Nacha Return Rate Limits for Lenders: Codes, Reviews and Fixes
Learn which return codes count toward each ACH return rate threshold for lenders, what an ODFI review involves, and servicing fixes that cut R10 returns.
Photo: Pixabay
On this page 6 sections
Key takeaways
- Insufficient-funds returns don't count toward the unauthorized limit. Every failed retry does count toward the overall limit, so retry policy alone can push a lender over that line.
- Many unauthorized returns in lending come from servicing problems, such as unfamiliar descriptors or ignored revocations, rather than stolen account numbers.
- Consumers can file unauthorized claims weeks after a debit settles, so this week's rate understates what is still coming. Track rates by debit date and lead source.
- Don't retry a return for a closed, invalid or unauthorized account. Fix the account or get a new authorization first.
Every lender that debits borrower bank accounts has to stay under three ACH return rate thresholds in the Nacha Operating Rules. One covers unauthorized returns, one covers administrative returns, and one covers all returns combined. For a lender, the unauthorized threshold is the one that matters most. It sits far below the other two, it is the one most likely to end a banking relationship, and it is the one that responds most directly to how you service loans.
These are network rules written by Nacha, the organization that governs the ACH Network. They are not federal law. Your bank, called the ODFI (Originating Depository Financial Institution), enforces them as a condition of letting you send debits, and many banks set tighter internal limits of their own. Treat what follows as general information. Confirm the current threshold figures and measurement period in the Operating Rules or with your ODFI, and take consumer-lending law questions to counsel.
The Three ACH Return Rate Thresholds Every Lender Faces
Nacha measures each originator's returns over a recent look-back period and compares them with the debit entries sent in that period. The three thresholds carry different weight.
The unauthorized return rate threshold is the strict one. If you exceed it, Nacha can open a rules enforcement proceeding through your ODFI. The bank then has to answer on a deadline and show that your rate is coming down and staying down. Expect your bank to pass those deadlines straight to you.
The administrative and overall return rate thresholds work as review triggers. Crossing either one prompts Nacha to ask your ODFI what caused the spike and how it is being handled. A review is not an automatic violation, but it is still serious. Many banks tighten terms long before Nacha ever calls.
Nacha Unauthorized Return Rate: Which Codes Count
Lenders often misunderstand which return codes fall into which bucket. A borrower with no money in the account does not hurt your unauthorized rate. A borrower who tells their bank "I didn't authorize this" does.
The unauthorized category covers returns where the account holder disputes the debit itself. In consumer lending, the most common is R10, which a bank uses when a consumer says a debit was unauthorized or improper. R11 covers a debit the borrower did authorize that broke the agreed terms, such as the wrong amount or the wrong date. R07 means the borrower revoked authorization and was debited anyway. R29 is the business-account version of an unauthorized claim. It matters if you make small-business loans or merchant cash advances against corporate accounts.
The administrative category covers account problems rather than disputes. These include closed accounts (R02), accounts that can't be located (R03) and invalid account numbers (R04).
The overall category includes everything above plus the returns lenders see most: R01 for insufficient funds and R09 for uncollected funds. Nacha's rules define exactly which codes belong in each category, so pull the current list from the Operating Rules or ask your ODFI for the one it reports against.
Note that insufficient funds is absent from the unauthorized category. An R01 counts only toward the overall rate. That sounds forgiving until you see what retries do to it.
Why R10 Returns Hit Lenders Harder Than Other Merchants
A subscription box company debits accounts that usually have money in them, for amounts customers expect. A consumer lender often debits thin accounts on dates set months earlier. The authorizations were collected online, sometimes through a lead generator the borrower barely remembers.
Several patterns push lender return rates up:
- Unfamiliar descriptors. The debit may show a servicer's legal name or a parent company instead of the brand the borrower applied with. The borrower calls the bank, and the bank codes it R10.
- Revocations that never reach the ACH file. A borrower emails "stop taking money from my account," the message sits in a support queue, and the next scheduled debit comes back R07.
- Amount or date drift. Late fees folded into a payment, or a debit moved off the agreed schedule without the required notice, invite R11.
- Account turnover. Borrowers under financial stress open and close accounts often, which drives R02 and R03 returns.
- Delayed claims. Consumers can file unauthorized returns weeks after a debit settles, so your unauthorized rate keeps climbing long after the debit date.
Underwriters know all of this, which is part of why lenders struggle to get approved in the first place. Our guide on why payday lenders get declined for merchant accounts covers that side of the problem.
A Worked Example: How Retries Move Two Rates at Once
The figures below are illustrative, not industry data. Assume a lender with:
- 8,000 active installment loans on biweekly payments, producing about 32,000 scheduled debits in a two-month window
- 10% of scheduled debits returned R01, or 3,200 returns
- One retry on every R01, with half of those retries failing again (1,600 more R01s)
- 256 administrative returns (R02, R03, R04)
- 140 unauthorized returns, mostly R10 with some R07 and R11
In this example, each rate is the returns in a category divided by total debits in the window. Confirm the exact calculation your ODFI uses. Total debits come to 32,000 plus 3,200 retries, or 35,200. Total returns come to 3,200 + 1,600 + 256 + 140 = 5,196.
