Recall and hold harmless letter: the indemnity behind a wire recall

A recall and hold harmless letter is the indemnity a sending bank gives the bank holding a recalled payment: a written promise to cover that bank's losses and costs if it returns the money. It exists because of the law. Under UCC 4A-211(f), when a bank that has accepted a payment order agrees to cancel it, the sender is liable for the bank's losses and expenses, including reasonable attorney's fees, whether or not the cancellation turns out to be effective. The beneficiary's bank is about to take money out of its own customer's account on the sending bank's word, so it wants that liability confirmed in writing, signed, before it returns anything. On the FedNow Service the same liability attaches to a request for return unless the message disclaims it. The FBI's own advice to fraud victims is to ask their bank for a recall "along with any necessary indemnification documents".

This page sets out what the letter covers, who stands behind whom in a chain of banks, when an indemnity can be disclaimed, and how to sign and track them. The worked example is from Wire & Instant Payment Recall, Botminds' software for recalling fraudulent wires and instant payments, in which agents draft return instructions and indemnities and named people approve and sign them; the bank and its counterparties are fictional sample data. This is an operations guide, not legal advice; the indemnity template itself belongs to the bank's counsel.

What is a hold harmless letter for a wire recall?

It is the sending bank's written promise to the bank that returns the money: if returning it costs that bank anything, the sending bank will make it whole. Banks call it a hold harmless letter or an indemnity; the substance is the same. It usually travels with the return instructions after the beneficiary's bank has frozen the funds and said what it will return. Policies differ: a bank may ask for it before it will freeze, or, as in the sample, freeze first and return on receipt of the signed letter.

In the sample, the beneficiary's bank answered at 3:05 PM that it had frozen $142,000.00 and would return it on receipt of a signed indemnity from the sending bank. The sample bank's directory already noted that this bank always wants a signed indemnity before any return, and that another counterparty always asks for the indemnity on its own form. Knowing that in advance is the difference between having the letter ready and drafting it while the money waits.

The beneficiary’s bank answers: frozen, and returned on a signed indemnity

Why the beneficiary's bank asks for one

Because returning the money creates a risk for it, and the recall gives it nothing in return. The funds sit in its own customer's account. If it agrees to cancel, Article 4A lets it recover what it paid out to that customer only as far as the general law on mistaken payments allows, and its customer may object: the account holder may claim the money was rightfully paid, or the account may belong to a recruited money mule who also feels wronged. The beneficiary's bank also has to be satisfied that the request is genuine; a forged recall request would be one more way to steal.

The letter moves those risks back to the party that asked. It does not make the recall lawful on its own: under 4A-211(c)(2), the beneficiary's bank can cancel an order it has accepted only if the order was unauthorized or resulted from a sender's mistake such as paying someone not entitled to the money. The legal line is drawn in what a wire recall is. The letter answers the commercial question that comes after: who pays if returning the money goes wrong.

Does the sending bank have to indemnify?

Article 4A already makes it liable, so the letter mostly confirms what the law provides. The rule in UCC 4A-211(f) applies, unless an agreement or a funds-transfer system rule says otherwise, whenever a receiving bank agrees to cancel after accepting an order: "the sender, whether or not cancellation or amendment is effective, is liable to the bank for any loss and expenses, including reasonable attorney's fees, incurred by the bank as a result of the cancellation or amendment or attempted cancellation or amendment."

Two features of that rule shape the letter. The liability attaches even if the cancellation fails, so a bank that tries and loses can still owe costs. And it runs from each sender to the bank it sent to, which in a chain means the customer to its bank, the sending bank to the intermediary, and the intermediary to the beneficiary's bank. A beneficiary's bank that wants a promise from the bank that actually asked, rather than from an intermediary that only passed the request on, has reason to ask for a letter directly; that is our reading of why the practice exists, not a rule.

Can the indemnity be disclaimed?

On FedNow, yes, in the message itself. Operating Circular 8, which governs the service, makes a participant that sends a return request liable to indemnify under 4A-211 "unless the FedNow Participant disclaims its indemnity obligation in the Message as specified in the FedNow Service’s technical specifications." A bank sending an instant payment return request therefore has a decision to make on every request: give the indemnity, or disclaim it.

For wires, 4A-211(f) itself allows the parties to agree otherwise, or a funds-transfer system rule to provide otherwise, but there is no message-level switch in the Fedwire guidance we cite. In practice, the question on a wire is the reverse: not whether to disclaim, but whether to give a written indemnity on the beneficiary's bank's terms, its own form, or the sending bank's template. Either way the decision should be a rule written in advance, not a judgment made at 5:00 PM.

What losses does an indemnity cover?

