ACH

ACH is the batch-based bank transfer rail in the US. It is cheap, slow, reversible, and nothing like a card payment, which matters because both often sit behind the same checkout button.

Everything on this page is US-specific. ACH is governed by Nacha, a US body, and the codes, windows and return rights below have no force anywhere else. Other countries run their own bank-transfer rails with their own rules; the shape described here — batch, no upfront check, failure arriving late — travels further than the detail does.

The shape of it

Files move on a schedule. Same-day windows exist, but the model underneath is still batch. A credit pushes money out; a debit pulls money in, and card payments are always a pull.

There is no authorization step. Nothing checks the balance in advance. You find out it failed afterwards, sometimes days afterwards.

The assumption that costs money

With cards, a decline is immediate and a dispute is unusual. With ACH, a return is a normal operating event that shows up asynchronously.

So the dangerous move is marking an order paid the moment an ACH debit is submitted. It looks fine for weeks and then it doesn't.

	Card	ACH
Balance checked upfront	Yes	No
Failure known	Immediately	Days later
Typical cost	Percentage of value	Flat, cents
Reversal window	Months, via dispute	Two banking days, or 60 calendar days
Can the reversal be contested?	Yes, by representment	No
Money to merchant	One to three banking days	One to two banking days, or same-day windows

This is the comparison the rest of the primer refers back to; timing, end to end links here rather than repeating it.

Returns

Returns arrive with a code that tells you whether to retry, stop, or investigate. Under the Nacha rules there are two windows that matter.

Most returns, including insufficient funds, account closed, invalid account number and uncollected funds, must reach the originating bank within two banking days of the settlement date.

Unauthorized debits to consumer accounts get 60 calendar days. That covers a revoked authorization, a debit the customer says they never authorized, and a debit outside the terms of the authorization. Sixty days is a long time to have treated an order as paid.

The long window is a consumer protection, and that is the whole logic of which code gets which clock. A business account claiming the same thing does not get 60 days; it returns on the standard two-day window like everything else. So the account type, not the complaint, decides how long you stay exposed.

Code	Meaning	Window	Retry?
R01	Insufficient funds	2 banking days	Yes, after a delay
R02	Account closed	2 banking days	No, get new details
R03	No account or unable to locate	2 banking days	No, get new details
R04	Invalid account number structure	2 banking days	No, fix the details
R05	Unauthorized debit to a consumer account using a corporate SEC code	60 calendar days	No
R07	Authorization revoked by the customer	60 calendar days	No
R09	Uncollected funds — the balance is there but not yet available	2 banking days	Yes, after a delay
R10	Customer says the originator is not authorized	60 calendar days	No
R11	Not in line with the terms of the authorization	60 calendar days	No
R29	Business customer says the debit is not authorized	2 banking days	No

Two pairs in that table are worth reading together. R01 and R09 both mean the money is not available right now and both are worth retrying later. R10 and R29 are the same complaint from a consumer and from a business, and the difference in window is the consumer protection at work.

R11 used to be a two-day return for a different purpose. Nacha repurposed it in 2020 and it now carries the 60-day window, so older internal documentation about it is wrong. That is the reason to check codes and windows against the current Nacha rules rather than against a table someone copied a few years ago, including this one.

After an ACH return

Read the return code before you do anything.

1. If the code is R01 or R09, you may retry. Wait at least one banking day.
2. If the code is R02, R03, or R04, do not retry. Get corrected account details first.
3. If the code is R05, R07, R10, R11, or R29, do not retry. Stop debiting the account and check the authorization you hold.

Retrying a revoked or unauthorized debit produces another unauthorized return.

Return rates are monitored

Nacha watches your return rates and enforces against them. Unauthorized returns above 0.5% and administrative returns above 3%, measured over a 60-day window, put your ability to originate ACH at risk. This is a rate limit on bad data and bad authorization practice, and it is the reason account validation before the first debit is worth building.

Terms introduced

• ODFI / RDFI — the originating and receiving banks.
• Return — the receiving bank sending a transaction back, with a reason code.
• NOC — a notification of change, telling you to correct the account details.
• SEC code — the entry class that identifies how the debit was authorized.
• Effective date — the date funds are meant to post, not the date the file was sent.

Check your understanding

0 of 4 answered

1. What is the dangerous assumption when applying card thinking to ACH?

   That a debit which has not returned has succeeded.That ACH is more expensive per transaction.That ACH settles faster than cards.That ACH transactions cannot be reversed.
2. How long can a consumer's bank take to return an ACH debit as unauthorized?

   60 calendar days.2 banking days.30 calendar days.120 calendar days.
3. Why does R29 carry a two-banking-day window when R10 gets 60 calendar days, given both mean "not authorized"?

   The 60-day window is a consumer protection, and R29 is the business-account equivalent.R29 is raised by the receiving bank, whereas R10 is raised by the customer.R29 applies only to same-day ACH, which settles on a shorter clock.R10 requires a written statement from the customer, which takes longer to obtain.
4. You receive a notification of change (NOC) on an ACH debit that otherwise succeeded. What does it mean?

   The debit worked, but the account details you hold are wrong and must be corrected.The debit was returned and must be resubmitted with the same details.The customer has changed banks and the authorization is no longer valid.The receiving bank is warning you that the account is close to its limit.