Exposure Window Modeling
Quantifying value-at-risk between when funds become usable and when they become final, by rail, so instant availability can be priced, limited and stress-tested like unsecured credit.
Core components
Three clocks: availability, settlement, finality
| Clock | Meaning | Who sets it |
|---|---|---|
| Availability | The customer can use the value: withdraw, trade, send, redeem | You (a non-bank), or Reg CC maximums plus your policy (a bank) |
| Settlement | Interbank funds have moved | The rail |
| Finality | The value can no longer be clawed back through the rail's return or dispute process | Rail rules, network rules, contract law |
Exposure runs from availability to finality, not to settlement. An ACH debit that settled yesterday can still come back as unauthorized for weeks. A collecting bank's right to charge back provisional credit for a check lasts until settlement for the item becomes final (UCC 4-214), and Reg CC says nothing about finality at all: it only caps how long a bank may wait before making funds available (Regulation CC and Funds Availability).
Two consequences follow:
- The amount at risk is the value that left the platform. A $2,000 instant deposit that stays in the account and is debited back on return costs you nothing but operations. The same deposit pushed out by instant payment to a new destination is a $2,000 unsecured loan.
- The term is the reversal window of the funding rail, and it's set by the slowest legitimate way the money can come back.
Reversal windows by rail
| Funding rail | Main ways value comes back | Window that defines the tail | Notes |
|---|---|---|---|
| ACH debit you originate (bank-link funding) | Returns for NSF, closed or invalid accounts; consumer unauthorized returns | Most returns: 2 banking days. Consumer unauthorized codes (R05, R07, R10, R11): 60 calendar days. | The 60-day tail is where account-takeover and first-party "I didn't authorize that" losses sit. ODFI-requested returns (R06) can come later by agreement. See Nacha Rules and ACH Risk. |
| Check / mobile deposit (RDC) | Returned unpaid; altered, forged or counterfeit claims; duplicate presentment | Normal returns arrive within days. Warranty and duplicate-deposit claims can surface much later. | Bank availability maximums are next day to roughly the second business day, with exceptions adding up to 5–6 business days. Finality comes later than any of these. |
| Card funding (debit or credit) | Chargebacks | Generally 120 calendar days from the transaction processing date; up to 540 days in some cases | Fraud disputes on card-funded balances are the long-tail rail. See Card Network Dispute Rules. |
| Incoming wire, RTP, FedNow | Sender-bank recall requests, which are voluntary | Short and rare | Low reversal risk, high inbound Money Mules risk. The question is how fast you let it leave again. |
| Incoming ACH credit | Reversals, ODFI-requested returns, RDFI fraud returns | Usually short | False-pretenses and payroll-redirect credits can be recalled |
| Marketplace sale proceeds | Buyer claims, chargebacks on the buyer's card | Claim window plus card dispute window | Reserves and payout delays are the hold. See Seller Onboarding and Reserves. |
| Cashback and rewards | Merchant or affiliate reversals, returns, receipt audit findings | Program-defined, until the merchant confirms | You set this window yourself through vesting. See Reward Vesting and Clawback. |
| Securities positions bought with unsettled funds | Deposit return forces liquidation | Funding rail's window, plus market moves | U.S. equities have settled T+1 since May 28, 2024; that's trade settlement and says nothing about funding finality |
The core model
For a cohort of deposits (a day, a segment, a tier), expected loss is the standard credit decomposition:
Expected loss = Σ (exposure at reversal × probability of reversal × loss given reversal)
| Term | Definition for funding fraud | What drives it | Lever |
|---|---|---|---|
| Exposure at reversal (EAR) | Value made available and extracted through an irreversible exit before finality | Limit size; what instant funds may be used for; exit velocity | Tiered limits; restrict instant funds to in-platform uses; exit controls (Withdrawal and Payout Controls) |
| Probability of reversal (PR) | Probability the funding comes back within the window, given extraction | Source quality, customer tenure, link method, account changes, linkage to bad actors | Bank Account Ownership Verification, Funding Source Signals, Customer Tenure and History, Entity Link Analysis |
| Loss given reversal (LGR) | 1 − recovery rate | Other balances, positions you can liquidate, debit authority, collections | Contract terms; cross-account set-off; closed-loop withdrawals (back to the funding source) |
| Market term (brokerage) | Adverse price movement on positions bought with unsettled funds | Volatility and liquidity of what was bought | Haircuts; no leverage or options on unsettled funds |
Estimate PR conditional on extraction. Good customers rarely use all of an instant limit and rarely push it out immediately. Fraud uses all of it, immediately, to an irreversible destination. If you estimate reversal probability on all deposits, you underestimate it on the deposits that matter. This adverse selection is the most common modeling error in instant funding.
