The ACH written statement of unauthorized debit (WSUD) is the statement a consumer signs, on paper, electronically or by phone, saying that a debit to their account was not authorized, was made after they revoked the authorization, or did not follow its terms. The receiving bank must have it before it returns a consumer debit in the extended 60-day timeframe, under codes such as R10, R11 and R07, and it must give the originating bank a copy on request. It matters because it is the only evidence the return stands on: a statement missing an element, signed too early or ticked in the wrong box can leave the bank holding a debit it credited back. Botminds' ACH Returns & NOC Management has a statement reader that notes the box ticked, the date signed and the entries named, and says which return code the statement supports. This guide walks the statement element by element.
The worked statement belongs to a fictional customer of a fictional sample bank, Tessaly Community Bank, in October 2026. Rule text is from Nacha's public rule pages and requests for comment, linked where it appears.
The statement has changed three times in five years
2020
R11 created for debits not in accordance with the authorization, needing the same signed statement as R10
2021
Nacha made explicit that a statement may be taken electronically or orally, and signed electronically
2024
it may be signed when the debit is presented, before it posts; the return must follow within six banking days of review
What is a written statement of unauthorized debit?
A written statement of unauthorized debit is the consumer's signed declaration, required by the Nacha Operating Rules, that identifies a debit and states why it should be returned as unauthorized. Nacha's rules organise the grounds in one section: the debit was unauthorized or "authorization revoked," returned as R10 or R07; or the debit was "not in accordance with the terms of the authorization," returned as R11 (Nacha, Differentiating Unauthorized Return Reasons). The same statement also supports a few narrower returns, such as R37 for a converted check whose paper original was also paid.
It is not a complaint form. A customer's call, a chat transcript or a branch note can start a claim, but only the statement lets the bank use the extended return. Two parties rely on it: the receiving bank, which returns the debit on its strength, and the originating bank, which may ask for a copy to decide whether to dispute the return. That is why its contents are fixed, not left to each bank's form designer.
When is a WSUD required?
A WSUD is required whenever the receiving bank returns a consumer's debit as unauthorized in the extended timeframe, which runs to the opening of business on the banking day after the 60th calendar day from settlement. Nacha's FAQ on that deadline adds, flatly, "A Written Statement of Unauthorized Debit is required for these returns" (Nacha, Limitation on Warranty Claims). It applies to R10, R11 and R07, and to two specific cases Nacha has steered into the same path.
The first is the improperly reinitiated debit, an originator re-sending a returned debit outside the rules. Because such debits "are likely to be identified via a customer complaint after the expiration of the normal two-day return timeframe," Nacha lets the RDFI use R10, and "in order to use R10 and the extended return timeframe, the RDFI needs to obtain a Written Statement of Unauthorized Debit" (Nacha, ACH Network Risk and Enforcement Topics). The second is the improper reversal to a consumer account, which goes back as R11 and needs the consumer's statement "prior to transmitting the extended return" (Nacha, Reversals and Enforcement).
The elements a WSUD must carry
The statement must carry, for each debit, enough to identify the debit, the customer and the reason, and two assertions by the customer. Nacha published the rule's minimum contents when it proposed the 2024 timing change; the list below follows that text.
What every written statement of unauthorized debit must contain, for each debit
- The customer’s printed name and signature
Signed “or similarly authenticated” by the account holder, the Receiver in Nacha’s terms.
- The customer’s account number
The account the debit was posted to, or presented against.
- Who debited the account
The payee as shown to the customer, and if different, the name of the intended third-party payee.
- The date
The date the debit was posted, or, if it was not posted, its effective entry date.
- The dollar amount
For each debit claimed.
- The reason for return
The ground the customer asserts, which is what decides between R10, R07 and R11.
- The customer’s assertion that the statement is true and correct
In the customer’s own declaration, not the bank’s.
- The customer’s assertion of authority on the account
That they are an authorized signer or have authority to act on the account.
- The signature date
Which must fall on or after the date the debit was presented to the account.
