Nacha Rules and ACH Risk
Nacha rules for ACH fraud teams: key return codes and windows, unauthorized/administrative/overall return rate levels, WEB debit validation, 2024 risk changes and the 2026 fraud monitoring phases.
Core components
Roles
| Role | Who | Fraud exposure |
|---|---|---|
| Originator | Company initiating entries (e.g., a brokerage pulling deposits via WEB debit; a payroll provider pushing credits) | Debit returns after value released; originating credits to fraudster-controlled accounts |
| ODFI | Originator's bank | Warranties on entries; monitoring of originators' return rates; credit-push fraud |
| Third-Party Sender / TPSP | Processors, payment facilitators, platforms sending on behalf of originators | Nested originator risk; monitoring obligations |
| RDFI | Receiver's bank | Receives fraudulent credits into mule accounts; handles consumer unauthorized-debit claims |
| Receiver | Account holder debited or credited | Victim (unauthorized debit) or mule (fraudulent credit) |
Many fintechs are originators or third-party senders through a partner ODFI. Their program agreement passes Nacha obligations down to them.
Return codes fraud teams live with
| Code | Meaning (short) | Fraud relevance |
|---|---|---|
| R01 / R09 | Insufficient / uncollected funds | First-party kiting and bust-out hide here; see Instant Funding Abuse (Kiting) |
| R02 / R03 / R04 | Account closed / no account / invalid number | Count toward the administrative return rate; mule churn, synthetic accounts, typos |
| R05 | Unauthorized debit to consumer account using corporate SEC code | Unauthorized |
| R06 | Returned per ODFI's request | Since Oct 2024, ODFI may request return for any reason (with indemnity) |
| R07 | Authorization revoked by customer | Unauthorized |
| R10 | Customer advises originator is not known and/or not authorized | Core unauthorized code; requires Written Statement of Unauthorized Debit (WSUD) for extended returns |
| R11 | Customer advises entry not in accordance with the terms of the authorization | Repurposed in 2020–2021: authorization exists, but the entry was wrong (amount, date, etc.) |
| R17 | File record edit criteria / "QUESTIONABLE" | Since Oct 2024, RDFIs may use R17 with descriptor QUESTIONABLE to return entries believed fraudulent (including false pretenses) |
| R29 | Corporate customer advises not authorized | Unauthorized (business accounts) |
| R51 | Item related to RCK entry is ineligible or improper | Counted among unauthorized returns for the 2015 return-rate rule |
| R90 (from Mar 17, 2028) | Sanctions compliance return | New code with its own return time frame |
Return windows (summary). Most returns must be transmitted within two banking days of settlement. Consumer unauthorized returns (e.g., R05, R07, R10, R11) with a signed WSUD can use an extended return timeframe, commonly described as 60 calendar days from settlement. That's why ACH funding fraud carries roughly 60 days of exposure. Since October 1, 2024, a Receiver may sign the WSUD once the entry is presented (posted or pending); previously it had to be on or after settlement. RDFIs returning in the extended window must do so by the opening of the sixth banking day after completing review of the WSUD.
The extended window runs 60 calendar days from the original entry's settlement date, and the return is due by opening of business on the banking day after day 60. Eligible codes are R05, R07, R10 and R11, and R11 has carried the 60-day window since April 1, 2020 (Nacha, Differentiating Unauthorized Return Reasons; EPCOR return reason code resource; Open Exam Prep summary).
Return rate levels
| Level | Threshold | Codes counted |
|---|---|---|
| Unauthorized entry return rate | 0.5% of debit entries | R05, R07, R10, R11, R29 (and R51 per the 2015 rule) |
| Administrative return rate | 3.0% of debit entries | R02, R03, R04 |
| Overall return rate | 15.0% of debit entries | All debit returns (excluding RCK) |
- Rates are calculated over the preceding 60 days or two calendar months.
- Exceeding a level doesn't automatically mean a fine. Nacha can open a preliminary inquiry, and an industry review panel can direct the ODFI to reduce the originator's or third-party sender's return rate. The rules set timeframes for those reductions. Get the specifics from your ODFI.
- Since 2016, ODFIs pay RDFIs an Unauthorized Entry Fee for each debit returned as unauthorized. R11 was added in 2021.
