Select the correct SEC code at origination: PPD (prearranged payment or deposit — consumer) for recurring debits with a signed authorization, WEB (internet-initiated debit) for authorizations obtained online, TEL (telephone-initiated) for verbal authorizations, and CCD (corporate credit or debit) for business-to-business
Obtain and retain the required authorization form for your SEC code: PPD requires a signed written authorization; WEB requires an electronic authorization with specific required fields; TEL requires a recorded verbal authorization or a written confirmation when the consumer has no existing relationship
For consumer PPD and WEB entries, NACHA rules permit the consumer to return the debit as unauthorized via R10 (customer advises not authorized) within a 60-calendar-day window from the settlement date
For WEB debits, apply the required commercially reasonable fraud detection screen on the account number before origination — NACHA requires this and auditors check for it
When you receive an R29 (corporate customer advises not authorized) on a CCD or CTX entry, treat it as a permanent stop — you must not re-originate without new written authorization from the receiver
Track your unauthorized return rate separately for each SEC code; exceeding NACHA's thresholds triggers a review by your ODFI and potentially a NACHA audit
Known gotchas
Using PPD for a transaction that was authorized online (where WEB is required) is a NACHA rules violation even if the consumer did authorize it; SEC code selection is a compliance matter, not just a labeling choice
The R10 window for PPD and WEB is 60 calendar days, but an R10 returned after this window is still a valid return under NACHA rules if the consumer claims the authorization was never valid — the RDFI has latitude to return outside the window in that circumstance
Re-originating after an R10 without new authorization exposes you to potential Reg E liability and NACHA sanctions; document the authorization refresh workflow and do not rely on the original authorization
Give your agent this knowledge — and 200+ more routes
One MCP install gives any agent live access to the full route map, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp