ACH unauthorized return rate threshold: 0.5% is 16 times the norm

The ACH unauthorized return rate threshold is 0.5%: an originator's debits returned as unauthorized, under codes R05, R07, R10, R11, R29 and R51, must not exceed 0.5% of its debits over the preceding 60 days or two calendar months. The originating bank is responsible for monitoring it and, when an originator goes over, for bringing the rate back down under Nacha's enforcement process. What most summaries leave out is where the line sits: Nacha set it at "more than 16 times" the network's average unauthorized return rate of 0.03%, so it marks the outliers, not the boundary of normal. A rate well under the line can still be a warning. Botminds' ACH Returns & NOC Management measures every originator against the line each morning, forecasts where it is heading and finds the cause, so a bank sees the rise while there is still time to act.

Examples come from a fictional sample bank, Tessaly Community Bank, and its fictional originators, as measured by the solution on October 22, 2026. Rules and averages are from Nacha's public rule pages and Federal Reserve research.

“This revised threshold is still more than 16 times higher than the average Network return rate of 0.03 percent for unauthorized debit Entries for calendar year 2013.”

Nacha, ACH Network Risk and Enforcement Topics (effective September 18, 2015)

What is the Nacha unauthorized return rate threshold?

It is the maximum share of an originator's debit entries that may come back as unauthorized: 0.5%, measured over 60 days or two calendar months. Nacha's risk advisory group puts it in one line: "An Originator's Unauthorized Entries may not exceed 0.5% of its Originated Entries" (Nacha RMAG, 2024). It applies to originators and to third-party senders, to debits under any entry code, and not to credits returned as unauthorized.

The codes have widened since the threshold was set. In 2015 it covered R05, R07, R10, R29 and R51; from April 2020, when Nacha re-purposed R11 for debits that broke the terms of an authorization, R11 returns joined "the definition of Unauthorized Entry Return Rate" (Nacha, Differentiating Unauthorized Return Reasons). The calculation, both of Nacha's permitted methods and the codes in each rate, is worked through in the ACH return rate calculation guide.

When did the threshold change from 1% to 0.5%?

On September 18, 2015. Nacha's rule "will reduce the current return rate threshold for unauthorized debit Entries (Return Reason Codes R05, R07, R10, R29, and R51) from 1.0 percent to 0.5 percent" (Nacha, ACH Network Risk and Enforcement Topics). It left the investigation and enforcement process for the threshold as it was; an ODFI with an originator over the lower line faced "the same obligations and potential enforcement" as before.

Nacha's stated reason was that the line should still catch real problems: "unauthorized debit returns at 0.5 percent would still indicate problematic origination practices, and therefore would be a useful tool to enable Nacha to focus on outliers of poor quality origination activity." The same rule created two new lines, the administrative and overall return rate levels, which work differently and are covered in what return rate monitoring has to show.

What return rate is normal?

Far below the lines. The network averages Nacha published with the 2015 rule, for calendar year 2013, were 0.03% for unauthorized debit returns, 0.33% for administrative returns and 1.42% for all debit returns. Nacha set each line as a multiple of its average, and the multiples tell you how far into the tail the lines sit.

The unauthorized line is the loosest relative to its norm, which is the point of this guide. An originator at half the line, 0.25%, is still more than eight times the 2013 average. The 2013 averages are old, and we found no newer network average on Nacha's public rule pages; what the multiples show is the rule's intent, which was to find outliers, not to mark the edge of normal.

Why the average misleads

Because return rates are skewed: a minority of very high rates pulls the average up, so most participants sit well below it, and "below average" says less than it sounds. Researchers at the Federal Reserve Banks of New York and Minneapolis matched every consumer debit return in a 2006 FedACH sample to its original entry and found the mean overall return rate across more than 8,500 ODFIs was 1.8%, against a median of 0.7%, "with about 75 percent of ODFIs experiencing below-average return rates" (Armantier et al., Federal Reserve Bank of Minneapolis, 2010).

The authors drew the practical conclusion themselves: average return rates are a poor benchmark, and "the majority of returns was originated by a minority of ODFIs with well above-average return rates." Their tails were long: "More than 5 percent of ODFIs had overall return rates in excess of 6 percent." The same skew applies within an ODFI's own book of originators, which is why a bank that compares each originator with the bank-wide average, or with the line, misses the one that is quietly ten times its peers.

Threshold or level: one word decides what happens next

Nacha calls the 0.5% unauthorized line a threshold and the 3% and 15% lines levels, and the difference is not cosmetic. Crossing the threshold engages obligations the rules already place on the ODFI, with the enforcement process behind them. Crossing a level only opens the possibility of a preliminary inquiry, which may close with no action. A bank's monitoring should treat them differently: the threshold as a limit the originator must stay under, the levels as points at which the bank should be ready to explain.

Nacha also brought the network's money into it. Since October 2016 the originating bank pays the receiving bank an unauthorized entry fee for every debit returned as unauthorized, R11 included since April 2021 (Nacha, DFI Checklists). Each unauthorized return is a cost to the ODFI as well as a point on a rate, and Nacha's checklist expected ODFIs to change billing systems "to assess Unauthorized Entry Fee to customer, if desired."