Account validation for WEB debits
Since March 19, 2021, WEB debit originators' "commercially reasonable fraudulent transaction detection system" must include account validation: at minimum confirming the account is open and can accept ACH, before first use of an account number and on changes. Ownership verification isn't required by this rule, but it's what actually stops funding fraud from someone else's account. See Bank Account Ownership Verification.
Data security
Covered non-FI originators, TPSPs and TPSs must render stored deposit account numbers unreadable at rest (encryption, tokenization, truncation or destruction). Phase 1 covered parties with 6M+ entries in 2019, from June 30, 2021. Phase 2 covered parties with 2M+ entries in 2020, from June 30, 2022.
The 2024 risk management package (effective October 1, 2024)
| Change | What it does |
|---|---|
| R17 for false pretenses | RDFIs may (not must) return entries they believe are fraudulent using R17 + QUESTIONABLE |
| "False Pretenses" defined | Inducing a payment by misrepresenting identity, association with or authority for another person, or ownership of the account to be credited (BEC, vendor/payroll impersonation). It excludes disputes over fake or poor-quality goods or services |
| Expanded ODFI Request for Return (R06) | ODFI may request return for any reason, indemnifying the RDFI. RDFI must report its decision or status within 10 banking days (from April 1, 2025) |
| Funds availability exception | RDFIs may delay availability for credits suspected of being originated under false pretenses (must notify the ODFI; Reg CC still applies) |
| WSUD timing | Receiver may sign WSUD once the debit is presented (posting or pending notice) |
| Prompt return of unauthorized debits | Extended-window returns by opening of the 6th banking day after WSUD review |
The 2026 fraud monitoring rules
| Phase | Effective | Who |
|---|---|---|
| Phase 1 | March 20, 2026 | All ODFIs; non-consumer originators, TPSPs and TPSs with 2023 ACH origination volume ≥ 6 million; RDFIs with 2023 ACH receipt volume ≥ 10 million |
| Phase 2 | June 19, 2026 (practically June 22, 2026, because June 19 is a federal holiday) | All remaining non-consumer originators, TPSPs, TPSs and RDFIs |
What's required:
- Originators, TPSPs, TPSs, ODFIs: establish and implement risk-based processes and procedures, relevant to their role, reasonably intended to identify entries suspected of being unauthorized or authorized under false pretenses.
- RDFIs: risk-based processes to identify credit entries suspected of being initiated due to fraud, including how flagged entries are handled. This is the first time RDFIs have a defined monitoring role.
- Review at least annually and update as risks evolve.
- Not required: screening every entry, or pre-processing/pre-posting monitoring. Nacha doesn't prescribe technologies; examples it cites include velocity checks, anomaly detection, behavioral tolerances and pattern recognition.
- Liability unchanged: the rules expressly don't modify UCC Article 4A allocations.
- Flagged-entry options for ODFIs include stopping processing, consulting the originator, checking internal systems, or contacting the RDFI (via the ACH Contact Registry). RDFIs can use the funds-availability exception to investigate and can return with R17 (or R06 at ODFI request).
Also effective March 20, 2026: standard Company Entry Descriptions. Use PAYROLL for PPD wage credits (helps RDFIs spot payroll redirection to new accounts) and PURCHASE for consumer WEB debits for online purchases of goods.
Other dates: September 18, 2026 funds availability for non-same-day credits by 9:00 a.m. RDFI local time on settlement date (5:00 p.m. receipt condition removed); September 17, 2027 Same Day ACH per-entry limit rises to $10 million.
What this means by industry
| Industry | Primary ACH risk | Nacha lever |
|---|---|---|
| Brokerage and Investing | Debit funding from accounts the user doesn't own; buy-then-return; instant buying power | Account validation + ownership; return-rate monitoring; availability holds |
| Neobanks and Consumer Fintech | Inbound credit fraud into mule accounts; payroll redirection; kiting via external debits | RDFI credit monitoring; PAYROLL description; R17 returns; funds availability exception |
| Payments and P2P | Bank-funded P2P with returns after send | Exposure limits; extended-return awareness |
| Cashback, Coupons and Rewards | ACH payouts to farmed or mule accounts | Payout destination verification; credit-push monitoring as originator |
| Online Marketplaces | Seller payouts redirected; buyer ACH funding returned | Payout holds; ownership checks |
How to build it
- Inventory your ACH roles per product: originator, TPS, TPSP, or RDFI (some fintechs with bank charters are both).