Two of these do most of the work in practice. The payee line has to name the originator the way the customer saw it, which is often a descriptor on a statement rather than a legal name, and, where a third party collected for someone else, the intended payee too. The reason line is where a generic form fails: a single box reading "unauthorized" cannot tell the originating bank whether the customer never authorized the debit, revoked it, or authorized something different.
Can a WSUD be signed electronically or taken by phone?
Yes, on both counts. Nacha's 2021 rule made explicit that "an RDFI may obtain a consumer's Written Statement of Unauthorized Debit (WSUD) electronically or orally," that "the same formats/methods permissible for obtaining a consumer debit authorization are permissible for obtaining a consumer's statement of unauthorized debit," and that a consumer may sign with an electronic signature (Nacha, Meaningful Modernization). Nacha was candid about why it needed saying: "anecdotal evidence suggests that the significant majority of WSUDs are still obtained by paper/wet signature."
The form changes; the contents and the duty to produce them do not. "An RDFI that obtains WSUDs electronically (including orally) must retain the electronic records in a form that accurately reflects the information in the record and that can be accurately reproduced. The RDFI must provide copies to the ODFI upon request." An oral statement taken on a call therefore needs a recording or an equivalent that can be played back and copied, with every element on it, including the customer's assertions. Nacha does not require banks to offer electronic statements; it encourages them "as a customer service and to improve process efficiency."
When must the WSUD be signed and dated?
On or after the date the debit was presented to the customer's account, which since October 2024 can be before it posts. Before then, the statement had to be dated on or after the debit's settlement date.
“This rule will allow a WSUD to be signed and dated by the Receiver on or after the date on which the Entry is presented to the Receiver (either by posting to the account or by notice of a pending transaction), even if the debit has not yet been posted to the account.”
Nacha, Risk Management Topics, effective October 1, 2024
The change follows how customers now find unauthorized debits: through alerts on pending transactions. Nacha's reasoning was that "allowing such a debit to post after being reported may cause harm to the Receiver." For operations it means two dates to check on every statement, the signature date against the presentment date of each debit listed, and a statement dated before any one of them does not support that debit. The same package added the other end: once the bank has completed its review of the signed statement, the extended return must follow promptly, by the opening of the sixth banking day after the review. The ACH return time frame, clock by clock sets that rule beside the others.
The words that choose the code: R07, R10 or R11
The reason the customer gives on the statement, not the claim form or the agent's notes, decides the return code. A statement that offers the three grounds as separate choices lets the customer say which one is true; a statement with one box called "unauthorized" leaves the code to whoever reads the claim. The table maps each ground to its code and to what the originating bank can do next.
Statement ground, return code, and what follows for the originator
| The customer states | Return code | What the originator may do next |
|---|---|---|
| I do not know this company, or I never authorized it to debit my account | R10 | Stop: a new debit needs a new authorization |
| I authorized it, then revoked the authorization before this debit | R07 | Stop debiting on the revoked authority; the revocation date matters |
| I authorized it, but this debit was the wrong amount, too early, part of an incomplete transaction or improperly re-sent | R11 | Correct the error and send a new entry within 60 days of the return’s settlement, without a new authorization |
| My dispute is about the goods or services | — (not an ACH return) | A matter between the customer and the merchant; neither R10 nor R11 covers it |
Revocation has a second source in federal law. Regulation E lets a consumer stop a preauthorized transfer by telling the bank, by phone or in writing, three or more business days before it is due (12 CFR 1005.10(c); how a stop payment differs from fraud screening is in ACH fraud filters versus fraud monitoring), and preauthorized debits "may be authorized only by a writing signed or similarly authenticated by the consumer." A statement that shows when and how the customer revoked, and attaches the proof, is what makes an R07 defensible when the originator asks.
At the sample bank, Dana Whitcombe disputed two $189.00 WEB debits from VANTORRA CLUBS. The contact-center note and the claim form said R10. The statement reader opened her signed statement and found the box she ticked: "I revoked the authorization I gave to the originator on Aug 3, 2026, before these debits were initiated," with her cancellation email attached. It proposed R07 for $378.00, checked that she signed on October 21, on or after both presentment dates, and set the claim form's R10 aside.