Exposure-days. For capital and funding cost, also track exposure × days outstanding. A $1M exposure that resolves in 2 days and one that sits for 60 days have very different carrying costs and tail risk.
Pricing instant availability as unsecured credit
Instant availability is worth offering where its benefit per dollar exceeds its cost per dollar:
Benefit (conversion, activation, engagement, revenue) > PR × LGR + cost of funds × days at risk + operating cost of returns and collections
Treat it like a credit product:
- Underwrite at the deposit as well as at onboarding (see Real-Time Transaction Risk Scoring).
- Assign limits by tier and season them on demonstrated good behavior, resetting on any return or high-risk account change.
- Name an owner who is accountable for the loss line, the way a credit risk owner is accountable for charge-offs.
- Re-price after regime changes: a rule change (Nacha, Reg CC), a new attack, or a product change that adds a faster exit.
Exposure limits at four levels
| Level | Limit | Catches |
|---|---|---|
| Deposit | Max instant amount per item | Single large bad items |
| Account | Max concurrent uncleared exposure | Repeated deposits stacking up before any returns |
| Entity | Max concurrent exposure across a household, device cluster or linked identity | One controller running many accounts, each under its own limit (see Entity Resolution) |
| Portfolio | Max new-customer instant exposure per day, per segment, per source bank | Coordinated attacks and logic exploits that scale faster than detection |
Most programs lack the portfolio cap, and it's the limit that bounds the loss from a ring attack (see the stress test below). Pair it with automated fallbacks: when the daily budget is exhausted, new deposits drop to standard availability rather than continuing to accrue exposure (see Kill Switches and Circuit Breakers and Velocity and Exposure Limits).
Worked example (illustrative numbers)
The same arithmetic works for other rails:
- Cashback app paying "pending" rewards early. $500,000 a month paid out before merchant confirmation, with 6% reversed by returns and cancellations and 1% by fraud findings, and 40% recovered from future earnings: expected loss = $500,000 × 0.07 × 0.60 = $21,000 a month. That gives you a concrete number to weigh against the engagement value of instant cash-out (see Cashback, Coupons and Rewards).
- Brokerage instant buying power. Add the market term: if a returned deposit forces liquidation of a volatile position, loss is the deficit after liquidation. That's why restricting what instant funds can buy (no options, no thinly traded securities) cuts tail loss, in addition to restricting withdrawal (see Brokerage and Investing and Case Study - Robinhood Infinite Leverage Glitch (2019)).
- Marketplace seller payouts. Exposure is payouts sent before buyer claim and chargeback windows close. The lever is reserve size and payout delay by seller tier.
How to build it
| Stage | What it looks like | Prerequisites |
|---|---|---|
| 1. Static | One hold policy per rail; losses reported in aggregate | Ledger separates available and uncleared balances |
| 2. Measured | Loss on uncleared funds reported by rail and segment; return codes joined to originating deposits | Deposit-to-return linkage in Fraud Data Architecture |
| 3. Curved | Empirical return-timing curves by rail, code and segment; limits released along the curve | 6–12 months of matured outcomes (Fraud Labeling and Feedback Loops) |
| 4. Priced | EL model per deposit drives tiered availability; benefit measured by experiment | Scoring at deposit; holdouts |
| 5. Stressed | Entity and portfolio caps; attack scenarios run monthly; automated fallbacks | Entity Resolution, circuit breakers, tabletop exercises (Fraud Tabletop Exercises) |
Ownership: fraud strategy owns the model, data science builds the curves, finance agrees the loss budget and cost of funds, and product owns the benefit side. One person signs off on the trade, as in Fraud Risk Assessment.
