What do ACH return codes mean, and which ones cost you most?

An ACH return code is the reason a customer's bank gives, such as R01 or R10, for sending an ACH payment back unpaid. It says why the payment failed and sets the bank's deadline to return it. Unauthorized returns cost US businesses the most, because they can arrive up to 60 days after settlement and can't be retried.

Return codes are set by the Nacha Operating Rules, which govern the US ACH network. The customer's bank, called the RDFI (receiving depository financial institution), picks the code, and your payment provider passes it back to you. Read the code before anyone works a failed payment, because it tells you whether the problem is money, account details or a dispute.

What are the most common ACH return codes?

Twelve codes cover the returns US businesses see most often. They fall into three groups, and each group needs a different fix.

Every code also counts toward Nacha's 15% overall return threshold. The 60-day deadline applies to consumer accounts, so an unauthorized return can arrive weeks after you've shipped the order, credited a wallet or paid out funds.

Which ACH return codes cost you the most?

Unauthorized returns cost the most, account data returns come second, and funding returns cost the least. Three things set that order: how late the return arrives, whether you can recover the money, and how strictly Nacha caps it.

1. Unauthorized returns (R05, R07, R10, R11, R29). On consumer accounts they arrive up to 60 days after settlement, and because the customer is disputing the payment, Nacha doesn't allow a retry. Nacha's tightest threshold applies too. An unauthorized return rate above 0.5% of your debits exposes your business to a Nacha inquiry through your bank.
2. Account data returns (R02, R03, R04). These arrive within two banking days, but the payment can never succeed as entered, whether the cause is a mistyped number or a closed account. Nacha's threshold for these administrative returns is 3%.
3. Funding returns (R01, R09). The account is real and the customer meant to pay, but the money wasn't there when the debit posted. A retry timed to the customer's next deposit often succeeds.

Nacha also caps all returns combined at 15% of debits, according to its Risk and Quality Rules fact sheet. The thresholds measure your business as the originator, so every return you prevent counts toward staying under all three.

How do you read return codes to fix the cause?

Each group points to a different broken step, so sort your returns by group before you change anything.

• Lots of R02, R03 and R04? Account details are going in unverified. Verifying the account when the customer connects it, instead of accepting typed-in numbers, removes most of these. We built Aerosync to do that at connection, and its direct bank connections reduce R03 and R04 returns caused by bad account data. Our guide to real-time bank account verification covers the methods.
• Lots of R01 and R09? Payments are going out against accounts without the funds. Check the available balance before submitting, and time any retry to when the customer's next deposit lands. Our guide on how to recover a failed bank payment covers the retry rules for each code.
• Rising R10 and R05? Either fraud is getting through or customers don't recognize the charge. Clear billing descriptors and explicit authorization records fix the second. For the first, score each payment for fraud risk before it settles. Since June 22, 2026, Nacha's fraud monitoring rules have required every non-consumer originator to run risk-based processes to spot fraudulent entries.

For a broader playbook on preventing returns, see ACH returns: How to stop failed bank payments.

Frequently asked questions

How long does a bank have to return an ACH payment?

Two banking days after settlement for most returns. Unauthorized returns on consumer accounts, such as R10 and R11, have a 60-calendar-day deadline. Business accounts get no extended window: an unauthorized return on one comes back as R29 within two banking days.

What is the difference between a return code and a notification of change?

A return code means the payment failed and the money came back. A notification of change, which uses C codes like C01, means the payment posted but the bank corrected the account details. In most cases, Nacha requires you to update the details within six banking days or before your next payment, whichever is later.

Can a business challenge an R10 return?

Not by sending the payment again. For a consumer account, your bank can request the customer's written statement of unauthorized debit, and the customer's bank must provide it within 10 banking days. If the authorization holds up, you resolve the dispute with the customer directly, outside the ACH network.

The bottom line

ACH return codes tell you why a payment failed and how to stop it happening again. Funding returns are the easiest to recover, account data returns point to unverified accounts, and unauthorized returns cost the most because they arrive late and can't be retried. Verify accounts when customers connect them and check risk before settlement to cut all three.

Want fewer returns, and coverage on the ones that still happen? See how Aeropay Guaranteed ACH covers eligible returns, up to your agreed coverage limit.