ACH Return Codes: What Each One Means

Short answer: an ACH return code is the two-character reason, from R01 to R85, that a customer's bank gives when it sends an ACH payment back. For an online store taking ACH debits, a handful of codes matter most: R01 (insufficient funds), R02, R03 and R04 (closed, missing or invalid account), and R10, R11, R05, R07 and R29 (unauthorized). Most returns arrive within 2 banking days of settlement; unauthorized consumer returns can arrive up to 60 calendar days later. Each code tells you whether you can retry, whether you need a new account, or whether you need to stop debiting that customer.

Key terms#

• Return: a settled ACH entry sent back by the receiving bank (the RDFI), with a reason code. The money is taken back from you.
• Originator: you, the business that starts the debit.
• SEC code: the code that says how the debit was authorized. Online consumer debits are WEB; business-to-business debits are often CCD.
• Return rate: returns divided by debits over the last 60 days or two calendar months, which Nacha and payment providers watch.

The codes an online store sees most#

Descriptions below follow Plaid's published ACH return code list; families follow Nacha's rate rules.

Nacha's unauthorized family is R05, R07, R10, R11, R29 and R51 (R11 was added on 1 April 2020). The administrative family is R02, R03 and R04. Everything counts toward the overall rate.

What the rest of the list covers#

Plaid's list runs to R85. Most of the other codes are technical or rare for a store:

• File and format errors: R17 (fields rejected), R18 (improper effective entry date), R19 (amount field error), R25 (addenda error), R26 (mandatory field error), R27 (trace number error), R28 (routing number check digit).
• Bank status: R12 (branch sold to another bank), R13 (invalid ACH routing number), R34 (limited participation bank).
• Account holder status: R14 (representative payee deceased) and R15 (beneficiary or account holder deceased).
• Credit-only codes: R23 (credit entry refused by receiver), for example a refund the customer's bank would not accept.
• Duplicates: R24 (duplicate entry).

If you use a processor or Plaid, these usually point to a setup problem rather than a customer problem. Contact your provider.

Return windows: why 60 days matters#

Plaid's documentation explains the two windows. Most returns, "including all R01 'insufficient funds' returns", must come back within 2 banking days of settlement. "However, for ACH returns in which the consumer alleges that the transaction was unauthorized, including return codes such as R10 or R11, the window is 60 calendar days."

The SEC code changes the window too. Plaid notes that consumer codes (WEB, TEL) allow unauthorized returns for up to 60 calendar days even if the debit went to a business account, and that debiting a consumer with the business code CCD can be returned for up to 60 days with R05.

In practice: if you ship two banking days after settlement, you are safe from R01 to R04, but not from R10 or R11.

What does it cost to ignore return codes?#

Return codes are an early warning system. Ignoring them costs you three ways.

1. Lost goods and fees. Each return reverses money you may already have spent or shipped against.
2. Return-rate limits. Nacha's levels are 0.5% for unauthorized returns, 3.0% for administrative returns and 15.0% overall. Nacha says going above the administrative or overall level starts an inquiry rather than being an automatic violation. Payment providers can be stricter: Plaid's limits for Plaid Transfer are 0.4% unauthorized, 2.5% administrative and 12% overall over 60 days, and Plaid says failing to bring rates down within three months "may result in a fine" and could lead to losing access.
3. Fraud monitoring duties. Since Nacha's Phase 2 fraud monitoring rule (19 June 2026, in practice 22 June) every business that originates ACH debits must run risk-based processes to spot fraudulent entries and review them at least once a year. A rising R10 count is exactly what those processes should catch.

The rate maths is covered step by step in Nacha return rate thresholds, and the monitoring rule in Nacha fraud monitoring rule 2026.

A worked example: one month of returns#

A store sends 1,000 WEB debits in the 60 days to 31 October. In the same period it receives these returns:

Using Nacha's first method (returns divided by debits originated in the same 60 days):

• Unauthorized: (4 + 2) ÷ 1,000 = 0.6%. That is above Nacha's 0.5% level and Plaid Transfer's 0.4% limit. This is the number to fix first.
• Administrative: (9 + 6) ÷ 1,000 = 1.5%. Below 3.0%, but every one of those 15 was avoidable with account validation.
• Overall: 43 ÷ 1,000 = 4.3%. Well below 15%.

The R10 and R11 returns point to the checkout wording and the statement description. The R03 and R04 returns point to typed account numbers without validation. R01 is mostly timing and balance.

How to handle a return, step by step#

1. Read the code first, not just the amount. It tells you who has to act.
2. Pause fulfilment for that order or membership until it is resolved.
3. For R01 or R09, wait for the customer's next likely payday, then retry. Plaid requires a retry to be labelled "Retry 1" or "Retry 2" and allows no more than two.
4. For R02, R03, R04, R16 or R20, email the customer and ask them to link or enter a different account. Do not retry the same one.
5. For R07, R10 or R11, stop all future debits to that account. Check what the customer agreed to, the amount and the date. Keep your proof of authorization.
6. For R29, ask the business customer to tell its bank to allow debits from your company.
7. Log every return by code and look at the 60-day trend each month, split into unauthorized, administrative and overall.

How to prevent the most common returns#

How ChargeWarden and BankBridge help#

For stores that take ACH debits with BankBridge and Plaid Transfer, ChargeWarden reads every entry and every return. It shows rolling 60-day unauthorized, administrative and overall return rates against Nacha's 0.5%, 3% and 15% levels, and emails you as a rate gets close. It records how each WEB debit account was validated through Plaid when the debit was created, and flags first-use accounts with no record. A monthly PDF and CSV report lists volumes, return rates and returns by code, which you can share with your bank. The report supports your own risk-based process; it is not a certification, and your bank calculates the official rates.

On the BankBridge side, Plaid's bank login, balance check and Signal return-risk score stop many R01 to R04 returns before the debit is sent.

See the ACH monitoring doc, look around the live demo, or get ChargeWarden.

This guide is general information, not legal advice. Nacha's own Return Reason Code Guide is a paid booklet; descriptions here follow Plaid's public list and Nacha's public rule pages, checked 24 October 2026.