The statement, opened beside the proposal in ACH Returns & NOC Management
Should the RDFI review a WSUD before returning?
Nacha's rules do not require a review, and banks differ widely; Nacha has begun to describe what the careful ones look at. "Although the Nacha Rules do not articulate and enumerate any requirements for the review of a Written Statements of Unauthorized Debit (WSUD) by an RDFI," Nacha wrote in July 2026, "some RDFIs report that the factors discussed below can help determine the credibility of a customer's claim of unauthorized" (Nacha, How Some RDFIs Review Customer WSUDs for First-Party Fraud). The same piece notes that some banks decline to return a debit when the review finds the claim not credible, while "other RDFIs do little or no review of claims and submit a return based only on the receipt of the customer's signed WSUD."
The factors some RDFIs weigh before returning on a WSUD
| Factor | What it can show |
|---|---|
| Dollar amount | Thresholds or tiers, with more scrutiny as the claim grows |
| Name match | Whether the name in the entry matches a name on the account; a mismatch can corroborate the claim |
| Account validation | Whether a prenote, micro-entry or open-banking call validated the account before the debit |
| History with the same originator | Earlier undisputed payments, or a credit from the same originator to the same account |
| Negative balance | Whether the debit overdrew the account, which can give a customer reason to dispute it |
| Age and pattern of the account | New accounts used quickly, or activity unlike a typical consumer’s |
| Type of transaction | Entry description, company name and code, for example a debit following a loan credit |
| History of claims | Repeated disputes across cards, checks and ACH |
A review does not suspend the customer's rights. Regulation E's error-resolution clock runs from the customer's notice, and a bank that decides a claim is not credible still has to complete and report its investigation. What the review changes is which claims go back through the network and with what code. Nacha also points to a faster source of evidence: an RDFI may ask the ODFI for proof of authorization, which "must either provide such proof within 10 banking days or give permission to return."
What the ODFI may ask for, and why the statement must be reproducible
The originating bank may ask the receiving bank for a copy of the statement behind any extended return, and the receiving bank must provide it. The Federal Reserve's Exception Resolution Service has a case type for exactly this, the WSUD copy request, "used by the originating depository financial institution (ODFI) to request the written statement of unauthorized debit from the receiving depository financial institution (RDFI)" (Federal Reserve Financial Services). If the responder does not answer within 10 business days, that service closes the case; the RDFI's obligation under the Nacha Rules does not close with it.
The copy is how an originator checks a return it doubts, and what it reads is the statement as signed: the box, the date, the entries. How long the RDFI must keep each statement is set in the licensed Nacha Operating Rules; a bank's own retention policy should cover at least that period and its examiners' expectations. At the sample bank, every statement the statement reader relied on stays attached to the return it supported, on the same audit trail as the approval.
Thirty-four statements read by ACH Returns & NOC Management before anyone signed in
Questions people ask
What is a WSUD form?
It is the bank's form for the written statement of unauthorized debit, on paper, in online banking or as a scripted call. Nacha does not prescribe the layout, only the minimum contents: name and signature, account number, payee, date, amount, reason, the customer's assertions and the signature date.
Does a WSUD have to be signed?
Yes, signed "or similarly authenticated" by the account holder. An electronic signature is acceptable, and since 2021 Nacha has said a statement may be taken orally, provided the bank can reproduce it accurately and give the ODFI a copy.
Can one WSUD cover several debits?
Yes, for debits from a single originator. Nacha's rule text allows more than one unauthorized debit from one originator on a statement, "provided that all of the information detailed above is provided for each debit Entry for which the Receiver is seeking recredit."
Can the bank complete the statement for the customer?
The bank can help the customer fill it in, but the statement and its assertions must be the customer's, signed or authenticated by them. In ACH Returns & NOC Management the statement reader never signs or completes a statement for a customer, and never returns a 60-day claim without one.
What if the customer revoked authorization but the originator kept debiting?
The statement should say so, with the revocation date, and the return goes back as R07, authorization revoked. Proof such as a cancellation email or letter strengthens it if the originator asks for a copy, and a pattern of R07 returns tells the originator's bank that its customer's cancellation process is not working.