, returns, operational losses and transaction types, with explanations for variances | Rates over time with the cause of each material change |
| A summary of return rates by originator, and, as applicable, third-party senders | Every originator’s three rates against the lines and the bank’s early warnings |
| Unauthorized returns that exceed board-established thresholds | Originators over the bank’s own unauthorized line, not only Nacha’s |
| Notices of potential and actual rules violations and fines by NACHA | Open inquiries, the replies sent and their status |
| Risk management reports comparing actual performance to approved risk parameters | Controls in force, their expected effect and their measured effect |
Note the third row: the OCC expects the board to set its own unauthorized threshold, which is how a bank's early warning gets its authority. At the sample bank it is 0.40%, with 2.4% administrative and 12.0% overall, against Nacha's 0.5%, 3% and 15%.
Finding the cause in the returns
A rate says that something is wrong; the cause is in how the returns break down. Cut the returns by Company ID, sales channel, entry description, return code and the age of the customer relationship, and the problem usually concentrates. At the sample bank's partner Plumline Pay, the unauthorized rate rose from 0.21% on August 27 to 0.46% on October 22. One affiliate sign-up channel, opened September 14, carried 22,100 of 184,300 debits but 70% of the unauthorized returns, a 2.69% rate; the rest of the partner ran at 0.16%. Most were R10 on the first two debits after sign-up, with no login or device change: weak authorization at sign-up, not account takeover.
The code mix is part of the cause. A rise in R10 points at authorization capture; a rise in R07 points at a cancellation process that does not stop debits; a rise in R11 points at billing errors. Administrative returns have their own story: R03 and R04 suggest bad data entry, while an RDFI that suspects fraud may return the same kind of debit as R17 "QUESTIONABLE," which Nacha excludes from the administrative rate and encourages ODFIs to track separately (Nacha, Return for Questionable Transaction). How to check that each return code was right matters here too, because the cause analysis is only as good as the codes the RDFIs chose.
Drafting the reply from the file in ACH Returns & NOC Management
When an inquiry does arrive, the reply should be assembled from the file, not written from memory. At the sample bank, Nacha's letter about the partner Kestrova Credit asked for the originator's information, the reason for its returns and a plan to bring the unauthorized rate under 0.5%. The threshold agent drafted the reply from the bank's own data: the cause, debits re-presented on charged-off loans after customers had revoked their authorizations; the fix, made on October 7; the rate, 0.55% on a rolling 60 days and falling, mostly R07; and the plan, under 0.5% by November 18 and held for 180 days, with every figure linked to the returns and originations behind it. The fintech partner risk manager reviewed it; the ACH operations manager signs and sends it. The agent cannot send anything to Nacha.
Every figure in the reply, traceable on the same trail
The same file serves the examiner and the annual Rules compliance audit, and exports by audience. Questions about whether an originator should have been onboarded, or on what exposure limit, belong to ACH Originator Risk Assessment; this solution's job is the returns and what they say. It is at ACH Returns & NOC Management.
Questions people ask
How do banks monitor ACH return rates?
Most calculate each originator's unauthorized, administrative and overall rates from their own return and origination data, by Company ID, against Nacha's lines and their own lower warnings. Nacha leaves the method to the ODFI but expects monitoring to be in place; in our view the stronger programs measure daily, forecast the returns still to come and record what they did about each rise.
How does Nacha know an originator's return rate?
From the ACH operators. Nacha's summary sheet describes identifying originators and third-party senders from return data the operators provide, which is why a bank should not rely on a monthly report to find its outliers first.
Can Nacha fine a bank for an originator's return rate?
Only at the end of an enforcement proceeding, and the industry review panel decides. Exceeding a level starts a preliminary inquiry; exceeding the unauthorized threshold requires a plan to reduce the rate within 30 days. Fines follow if the ODFI does not respond, does not reduce the rate, or does not hold it for 180 days.
What must an ODFI do to bring a return rate down?
Find the cause and change the origination practice behind it: authorization capture, cancellation handling, account validation, reinitiation, or the channel the debits come from. Nacha's checklist asked ODFIs to "document actions taken to address unauthorized return rates above the threshold," and the 30-day and 180-day clocks make a fix that works on future debits the only kind that counts.
Do returns of fraud-flagged entries count against the originator?
R17 "QUESTIONABLE" returns are excluded from the administrative rate but count among all debit returns. Nacha encourages ODFIs to track them separately and contact originators when they cross a level the ODFI sets. Monitoring credits for fraud under Nacha's 2026 rules is separate work: ACH credit monitoring by RDFIs.