ACH Operations

Prerequisites

Before managing ACH operations, understand:

• Payment methods - bank transfers basics
• Settlement and reconciliation timing
• ACH return codes reference
• Fraud prevention for bank payments

ACH is not cards. The rules are different, the timing is different, and the failure modes are different.

The big difference: ACH transactions settle before you know if they'll stick. A card authorization tells you instantly if the funds are available. An ACH debit can return days later, after you've already shipped the product or provided the service.

If You're Under $1M/Year on ACH

Start with account verification on new customers and ignore risk scoring for now. Your volume doesn't justify the cost or complexity of Plaid Signal or similar tools.

The Big Four Return Codes

These are the returns you'll see 90%+ of the time:

Code	Name	What It Really Means	Your Exposure
R01	Insufficient Funds	Account is empty or overdrawn	Retry in a few days, might work
R02	Account Closed	Account no longer exists	Don't retry, get new payment method
R03	No Account/Unable to Locate	Account number is wrong	Data entry error, verify with customer
R10	Customer Advises Unauthorized	Customer told their bank they didn't authorize this	This is the ACH version of a chargeback

R10 is the scary one. It means the customer went to their bank and said "I didn't authorize this." Even if they did authorize it, you now have a dispute on your hands and potential issues with your ACH provider.

Less Common But Important

Code	Name	When You'll See It
R05	Unauthorized Consumer Debit	Business account debited as consumer
R07	Authorization Revoked	Customer cancelled their authorization
R08	Payment Stopped	Customer put a stop payment on this specific transaction
R09	Uncollected Funds	Funds exist but aren't available yet
R29	Corporate Customer Advises Not Authorized	R10 equivalent for business accounts

See ACH Return Codes for the complete list.

Nacha Thresholds

Your bank or processor will usually warn you before Nacha does, but they're reacting to the same numbers:

Metric	Target	Yellow Flag	Red Flag
Overall return rate	Under 1%	1-3%	Over 3%
R01 rate	Under 0.5%	0.5-1%	Over 1%
R10 rate	Under 0.1%	Any pattern	Any pattern

R10s are different. One R10 might be a confused customer. Three R10s in a month is a pattern your processor will notice. Five and you'll get a call.

Verification Stack

From cheapest to most expensive:

1. Micro-deposits (Cheapest, Slowest)

Send two small deposits (usually $0.01-$0.99), customer confirms the amounts.

Good for: Low-risk recurring payments where you can wait 2-3 days Bad for: Anything time-sensitive, high-value first transactions Cost: Pennies per verification

2. Instant Account Verification

Connect to customer's bank via Plaid, Stripe Financial Connections, Finicity, or MX. Verify account ownership instantly.

Good for: Most ecommerce and subscription businesses Bad for: Customers who won't connect their bank (some demographics resist this) Cost: $0.50-2.00 per verification

3. Balance Check

Same connection as above, but also check current balance.

Where this breaks: Balance checks are a snapshot, not a promise. The customer can drain the account between your check and the debit. Useful for flagging obviously-empty accounts, not for guaranteeing payment.

4. Risk Scoring (Plaid Signal, etc.)

ML-based scoring using account history, balance patterns, identity signals.

Good for: High-value transactions, lending, insurance premiums Bad for: Low-value transactions where the cost doesn't justify the risk reduction Cost: $1-5+ per transaction

Volume-Tiered Recommendations

Under $100K/year ACH:

• Micro-deposits for new customers
• Manual review of any R01s before retry
• That's it

$100K-$1M/year:

• Instant account verification for all new customers
• Basic balance check for transactions over $500
• Track your R01 rate weekly

$1M-$10M/year:

• Plaid (Auth + Balance) or equivalent
• Consider Plaid Signal for high-value transactions
• Automated retry logic for R01s
• R10 investigation workflow

Over $10M/year:

• Full verification stack
• Risk scoring on all transactions
• Dedicated ACH operations monitoring
• Direct Nacha membership consideration

Experiment to Run: Balance Check ROI

Hypothesis: Balance checks will reduce R01 returns enough to justify the cost.

Test: For 30 days, run balance checks only on first debits over $500. Compare R01 rates vs. segment with no checks.

Metrics: R01 rate, balance check cost, net savings

Decision rule: If (R01 reduction × average recovery cost) > balance check cost, keep it

Typical result: Balance checks have diminishing returns under $500. Test your own break-even.

Verification Tool Comparison

Tool	Coverage	Strength	Best For
Plaid (Auth, Identity, Balance, Signal)	Broadest	Most features, best known	Default choice for most
Stripe Financial Connections	Good	Tight Stripe integration	Already on Stripe
Finicity (Mastercard)	Good	Enterprise features	Large volume, need alternatives
MX	Strong in credit unions	CU coverage	Customers at credit unions

Honest take: Plaid has the most coverage and is the default for a reason. The others are worth evaluating if you're large enough to negotiate pricing or have specific coverage gaps.

Retry Logic for R01s

When you get an R01 (insufficient funds), don't immediately give up:

Timing matters:

• Retry 3-5 business days later
• If monthly payment, try around typical payday (1st, 15th)
• Max 2-3 retries before giving up

Don't retry:

• R02 (closed account) - Account is gone
• R03 (can't locate) - Wrong account number
• R10 (unauthorized) - They've disputed, stop trying

Handling R10s

An R10 is a claim of unauthorized transaction. Treat it seriously:

1. Stop all debits to that customer immediately
2. Pull the authorization records - Do you have signed ACH authorization?
3. Check for fraud signals - New customer? Changed bank details recently?
4. Respond to your processor within 24 hours if they ask

If you have clear authorization documentation and the customer is lying, you can dispute the R10. But it's an uphill battle and often not worth the effort for small amounts.

Where This Breaks

Balance checks don't prevent R01s: A customer can have $5,000 when you check and $0 when you debit. Balance is directional, not deterministic.

Weekend timing: ACH doesn't process on weekends or bank holidays. A debit initiated Friday might not settle until Tuesday, giving three days for the balance to change.

Business vs Consumer accounts: Different rules, different protections. Business accounts have fewer protections, which cuts both ways.

Same-day ACH limitations: Same-day ACH has dollar limits and cutoff times. Not all transactions qualify.

Next Steps

Setting up ACH operations?

1. Know the big four returns - R01, R02, R03, R10
2. Choose verification stack - Micro-deposits to risk scoring
3. Follow volume recommendations - Right-sized approach

Handling ACH returns?

1. Implement retry logic - When to retry R01s
2. Handle R10s properly - Unauthorized claims
3. Stay under Nacha thresholds - Target metrics

Choosing verification tools?

1. Compare verification options - Cost vs coverage
2. Evaluate tools - Plaid, Stripe, Finicity
3. Consider balance checks - Test ROI before committing

---

Related

• ACH Return Codes - Complete code reference
• Bank Transfers - ACH vs wire vs RTP
• Holds and Reserves - What happens when your ACH risk spikes
• Settlement & Reconciliation - When money moves
• Processor Management - Acquirer relationships
• Fraud Prevention - Prevention strategies
• Third-Party Fraud - Unauthorized transaction fraud
• Friendly Fraud - First-party dispute abuse
• Subscriptions & Recurring - Managing recurring ACH
• Payout Strategy - Settlement timing
• Regulation E - Consumer liability for EFT
• Operations Metrics - Tracking performance