ACH Return Codes: What to Retry and What to Stop
ACH Return Codes: What to Retry and What to Stop
A business collecting 20,000 bank debits a month sees 500 come back for insufficient funds, worth $75,000. Two retries timed to customers' paydays recover $41,250 of it. Retry a different code, a closed account or a revoked authorization, and the business gains nothing and moves toward Nacha's 0.5% unauthorized return threshold. The return code decides which response is allowed and which one pays.
What you'll learn
What an ACH return code tells you
When a bank debit fails, the customer's bank sends it back with a return reason code. Like a card chargeback code, it says why, and the reason decides what the business may do next: retry, update the account, ask for a new authorization, or stop. Per our bank payment analysis, ACH is far cheaper than cards, but only for businesses that handle returns well. Treating every return the same way wastes recoverable revenue on some codes and creates compliance problems on others.
| Group | Codes | Meaning | Return window | What to do |
|---|---|---|---|---|
| Funding | R01 Insufficient Funds; R09 Uncollected Funds | The account exists but could not cover the debit | 2 banking days | Retry, at most twice, within 180 days |
| Administrative | R02 Account Closed; R03 No Account; R04 Invalid Account Number | The account details are wrong or no longer valid | 2 banking days | Do not retry; obtain new account details |
| Unauthorized | R05, R07 Authorization Revoked, R10 Not Authorized, R11 Not in Accordance with Authorization | The account holder disputes the authorization or its terms | Up to 60 calendar days for consumer accounts | Do not retry without a new or corrected authorization |
| Stop payment | R08 Payment Stopped | The customer told the bank to stop the debit | 2 banking days | Retry only with a new authorization |
| Account status | R16 Account Frozen; R20 Non-Transaction Account | The account cannot be debited | 2 banking days | Obtain a different account |
The two-day and sixty-day windows create different risks. A funding return arrives quickly, before most goods ship. An unauthorized return can arrive two months after the business considered the payment complete, which makes it closer to a card chargeback than to a decline. Per our chargeback reason code analysis, the same principle applies to both: the code routes the response.
The thresholds that matter
Nacha, which sets the rules for the ACH network, monitors each originator's return rates against three thresholds measured over the prior 60 days. Exceeding them triggers inquiries to the originator's bank and, if not resolved, can lead to fines and loss of access.
| Return rate | Codes included | Threshold |
|---|---|---|
| Unauthorized | R05, R07, R10, R11, R29, R51 | 0.5% |
| Administrative | R02, R03, R04 | 3.0% |
| Overall | All debit returns | 15.0% |
The unauthorized threshold is the one that binds. At 0.5%, a business running 20,000 debits a month can absorb 100 unauthorized returns before it is flagged. That is a narrow margin for a business with weak authorization records, and the codes in it are the ones that most directly suggest fraud or misleading enrollment.
A month of returns, worked
Take a subscription business collecting 20,000 bank debits a month averaging $150, with a $3 bank fee per return.
| Code | Rate | Returns |
|---|---|---|
| R01 Insufficient Funds | 2.50% | 500 |
| R02 Account Closed | 0.40% | 80 |
| R03 No Account | 0.30% | 60 |
| R04 Invalid Account Number | 0.20% | 40 |
| R10 Not Authorized | 0.15% | 30 |
| R07 Authorization Revoked | 0.05% | 10 |
| Total | 3.60% | 720 |
The business sits comfortably under every threshold: 0.20% unauthorized, 0.90% administrative and 3.60% overall. The money is in the R01 row: 500 returns worth $75,000.
| R01 recovery step | Items collected | Dollars recovered |
|---|---|---|
| First retry, timed to the customer's payday (40% succeed) | 200 | $30,000 |
| Second retry (25% of the remaining 300 succeed) | 75 | $11,250 |
| Total | 275 of 500 (55%) | $41,250 |
Timing drives the retry rate. An R01 retried the next morning usually fails again; one retried on the day the customer's pay arrives often succeeds. Per our failed payment analysis, retry logic tuned to income timing recovers far more than a fixed schedule, and per our payment data analysis, the dates of past successful debits are the best guide to when funds will be there.
Retry when the money is there
HL Hunt AI Payment Processing reads each return code, schedules insufficient-funds retries around each customer's observed pay cycle within Nacha's limits, and blocks retries on codes that require a new authorization.
