ACH for Crypto Purchases: Managing R10 Returns and Release Holds

On this page 6 sections

1. Why Exchanges Turn to ACH and Pay by Bank Crypto Funding
2. ACH Return Codes and Timelines That Matter for Crypto
3. The R10 Return Window Outlasts Any Hold You'd Accept
4. Verifying Accounts and Balances Before You Fund
5. Managing ACH Crypto Purchase Return Risk With Holds and Tiered Limits
6. Nacha Unauthorized Return Thresholds You Must Stay Under

Key takeaways

• Holds catch the fast returns from insufficient funds and closed accounts. Limits cap the slow R10 returns. No hold a customer will accept covers the whole unauthorized window.
• Account validation and balance checks prevent R01 to R04 returns. They do little against a fraudster using stolen bank logins, so match the KYC name to the account owner.
• Return rates count entries, not dollars. Lower limits shrink your losses, but only better KYC and ownership matching lower your unauthorized return rate.
• Sending a consumer debit under a business entry class does not shorten your exposure. It creates its own unauthorized return.

ACH looks like the cheap way to let customers buy crypto. There's no interchange, and a bank account sits behind every deposit. The catch is timing. The biggest ACH crypto purchase return risk is that a consumer can tell their bank a debit was unauthorized long after your platform credited the account and the coins left on-chain. That return, coded R10, lands on you as a loss.

Insufficient-funds and closed-account returns usually show up within days. Unauthorized returns can arrive weeks later. Use holds to absorb the fast returns and limits to cap the slow ones. Then watch your unauthorized return rate closely, because Nacha (the organization that writes the ACH rules) and your bank both watch it.

This is general information about ACH rules and common risk practice. It is not legal or compliance advice. Return deadlines and thresholds change, so confirm current terms with your bank and a qualified professional.

Why Exchanges Turn to ACH and Pay by Bank Crypto Funding

Cards are a poor fit for crypto purchases. Many issuers treat a crypto buy as a cash-like transaction, so cardholders can face cash-advance pricing or an outright decline. We cover the coding side in why crypto card buys are processed as quasi-cash under MCC 6051. Percentage-based card fees also get expensive on the larger tickets crypto buyers often place.

Banks and processors usually price ACH debits as a flat per-item fee. A large deposit costs about the same to collect as a small one. Customers who fund from a bank account also tend to fund again.

"Pay by bank" puts a better front end on the process. The customer logs into their bank through an account-linking service, and the platform confirms the account before any money moves. In most U.S. setups, though, the money itself still moves as an ACH debit. A smoother login doesn't change the consumer's return rights.

A credit transfer works differently. Here the customer pushes money from their own bank over a real-time payment network, so there's no debit for anyone to return. The fraud risk shifts toward scams and account takeover at the customer's bank. If a provider pitches pay by bank crypto funding, ask whether it means a debit you pull or a credit the customer sends.

ACH Return Codes and Timelines That Matter for Crypto

Every ACH return comes back with a reason code, and the code decides how long you're exposed. Nacha's rules give most returns a short standard window. A return where the consumer says a debit was unauthorized or not as agreed gets a longer, extended window.

This table simplifies the rules. Your ODFI (originating depository financial institution, the bank that sends your debits into the ACH network) can tell you the exact deadline for each code. Your origination agreement may also add terms of its own.

The top two rows are operational problems, and good data mostly prevents them. Everything below them is a claim a consumer makes to their own bank. For a crypto exchange, the R10 return is the one that hurts. A fraud victim's bank uses that code, and a buyer with remorse may reach for it too.

The R05 row clears up a common misunderstanding. Some sellers assume that sending a consumer debit as a business-to-business entry shortens the return window. It doesn't. A business entry pulled from a consumer account can be returned as R05 within the extended window, and the miscoding will draw your bank's attention. Use the entry class that matches both the account and the channel.

The R10 Return Window Outlasts Any Hold You'd Accept

Here is how a typical R10 loss plays out at a crypto exchange. A fraudster gets someone's online banking login and links that account to a new exchange profile. After a deposit funds a bitcoin purchase, the fraudster withdraws the coins to an outside wallet. Your balance shows the money once the transfer settles.

Weeks later, the real account holder spots the debit on a statement and tells their bank it wasn't authorized, usually by signing a written statement. That bank returns the debit as R10, and your ODFI pulls the funds back from you. On-chain transfers don't reverse, so the coins are gone. Funds that have cleared into your account can still come back at any point in the extended window.

First-party fraud is the second pattern. A real customer buys, and after the price drops, tells their bank they never authorized the debit. Your evidence, such as login history and the confirmation screen they clicked, won't reverse that return inside the ACH network, because ACH has no card-style representment process. Your recourse sits mostly outside the network. You can ask your ODFI to get the consumer's signed statement from their bank, and you can try to collect from the customer directly under your terms of service. Card disputes follow a different process, covered in how to win crypto purchase chargebacks after coins are sent.