Under the statute, the receiving bank's loss and expenses, including reasonable attorney's fees, caused by the cancellation or the attempt. In practice the loss that matters is the one the beneficiary's bank cannot recover from its own customer: money it returned to the sender that its customer then claims, successfully, was rightfully theirs. The expenses are the cost of dealing with that customer and any dispute. A letter that goes further than 4A-211(f), for example covering claims unrelated to the return, is a negotiation, and the bank's counsel should decide whether to accept another bank's form.

What the indemnity does not do is guarantee the customer's money comes back. It covers the bank that returns the funds, not the sender. In the sample, the indemnity covered the $142,000 that was frozen; the $44,000 that had already left was pursued separately, through a request that the beneficiary's bank recall its own onward wire and through the fraud case.

Who can sign an indemnity?

Only someone the bank has authorized in writing, at an amount the bank has set, and never the same person who prepared or approved the return instructions it accompanies. The letter commits the bank to an open-ended liability, so it belongs with the bank's other signing authorities, not with whoever is on the desk. In the sample bank's settings, a wire operations supervisor approves every indemnity and the SVP of payment operations signs any above $100,000; nobody signs an indemnity they prepared or approved.

The weak point in most desks is not the rule but the hour. A signer who is in a meeting, or at home at 7:00 PM, holds the money at the other bank as surely as a missing request would. An on-call signer, with the template and the limit, belongs on the same after-hours list as the other banks' fraud lines; the rest of that list is in the contact sheet and message map.

Return instructions with a maker, a checker and a signed indemnity

Is an indemnity required for every recall?

No. Article 4A creates the liability whether or not anyone signs a letter, and a beneficiary's bank may return funds without asking for one, especially when its own customer's account is plainly fraudulent. On FedNow, a sender can disclaim it in the message. What is required is that the bank decide in advance when it gives an indemnity, on whose form, up to what amount and with whose signature, so that no recall waits on the question.

The receiving side asks the same question in reverse. When another bank asks the sample bank to return $64,250.00 credited to a customer that looks like a money mule, the sample bank's answer is to hold the balance and return it on receipt of an indemnity. A bank that both sends and receives recalls should use the same rules in both directions, and the inbound side is covered in instant payments recall vs return.

The customer's side: indemnifying your own bank

The customer who sent the wire is a sender too. Under 4A-211(f) it is liable to its own bank for losses and expenses if that bank agrees to cancel, and banks may ask a business customer for its own indemnity before recalling a payment on its behalf. The FBI's advice to fraud victims assumes as much.

"Immediately, contact your financial institution and request a recall of the funds along with any necessary indemnification documents. Different financial institutions have varying policies; it is important to know what assistance your financial institution will provide when attempting to recover funds."

FBI Internet Crime Complaint Center, 2025 Internet Crime Report

For a treasury customer, the practical advice is to know the bank's form before it is needed, and to have someone with authority to sign it reachable the same afternoon. For the bank, the customer's indemnity and its own letter to the beneficiary's bank should be drafted from the same facts, so the promises line up.

The indemnity register: what to keep

A bank that gives indemnities on every fraud recall is accumulating contingent liabilities, and someone should be able to list them. The minimum is a register of each letter: the counterparty, the payment, the amount returned, the template and version, the signer and the date, and whether any claim has been made under it. In the sample, every signature is an event in an audit trail that nobody, including administrators, can edit, kept for five years under the bank's records setting, and an export for examiners or internal audit is built from it. Whatever the tool, the register should answer two questions in a minute: what has this bank promised, and to whom.

Questions people ask

Is a hold harmless letter the same as an indemnity?

In a wire recall, yes in substance: both are the sending bank's promise to cover the returning bank's losses and costs. Banks use the names interchangeably; what matters is the wording, which should cover the losses and expenses UCC 4A-211(f) describes and be signed by someone with authority.

Does signing the indemnity guarantee the money comes back?

No. It covers the bank that returns the funds, and it only matters for money that bank still holds. Funds that left the account before the recall arrived need a separate request to the next bank, or law enforcement.

Who pays if the beneficiary sues the bank that returned the funds?

The bank that returned them can look to the sender for its losses and expenses, including reasonable attorney's fees, under 4A-211(f) and any letter it was given. That is precisely the risk the indemnity exists to move.

Does a receiving bank ever ask the sender for an indemnity before freezing?

Some may; policies differ, as the FBI notes. In the sample, the beneficiary's bank froze first and made the return conditional on the signed letter, which is why the sending bank's directory records each counterparty's practice.

How long does a recall indemnity last?

As long as its wording says. Article 4A sets no period for the liability in 4A-211(f), so the term, if any, is a matter for the letter and the bank's counsel, and the register should record it.