The codes you must not retry
- Administrative returns. A debit to a closed or nonexistent account will fail again. Retrying adds to the administrative rate and the return fees without any chance of collecting. Obtain new details first; per our closed account analysis, a closed account is often the first sign of a customer in difficulty.
- Unauthorized and revoked returns. Nacha rules treat reinitiating these without a new authorization as improper. Regulation E also gives consumers the right to stop preauthorized debits, and debiting an account after a revocation risks both rule violations and consumer complaints.
- Stop payments. An R08 means the customer took a deliberate step. Retrying without a new authorization is improper.
- Disguised retries. Changing the amount, date or description to make a returned debit look like a new one is itself a violation of the reinitiation rules.
Notifications of change are the quiet counterpart. When a bank accepts a debit but the account details need updating, it sends a notification of change rather than a return. Originators must apply the correction within six banking days or before the next debit, whichever is later. Ignoring them turns a fixable data issue into future administrative returns. Per our account updater analysis, it is the bank-debit equivalent of updating expired cards.
Preventing returns at enrollment
- Validate account numbers. Nacha rules require originators of internet-authorized debits to use account validation as part of a commercially reasonable fraud detection system when an account number is first used.
- Keep authorization records. A clear, retained authorization is the defense against an R10 or R11, and the evidence the bank will ask for.
- Use a recognizable company name. Per our billing descriptor analysis, customers who do not recognize a debit report it as unauthorized.
- Send advance notices. A reminder before each debit, especially if the amount changes, lets customers fund the account or update it, reducing both R01 and R10.
- Monitor for fraud. Nacha rules phased in during 2026 extend risk-based fraud monitoring obligations to originators, and an unusual pattern of unauthorized returns is the signal they look for.
Keep unauthorized returns far from 0.5%
HL Hunt AI Payment Processing validates accounts at enrollment, stores authorization evidence, applies notifications of change automatically and tracks your return rates against Nacha thresholds by code.
The case for stopping at one retry
Retries are not free. Each failed attempt costs a return fee, may trigger an overdraft or insufficient-funds fee for the customer, and raises the overall return rate. Per our overdraft analysis, a customer charged a bank fee because a merchant retried an unfunded debit is more likely to revoke authorization or complain, which converts a recoverable R01 into an unauthorized return. A business serving financially stretched customers may reasonably retry once, at the best-predicted date, and then contact the customer rather than the bank. Per our recurring billing analysis, the best-performing billing programs treat a return as the start of a conversation, not just a scheduling problem.
Frequently asked questions
R01 and R09 funding; R02, R03, R04 administrative; R05, R07, R10, R11 unauthorized; R08 stop payment.
Yes, up to two more times within 180 days. Timing retries to paydays recovered 55% of R01 dollars in the example.
0.5% unauthorized, 3.0% administrative and 15.0% overall.
Administrative returns without new details, and unauthorized, revoked or stopped debits without new authorization.
Key takeaways
- The return code decides whether a business may retry, must update the account, or needs a new authorization.
- Most returns arrive within two banking days; consumer unauthorized returns can arrive up to 60 days later.
- Nacha thresholds are 0.5% unauthorized, 3.0% administrative and 15.0% overall.
- R01 and R09 may be retried up to two more times within 180 days.
- In the example, payday-timed retries recover $41,250 of $75,000 in insufficient-funds returns.
- Administrative, unauthorized, revoked and stopped debits must not be retried without new details or authorization.
- Apply notifications of change within six banking days or before the next debit.
- Account validation, clear authorizations and recognizable descriptors prevent returns at enrollment.
References
- Nacha. Nacha Operating Rules & Guidelines, including Reinitiation of Returned Entries and Return Rate Levels. Nacha.
- Nacha. Nacha Operating Rules, Appendix Four: Return Entries (return reason codes and time frames).
- Nacha. Supplementing Fraud Detection Standards for WEB Debits (effective 2021).
- Regulation E, Preauthorized Transfers, 12 C.F.R. § 1005.10.
- Electronic Fund Transfer Act, 15 U.S.C. § 1693 et seq.
This guide is educational and does not constitute legal or payments advice. Return codes, time frames, reinitiation limits and return rate thresholds are set by the Nacha Operating Rules, which change periodically; consult the current rules and your originating bank. Volumes, return rates, retry success rates and fees are stylized illustrations and do not describe any particular business.