Customers won't accept a withdrawal hold as long as the full unauthorized return window. If you tried one, competitors would win those customers. A hold alone can't solve R10, so it has to work alongside limits.

Verifying Accounts and Balances Before You Fund

Your bank will expect fraud screening on online consumer debits, and validating an account before you debit it is part of that. Ask your ODFI what its origination agreement and the current Nacha rules require for internet-authorized debits. In practice, verification works in layers, and each layer blocks a different kind of return.

Account validation and balance checks handle the operational codes. Validation confirms the account exists and is open, either through the bank login itself or through micro-deposits, and it prevents most R02 to R04 returns. A real-time balance read through the linked connection, taken when you start the debit, tells you whether the deposit amount is actually there. That heads off R01.

Ownership matching is the layer that affects R10. A stolen login passes validation and the balance check without trouble. Where it often fails is a name match between the person who passed your KYC and the account holder the bank reports. Route any mismatch to a hard stop or a manual review. Then add crypto-specific signals:

• A bank account linked within minutes of profile creation
• A withdrawal address added right after the first deposit
• A login from a new device just before a large purchase
• One bank account linked to several profiles, or several bank accounts tried on one profile

No single signal proves fraud. Two or three together justify a longer hold and a lower limit.

Managing ACH Crypto Purchase Return Risk With Holds and Tiered Limits

You have two levers. An ACH hold before crypto withdrawal lets the customer buy and see the asset but stops them from moving it off-platform until the hold ends. Limits set how much provisional buying power you extend against deposits that are still inside their return risk.

Set the hold length from your own data. Pull every return from the past year and chart the days from settlement to return, broken out by code. You'll likely see R01 to R04 cluster early and R10 trail out in a long tail. A hold that covers the early cluster turns those returns into a cancelled trade instead of a loss. Make sure your terms of service let you sell or reverse the position if a return arrives during the hold. If the price has fallen by then, you still absorb the difference, so have counsel review that clause.

Limits handle the long tail. A common structure ties buying power to clean history:

1. New customers get a low limit on unsettled funds and a withdrawal hold on anything bought with ACH money.
2. Once a first deposit clears past your observed return cluster, the limit steps up modestly.
3. After several clean deposits, limits rise further and holds shorten.
4. A password reset or a new withdrawal address drops an established customer back a tier for a while.

Worked Example: What a Lower Limit Is Worth

Every number in this example is illustrative, not a benchmark. Assume six fraudsters open accounts on your platform in a month, and their debits come back R10 after your hold ends. Assume each one deposits the most you allow.

Under these assumptions, Policy B cuts the loss to a tenth of Policy A's. The cost is friction, because legitimate new customers who wanted to buy more than the limit have to wait. Your conversion data decides whether that trade is worth it. Determined fraudsters will answer Policy B by opening more accounts, which is why ownership matching comes before limits.

Look at the count, too. Both policies produce six R10 returns. A lower limit shrinks the dollars lost but leaves your return rate untouched.

Nacha Unauthorized Return Thresholds You Must Stay Under

Nacha sets return-rate thresholds for originators in several categories, and the threshold for unauthorized returns is the tightest. Rates count entries over a lookback period, not dollars. So the six returns in the example matter regardless of their size, and many small fraudulent debits can hurt your rate more than one large one. Ask your ODFI for the current thresholds and how it calculates your rate.

Crossing a threshold can trigger a Nacha inquiry through your bank. That can escalate to fines and, at worst, the loss of your ability to originate debits. Your ODFI almost certainly has tighter internal triggers written into your origination agreement, and it can end the relationship before Nacha gets involved. Get those triggers in writing. Track your unauthorized rate weekly by cohort, comparing new accounts with established ones, so you see a spike before your bank does.

ACH risk is one part of how banks judge a crypto seller. Underwriters also review the items in what crypto exchange underwriters need to see, along with your FinCEN MSB registration and state licenses.

Start this week by exporting a year of ACH returns and charting days-to-return by code. If your current hold ends before the early cluster does, lengthen it. Then set your new-customer limit at a loss you can absorb. MannyPay offers high-risk merchant accounts, and whether a given business qualifies depends on underwriting. Request a free quote and a MannyPay specialist will respond within one business day.

MB

About the author

Marcus Bennett

Marcus Bennett is Payments Risk & Compliance Analyst for Beyond the Swipe, covering high-risk processing, chargebacks, rolling reserves, frozen merchant accounts and fraud prevention.

This article is for general educational purposes and is not legal, tax or financial advice. Card network rules and state laws change; confirm current requirements for your business.