Now add a second retry on the 1,600 payments that failed twice. Assume 60% of those retries fail again, which adds 960 returns. Assume also that the extra attempt annoys enough borrowers to generate 40 more R10 and R07 claims. Debits rise to 36,800. Returns rise to 5,196 + 960 + 40 = 6,196. Unauthorized returns rise to 180.
| Scenario | Debits | Overall rate | Administrative rate | Unauthorized rate |
|---|---|---|---|---|
| One retry | 35,200 | 14.8% | 0.73% | 0.40% |
| Two retries | 36,800 | 16.8% | 0.70% | 0.49% |
One more retry added two points to the overall rate. It also raised the unauthorized rate by more than a fifth, even though unauthorized claims grew by only 40. The administrative rate fell slightly, but only because the extra debits enlarged the denominator. Compare your own numbers with the current thresholds in the Operating Rules. A lender already near either line can cross it with one policy change.
Nacha's rules allow insufficient-funds returns to be reinitiated, but they cap how many times and for how long. Even a retry the network rules permit can be a bad trade, as this example shows. Federal consumer finance rules may also limit repeated withdrawal attempts on some loan products after consecutive failures unless the borrower gives a new authorization. The status of those rules has shifted through litigation and agency action, so confirm with counsel whether and how they apply to your products. Our piece on the House GOP bill that would reshape the CFPB tracks one of the forces affecting federal lending rules.
What Happens During an ODFI Return Rate Review
ODFIs watch their originators' return rates closely. If you send through a third-party sender or payment processor, that party sits between you and the bank and carries similar responsibilities. Many banks check more often than Nacha's measurement period requires.
When your numbers climb, a typical sequence looks like this, though each bank runs its own process:
- An inquiry from the bank asking for return data by code, your authorization language, sample authorization records and an explanation of the spike.
- A remediation plan listing specific changes and a date by which rates must come down. If Nacha has opened a proceeding on your unauthorized rate, the bank answers to Nacha on a deadline and will set one for you.
- Interim risk controls such as a higher reserve, a lower daily or monthly origination cap, a hold on debits for new borrowers, or more frequent reporting.
- Suspension or termination if the rate doesn't fall. Continued violations carry escalating consequences for the bank under Nacha's enforcement process, and banks pass that pressure down.
Document requests are where many lenders stall. If you can't quickly produce a borrower's authorization with the terms and revocation instructions visible, the review gets harder. Keep authorization records for the full retention period the Nacha rules require, and make them retrievable by loan number. The Nacha authorization rules for recurring ACH billing are written for memberships. The underlying expectations, clear terms and a clear way to revoke, apply to loan payments as well.
Servicing Changes That Cut R10 Returns for Lenders
Many lender R10s come from servicing failures that borrowers report as unauthorized. Operational changes bring those down faster than new underwriting does.
Make the debit recognizable. Set the Company Name field to the brand the borrower applied with, and use a plain Company Entry Description such as "LOAN PMT." If you sell or transfer servicing, tell borrowers before the descriptor changes.
Route revocations to the ACH file the same day. Borrowers say "stop" through email, chat, phone, text and letters. Every one of those channels should feed a single queue that pulls the debit before the next file cutoff. A revocation that misses the file can come back as an R07, which counts toward the unauthorized rate.
Validate accounts before the first debit. Nacha's rules for online-authorized (WEB) debits include account validation expectations. Ask your ODFI exactly what it requires. Validation also catches typos that would otherwise come back R03 or R04.
Send a reminder before every debit. A text or email a few days ahead, showing the amount and date and offering a way to reschedule, turns potential disputes into rescheduling calls. When the amount changes, give the advance notice Nacha requires for variable debits.
Retry only codes that allow it. Reinitiate R01 and R09 returns within Nacha's limits, ideally timed to the borrower's payday, and label retries with the descriptor the reinitiation rule specifies. Leave R02, R03, R04, R07 and R10 returns alone until you have fixed the account or obtained a new authorization.
Call borrowers who file R10s. Reach them before their next scheduled debit. Some will reauthorize. Others need their debits stopped, and stopping them costs you less than another return.
Offer another way to pay. Debit card payments give borrowers who keep bouncing ACH another option, though card networks have their own rules for loan repayment. Read card network rules for taking loan payments by card before you add it.
Monitoring Your ACH Return Rates Each Week
Don't wait for your bank's report. Each week, pull a rolling view of debits and returns that matches your ODFI's measurement period, compute all three rates, and break them down four ways.
Start by sorting on debit date instead of return date. Late R10 claims attach to the debit that caused them, which shows whether a particular file or policy change created the problem. Lead source and origination channel come next, because one affiliate sending poorly authorized borrowers can carry your whole unauthorized rate. Look at first-payment returns separately too. An R10 on a borrower's very first debit usually points to the application flow, while one on the tenth payment points to servicing. Finally, split by retry attempt so you can see whether later retries collect enough to justify the returns they generate.
Set internal alarms well below Nacha's thresholds so you have room to act before the bank does. Choose levels that fit your portfolio, and write down who does what when an alarm trips.
Your first move is to pull the last two months of returns grouped by code and lead source. If one channel stands out, fix that first. If adding card acceptance is part of your recovery plan, MannyPay offers high-risk merchant accounts, and approval depends on underwriting. You can request a free quote, and a MannyPay specialist responds within one business day.
This article is for general educational purposes and is not legal, tax or financial advice. Card network rules and state laws change; confirm current requirements for your business.