- Write the risk-based monitoring procedure the 2026 rules require: scope, data used, detection methods, alert handling, escalation to ODFI/RDFI, annual review.
- Return-rate dashboard by channel and cohort, using Nacha's code groupings and 60-day windows.
- Exposure model: value released before the extended return window closes. Tie it to Funds Availability Holds and Velocity and Exposure Limits.
- Contact Registry and partner playbooks for urgent recalls and R06 requests.
- Annual review with sign-off, aligned to rules and your partner bank's program requirements.
Artifacts and templates
2026 monitoring procedure outline
- Role(s) and phase applicability documented
- Entry types in scope (credits, debits, SEC codes)
- Risk factors: new payees, account changes before payout, new-origin accounts, velocity, payroll-to-new-account, mismatched names
- Detection methods (rules, models, vendor signals) and timing (pre- or post-processing)
- Handling of flagged entries: hold, contact counterparty, return code choice (R17/R06), customer contact
- Documentation and metrics
- Annual review owner and date
Metrics
- Unauthorized, administrative and overall return rates (60-day), by channel and cohort
- Exposure at risk within extended-return windows
- Credit-push fraud detected / missed (inbound and outbound)
- R06 / R17 volumes and recovery rates
- Time to contact counterparty on flagged entries
Pitfalls
- Treating 2 banking days as the risk window for consumer debits. Exposure runs through the extended unauthorized window.
- Account validation ≠ ownership. An open account isn't necessarily the customer's account.
- Monthly return-rate reporting. By the time you see it, the 60-day window is already blown.
- Assuming RDFI monitoring means debit monitoring. The 2026 RDFI obligation is about credits.
- No relationship with your ODFI's risk team. Without a named contact there, escalations and R06 requests stall.
- Using R17 for merchant disputes. False pretenses exclude goods/services quality disputes.
Related
- ACH Funding Fraud · Playbook - ACH Funding Fraud Members · Instant Funding Abuse (Kiting) · Payout Redirection · Money Mules
- Bank Account Ownership Verification · Funds Availability Holds · Velocity and Exposure Limits · Transaction Monitoring
- Regulation E and Unauthorized Transfers · US Regulatory Overview · BSA-AML and SAR Filing
- Payment Rails Map · Fraud Labeling and Feedback Loops
Sources and further reading
- Nacha, Fraud Monitoring Phase 1: March 20, 2026 coverage, 6M/10M thresholds, requirements, false pretenses, FAQ on R17 and UCC 4A
- Nacha, Fraud Monitoring Phase 2: June 19/22, 2026 extension to all parties
- Nacha, New rules list: 2026–2028 effective dates (funds availability, Same Day ACH $10M, R90)
- Nacha, Summary of upcoming rule changes: implementation calendar including June 22, 2026
- Nacha, Company Entry Descriptions: PAYROLL and PURCHASE, effective March 20, 2026
- Nacha, Risk Management Topics (Oct 1, 2024): R17, R06, funds availability exception, WSUD timing, sixth-banking-day return
- Nacha, ACH Network Risk and Enforcement Topics (2015): 0.5% / 3.0% / 15.0% return rate levels and codes
- Nacha, Archived rules (2015–2021): Unauthorized Entry Fee (2016) and its return codes
- Nacha, Unauthorized Return Rate guidance (Mar 2021): calculation over 60 days/two months; R11 included
- Nacha, Differentiating Unauthorized Return Reasons: R10 vs R11; R11 in unauthorized return rate and fees
- Nacha, Supplementing Fraud Detection Standards for WEB Debits: account validation requirement, March 19, 2021
- Nacha, Supplementing Data Security Requirements: unreadable storage of account numbers; phases and thresholds
- Nacha, Credit-Push Fraud Monitoring Resource Center: non-prescriptive methods; RMAG guidance links
- Nacha RMAG, RDFI credit-push fraud response checklists (2023): hold, contact ODFI, return, post-mortem steps
- Nacha, ACH Network volume and value statistics: 35.19 billion payments worth $93.00 trillion in 2025