Artifacts and templates
Rail parameter sheet (one per funding rail)
| Field | Example entry |
|---|---|
| Rail and product | ACH debit, bank-link deposit, consumer |
| Availability policy | Tiered instant up to limit; remainder at settlement |
| Settlement | Per ACH schedule |
| Finality definition | 60 calendar days after settlement for consumer unauthorized returns |
| Return-timing curve | Share of eventual returns by day 1/2/5/10/30/60, by code group |
| Exit restrictions on uncleared funds | No external withdrawal, P2P, crypto or gift cards |
| Recovery options | Set-off, debit authority, collections |
| Limits | Deposit / account / entity / portfolio |
| Owner and review date | Fraud strategy; quarterly |
Daily exposure report
- Uncleared exposure outstanding, by rail, tier and age bucket
- Of which extracted through irreversible exits
- New-customer instant exposure vs daily portfolio cap
- Largest entity-level exposures
- Returns received today, by code, against the expected curve
- Stress scenario: loss if every account opened in the last N days defaulted
Metrics
| Metric | Definition | Watch for |
|---|---|---|
| Uncleared exposure | Value available but not final, peak and average | Growth faster than deposits |
| Extracted exposure | Uncleared value that left through irreversible exits | The number that actually loses money |
| Loss on uncleared funds (bps) | Losses on reversed, extracted deposits ÷ instant availability granted | By tier and cohort as well as in aggregate |
| EL forecast vs actual | Model expected loss vs matured loss per cohort | Persistent under-forecast means adverse selection or a new attack |
| Return-curve drift | Change in the timing curve by code | Later returns mean your releases are too early |
| Recovery rate | Recovered ÷ reversed extracted value | Collections and set-off effectiveness |
| Stress exposure | Modeled loss under the standard attack scenario | Whether caps are sized to detection speed |
| Benefit per dollar | Measured conversion or revenue lift from instant availability | Without this, you can't price the loss |
Report loss on uncleared funds alongside the program's main loss metrics in Fraud Metrics and KPIs, and classify it carefully: much of it is first-party or credit-like loss, not third-party fraud (Loss Taxonomy and Attribution, First-Party Fraud).
Pitfalls
- Measuring to settlement instead of finality. The tail after settlement is where unauthorized-return and dispute losses sit.
- Using deposit amount instead of extracted amount. That overstates exposure for good customers and understates it for fraud.
- Ignoring adverse selection. Reversal rates on all deposits understate reversal rates on extracted ones.
- Per-account limits only. A controller with 40 accounts has 40 limits (Multi-Accounting, Fraud Rings and Collusion).
- Calibrating on calm months. Attacks are regime changes, so run stress scenarios as well as averages.
- No owner. Instant availability treated as a growth feature with nobody accountable for the loss line.
- Faster exits added without re-pricing. Adding RTP, push-to-card or crypto withdrawal shrinks your detection window. The exposure math changes even though funding didn't.
- Seasoning on a few small cleared deposits. That's a classic setup for Bust-Out Fraud.
Related
- Controls: Funds Availability Holds · Velocity and Exposure Limits · Withdrawal and Payout Controls · Reward Vesting and Clawback · Seller Onboarding and Reserves · Kill Switches and Circuit Breakers · Real-Time Transaction Risk Scoring
- Mechanisms: Instant Funding Abuse (Kiting) · ACH Funding Fraud · Check and Mobile Deposit Fraud · Card-Not-Present Fraud · Chargeback and Friendly Fraud · Real-Time Payment Rail Fraud · Sign-Up Bonus Abuse · Business Logic Exploitation
- Playbooks: Playbook - Instant Funding Abuse Members · Playbook - ACH Funding Fraud Members · Playbook - Mobile Deposit Fraud Members
- Rules: Regulation CC and Funds Availability · Nacha Rules and ACH Risk · Card Network Dispute Rules · Broker-Dealer Obligations (FINRA and SEC)
- Program: Fraud Metrics and KPIs · Loss Taxonomy and Attribution · Friction and Customer Experience Tradeoffs · Experimentation and Champion-Challenger · Fraud Risk Assessment
- Industries: Neobanks and Consumer Fintech · Brokerage and Investing · Cashback, Coupons and Rewards · Online Marketplaces · Payments and P2P
- Cases and maps: Case Study - Chase Infinite Money Glitch (2024) · Payment Rails Map
Sources and further reading
- EPCOR, ACH Return Reason Code resource (2021): 2-banking-day vs 60-calendar-day return timeframes by code (R01, R02, R05, R07, R10, R11, R29)
- Adyen, Dispute timeframes: card dispute windows generally 120 days from the transaction date, up to 540 days in some cases; merchant response windows
- Cornell LII, UCC 4-214 Right of charge-back or refund: provisional credit can be charged back until settlement for the item becomes final
- eCFR, 12 CFR 229.12 Availability schedule: bank check availability maximums
- eCFR, 12 CFR 229.13 Exceptions: exception holds and reasonable-period extensions
- SEC, Chair Gensler statement on T+1 implementation (Press Release 2024-62): U.S. move to T+1 settlement on May 28, 2024
- Investor.gov, Updated Investor Bulletin: Trading in Cash Accounts (2026): Reg T payment rules, freeriding and the 90-day freeze on unsettled-funds trading