What happens if an originator exceeds 0.5%?

Nacha identifies the originator from the ACH operators' return data, writes to the ODFI, and the ODFI must either show the rate is not over the line or commit to bringing it down. Nacha's own summary of the process for the threshold: "If the ODFI acknowledges that unauthorized return rate threshold is above 0.5%, it must include a plan for reducing the rate below 0.5% within 30 days," after which Nacha "monitors for an additional 180 days to ensure return rates remain reduced" (Nacha, Risk and Quality Rules summary sheet). An ODFI that does not respond, responds incompletely, or fails to reduce or hold the rate goes into Nacha's System of Fines.

Thirty days is short for anything but a decisive fix, because returns on debits already sent keep arriving for weeks. That is the practical case for acting before the letter. At the sample bank, the partner Kestrova Credit was already over, at 0.55% and falling, with Nacha's inquiry open: the cause, debits re-presented on charged-off loans after customers had revoked their authorizations, had been fixed on October 7, and the drafted reply planned to be under 0.5% by November 18 and to hold it for 180 days.

Is 0.3% a good unauthorized return rate?

Under the line, and ten times the 2013 network norm. Whether it is acceptable depends on the originator's business and, more, on its direction. A subscription merchant steady at 0.3% for two years is a known quantity; one that was at 0.1% last quarter is a problem developing. The OCC's guidance to banks is blunt about what rising unauthorized returns usually mean: "A high level of unauthorized returns is often indicative of fraudulent activity" (OCC Bulletin 2006-39).

The OCC also warns against watching only that one number: "Fraud analysts should not rely exclusively on excessive unauthorized returns to identify fraud. Unusually high levels of returns for other reasons (e.g., nonsufficient funds (NSF), invalid account, or account not found) may also be indicative of fraud for some originators." A healthy unauthorized rate beside a climbing administrative rate can mean accounts are being made up rather than taken over. The FFIEC adds the credit view: rising return volume at an originator should prompt a fresh look at its exposure limit (FFIEC, Retail Payment Systems; how to calculate ACH return rates quotes the procedure), the review covered by ACH Originator Risk Assessment.

The sample bank's partner Plumline Pay shows why trend beats level. It was at 0.21% on August 27, a rate many banks would have filed as fine. Eight weeks later it was 0.46%, with 848 unauthorized returns on 184,300 debits, and forecast to pass 0.5% within days.

An early warning below the line in ACH Returns & NOC Management

The useful line for a bank is its own, set well below Nacha's, and paired with a forecast and a search for the cause. At the sample bank the early warning is 0.40% unauthorized, with 2.4% administrative and 12.0% overall, and the threshold agent counts the returns still to come on debits already sent. When Plumline passed the warning, the agent broke its returns down by sign-up channel: one affiliate channel opened on September 14 carried 22,100 debits and 70% of the unauthorized returns, a 2.69% rate, while the rest of Plumline ran at 0.16%. Most were R10 on the first two debits after sign-up, with no login or device change, which pointed at weak authorization at sign-up rather than stolen accounts.

Where the returns come from: one channel, 70% of the unauthorized returns

The control the two signers approved held first debits from that channel for account validation and an authorization check, capped the channel at 1,500 new first debits a week, and asked for a weekly return report by channel, with a review on November 20. Its expected effect was a peak just under the line, because returns on debits already sent still arrive, then 0.38% by November 20. A restriction on a partner needs the ACH operations manager and the fintech partner risk manager, never an agent.

ACH Returns & NOC Management: every originator against the line, the forecast deciding

The full solution is at ACH Returns & NOC Management.

Questions people ask

What are the Nacha return rate thresholds?

Strictly, there is one threshold, 0.5% for unauthorized debit returns, and two levels, 3% for administrative returns (R02, R03, R04) and 15% for all debit returns except RCK. Exceeding a level is not automatically a rules violation; it allows Nacha to open a preliminary inquiry.

What is the average ACH return rate?

The most recent network averages we found on Nacha's public rule pages are for 2013: 0.03% unauthorized, 0.33% administrative and 1.42% overall for debits. A Federal Reserve study of 2006 FedACH data put the mean overall return rate on consumer debits at 1.8%, but the median ODFI at 0.7%.

Does the unauthorized threshold apply to third-party senders?

Yes. Nacha's rule applies the threshold to originators and to third-party senders, and the ODFI is responsible for monitoring both. Nacha's 2015 checklist also told ODFIs to review rates at the Company ID level, where an inquiry can start.

Is there a fine for exceeding 0.5%?

Not automatically. The ODFI must reduce the rate below 0.5% within 30 days and keep it there for 180 days; a case goes to Nacha's System of Fines only if the ODFI does not respond adequately, does not reduce the rate, or does not hold it. Nacha's industry review panel decides any fine.

Do unauthorized credit returns count toward the threshold?

No. Nacha's FAQ says the threshold "covers debits using any SEC Code" and "does not apply to credits returned as unauthorized." Fraud on credits is handled under Nacha's separate fraud-monitoring rules; see ACH credit monitoring by RDFIs.