Summary: A lender that collects installment payments by ACH debit lives under three Nacha return rate limits, each measured over the preceding 60 days or two calendar months. Unauthorized returns (R05, R07, R10, R11, R29 and R51) may not exceed 0.5 percent of debits originated. Administrative returns (R02, R03 and R04) have a review level of 3.0 percent, and returns for any reason have an overall level of 15.0 percent. Crossing the 0.5 percent threshold starts an enforcement process with a 30-day deadline and 180 days of monitoring. Crossing the other two starts an inquiry.
The three thresholds and their return codes
Nacha’s return rate rules are written for the Originating Depository Financial Institution, the ODFI, which is the lender’s bank. The bank monitors the return rates of its Originators, and the fines land on the bank, which may pass them on by contract.
Unauthorized, 0.5 percent. The 2015 rule reduced “the current return rate threshold for unauthorized debit Entries (Return Reason Codes R05, R07, R10, R29, and R51) from 1.0 percent to 0.5 percent.” R11 joined the list from April 1, 2020, when Nacha re-purposed that code, and the current calculation guide lists the set as “R05, R07, R10, R11, R29 and R51.” R10 means the customer advises that the “Originator is Not Known to Receiver and/or Originator is Not Authorized by Receiver to Debit Receiver’s Account.” R11 means the customer advises the “Entry Not in Accordance with the Terms of the Authorization”: an authorization exists, but the debit did not match it.
Administrative, 3.0 percent. This level applies to “debit entries returned due to administrative or account data errors (Return Reason Codes R02, R03 and R04).”
Overall, 15.0 percent. This level applies to “all debit entries (excluding RCK entries) that are returned for any reason.”
The words matter. Nacha calls 0.5 percent a threshold and the other two figures levels: “The most significant difference is that a return rate above a Return Rate Level will not be considered automatically as a violation of the Rules.” On the 3.0 percent figure: “A return rate level above 3.0 percent will not automatically be considered a Rules violation or result in a Rules enforcement proceeding.”
How to calculate each rate, Nacha’s method
Nacha gives two acceptable formulas; use the one your bank uses. Method one: “The number of debits returned divided by the number of debits originated for the preceding 60 days or two calendar months.” Method two: “The number of debits returned for the preceding 60 days or two calendar months divided by the number of debits contained within the files in which the original forward entries were transmitted.” The difference is the denominator: what was originated in the window, or the files the returned entries came from.
Nacha’s own example uses April and May. Returns: 300 in April plus 200 in May, 500 in total. Debits originated: 60,000 plus 40,000, 100,000 in total. Five hundred divided by 100,000 is 0.5 percent, exactly at the threshold. The administrative and overall rates use the same arithmetic with a different numerator: R02, R03 and R04 returns, or all returns. For the overall rate, “RCK Entries and RCK Returns may be excluded from both the numerator and denominator.”
A fictional example with round numbers: Example Lender originates 40,000 ACH debits over two months. The 0.5 percent threshold is 200 unauthorized returns; the 3.0 percent level is 1,200 administrative returns; the 15 percent level is 6,000 returns of any kind. One lead source that produces 150 borrowers who later say they never agreed to the debit uses most of the unauthorized margin.
What causes spikes: lead sources, onboarding, authorization timing
Unauthorized returns are the hardest to bring down because the fix is upstream of collections. By the time the return arrives, the borrower has already disputed the debit. Nacha’s guide for Originators states the standard: “The burden of proof for Authorization is on the Originator.”
Patterns worth checking:
- Lead source. Borrowers acquired through a channel that pre-fills bank details, or that the borrower does not remember, dispute debits as unknown. The R10 rate by lead source is usually the first cut that explains a spike.
- Onboarding. An authorization captured before the loan terms were final, or with a payment amount or date that later changed, produces R11s.
- Authorization timing. Debits initiated before the authorization was signed, or after it was revoked, come back as unauthorized. A release that changed the order of signature and first debit shows up as a block of returns dated to the release.
- Re-presentment. A payment retried more often than the authorization allows, or for a different amount, is a return waiting to happen.
What happens when a limit is crossed
Nacha’s points-of-evaluation chart sets out the sequence for the unauthorized threshold. Nacha identifies an Originator “potentially above unauthorized return threshold through ACH Operator-provided return data” and notifies the ODFI. The ODFI responds with an admission or denial. If it denies, Nacha validates the documentation and closes the case. If the ODFI “does not respond or the response is incomplete, case enters the System of Fines.”
If the ODFI acknowledges the rate is above 0.5 percent, “it must include a plan for reducing the rate below 0.5% within 30 days.” Then: “NACHA confirms whether return threshold has been reduced within 30 days. NACHA monitors for an additional 180 days to ensure return rates remain reduced.” If the ODFI “does not reduce the rate within 30 days or fails to maintain for 180 days, case goes to System of Fines,” where the “ACH Rules Enforcement Panel (consisting of industry peers) reviews case and determines fine.”
For the administrative and overall levels, the path runs through an inquiry first: Nacha staff decide whether to forward the case to the panel, and the panel decides whether to direct the ODFI to reduce the rate, after which the same clocks apply.
Nacha’s RMAG guide says “Fines can be up to $500,000 per month for egregious violations,” and the enforcement rule in force since January 1, 2021 defines an egregious violation as “A willful or reckless action, and involves at least 500 Entries, or involves multiple Entries in the aggregate amount of at least $500K.”
Monitoring by month and by loan cohort
A lender can see its rate before the bank does, because every return posts to a loan’s payment history with a code and a date.
By month: count unauthorized-code returns and debits originated for each rolling 60-day window, and plot the rate against 0.5 percent. A rate that has climbed from 0.2 to 0.35 percent over three windows is a warning while still inside the limit.
By cohort: group loans by origination month and by lead source, and compute each group’s unauthorized return rate over its life. A cohort whose R10 rate is four times the book’s points at a channel or a release, with dates.
The check behind both views is the same. For every debit: does an authorization exist, do its amount and date match the debit, and was the debit initiated inside the authorized window? Answering that for every loan is the test. The rate is only the summary.
How the automated version works
MightyBot is an AI agent platform for lending and finance. Agents check every debit against the authorization on file and the lender’s rules, written in plain English: the amount and date must match the authorization, re-presentments must stay inside what the borrower agreed to, and no debit may run before signature. Each finding cites the authorization page or the transaction behind it, and exceptions route to a person for approval before the next debit goes out.
The loan-level side is on the loan servicing page, and the industry view on the payments page.
