handle ACH returns: NACHA return codes, timing windows, and retry rules

Verified steps

1. Subscribe to your ACH processor's or sponsor bank's return webhooks or poll the returns endpoint daily; every returned ACH entry arrives with an R-code, the original transaction details, and the return effective date.
2. Classify the return by R-code: administrative returns (R02 account closed, R03 no account, R04 invalid account number) indicate a permanent account problem and should not be retried; authorization returns (R05, R07, R10, R29) indicate the debit was unauthorized and require immediate action; soft returns (R01 insufficient funds, R09 uncollected funds) may be retried within NACHA rules.
3. For R01 (insufficient funds) and R09, NACHA allows a maximum of two retries of the original entry; the retry must occur within 180 days of the original settlement date and must be for the same amount.
4. For R07 (authorization revoked) and R10 (customer advises not authorized), do not retry and initiate your dispute or fraud review process immediately; these can escalate to ODFIs.
5. Update your internal records promptly: reverse any ledger credits or debits associated with the returned entry, notify the affected customer, and flag the bank account appropriately.
6. Maintain a return rate dashboard; NACHA monitors return rates by R-code category — exceeding thresholds (e.g., >0.5% for unauthorized returns) can result in your ODFI restricting your ACH access.