7.3 Unauthorized Consumer Returns: R05, R07, R10, R11 & The WSUD

7.3 Unauthorized Consumer Returns: R05, R07, R10, R11 & The WSUD

Core Principle: Consumer protection is the cornerstone of the ACH Network. Under Regulation E and the Nacha Operating Rules, consumers are shielded against unauthorized electronic debits through an Extended 60-Calendar-Day Return Window. However, to protect Originators and ODFIs from fraudulent customer claims, an RDFI cannot transmit an extended return without first securing a legally binding Written Statement of Unauthorized Debit (WSUD) executed under penalty of perjury.

---

1. The Extended 60-Calendar-Day Return Window

Under Nacha Operating Rules Subsection 3.8.2 (Extended Return Rule), an RDFI may return an unauthorized debit entry against a consumer account within an extended timeframe:

+---------------------------------------------------------------------------------------------------------+
|                                EXTENDED RETURN RULE TIMEFRAME FORMULA                                   |
+---------------------------------------------------------------------------------------------------------+
| The RDFI must transmit the Return Entry to its ACH Operator such that the return is made               |
| AVAILABLE TO THE ODFI NO LATER THAN OPENING OF BUSINESS ON THE BANKING DAY FOLLOWING THE SIXTIETH (60TH)|
| CALENDAR DAY after the original settlement date of the entry!                                           |
+---------------------------------------------------------------------------------------------------------+

Relationship with Regulation E Periodic Statement Rule

• Under Regulation E § 1005.11, a consumer has 60 calendar days from the transmittal date of the periodic account statement showing the unauthorized debit to notify the RDFI.
• Nacha Rules benchmark the return window directly to 60 calendar days from the original settlement date to establish a uniform, automated network cutoff for electronic ACH return routing.

---

2. Comprehensive Breakdown of Consumer Unauthorized R-Codes

+---------------------------------------------------------------------------------------------------------+
|                                CONSUMER UNAUTHORIZED RETURN CODES BREAKDOWN                              |
+---------------------------------------------------------------------------------------------------------+
| Code | Meaning                                 | Core Trigger Scenario / Distinction                   |
+------+-----------------------------------------+-------------------------------------------------------+
| R05  | Corporate SEC Code to Consumer Account  | CCD or CTX debit posted to a consumer account without  |
|      |                                         | specific consumer authorization.                      |
| R07  | Authorization Revoked by Customer       | Customer validly revoked authorization with Originator|
|      |                                         | but Originator debited anyway.                        |
| R10  | Customer Advises Unauthorized, Improper,| Zero authorization, bogus transaction, no notice given|
|      | Ineligible, or Notice Not Provided      | for check conversion. (Auth is VOID; NO re-initiation)|
| R11  | Customer Advises Entry Not in Accordance| Valid authorization exists, but error in execution:   |
|      | with the Terms of the Authorization     | wrong date or wrong amount. (Auth VALID; CAN fix/orig)|
+---------------------------------------------------------------------------------------------------------+

A. R05: Corporate SEC Code to Consumer Account

• Commercial SEC codes (such as CCD and CTX) are designed exclusively for business-to-business transactions and lack built-in Regulation E disclosures.
• If an Originator transmits a CCD or CTX debit against a consumer asset account without obtaining a valid consumer authorization, the RDFI may return the entry under the 60-day extended rule using R05.

B. R07: Authorization Revoked by Customer

• The consumer originally established a valid recurring debit authorization with the Originator.
• The consumer subsequently revoked that authorization directly with the Originator in accordance with the revocation procedures outlined in the agreement (e.g., providing written notice 15 days prior).
• The Originator ignores or fails to process the revocation and transmits the debit anyway. The consumer executes a WSUD confirming revocation, and the RDFI returns the item as R07.

C. R10 vs. R11: The Critical Operational Distinction

In 2020, Nacha implemented a landmark rule change that bifurcated consumer disputes into two distinct return codes to separate total lack of authorization from operational execution errors:

+---------------------------------------------------------------------------------------------------------+
|                                     R10 VS. R11 COMPARISON MATRIX                                       |
+---------------------------------------------------------------------------------------------------------+
| Dimension                   | R10 (Unauthorized / Ineligible)       | R11 (Error in Terms / Execution)        |
+-----------------------------+---------------------------------------+-----------------------------------------+
| Authorization Status        | ZERO AUTHORIZATION (Never authorized) | VALID AUTHORIZATION EXISTS              |
| Underlying Problem          | Fraud, identity theft, rogue debit,   | Debited EARLIER than authorized date;   |
|                             | ineligible check conversion (ARC/POP) | Debited for DIFFERENT amount than agreed|
| Legal Status of Auth        | Authorization is completely VOID      | Authorization REMAINS IN EFFECT         |
| Re-origination Permitted?   | STRICTLY PROHIBITED (Zero re-init)    | PERMITTED to re-originate with corrected|
|                             |                                       | date or amount WITHOUT new auth!        |
| WSUD Required?              | YES (Mandatory before return)         | YES (Mandatory before return)           |
+---------------------------------------------------------------------------------------------------------+

Why R11 Revolutionized ACH Exception Handling

• Prior to R11, all consumer disputes were returned as R10. If an Originator debited a customer on the 1st of the month instead of the agreed-upon 5th, or debited $150 instead of $105 due to a typo, the entry was returned R10. The Originator was legally barred from re-origination and had to track down the customer to sign a brand-new authorization form.
• Under R11, the RDFI confirms that the consumer has an ongoing relationship with the Originator, but disputes the specific timing or amount. Because the master authorization remains legally valid, the Originator is permitted to re-originate the entry with the corrected date or dollar amount without executing a new authorization agreement!

---

3. The Written Statement of Unauthorized Debit (WSUD)

Under Nacha Operating Rules Article Three, Section 3.12 (Written Statement of Unauthorized Debit), an RDFI cannot return an entry using R05, R07, R10, or R11 based solely on an informal phone call. The RDFI must obtain a formal WSUD.

+---------------------------------------------------------------------------------------------------------+
|                               MANDATORY ELEMENTS OF A COMPLIANT WSUD                                    |
+---------------------------------------------------------------------------------------------------------+
| 1. Sworn Declaration:       | Must state under PENALTY OF PERJURY that the debit was unauthorized,     |
|                             | revoked, executed on wrong date, or in an incorrect dollar amount.      |
| 2. Transaction Details:     | Identifies Receiver Name, Account #, Originator Name, Amount, & Date.    |
| 3. Execution Timing:        | Must be signed / authenticated ON OR BEFORE the date the return is sent. |
| 4. Permissible Formats:     | Physical paper with wet signature, or electronic signature (E-SIGN) via  |
|                             | secure authenticated online banking session / multi-factor portal.      |
+---------------------------------------------------------------------------------------------------------+

The 10-Banking-Day WSUD Copy Production Rule

• If an ODFI receives an extended unauthorized return (R05/R07/R10/R11), the ODFI has the legal right to inspect the consumer's sworn declaration.
• When the ODFI submits a written request to the RDFI for a copy of the WSUD, the RDFI must provide an accurate, legible copy of the completed WSUD to the ODFI within ten (10) banking days of receipt of the request.
• If the RDFI fails to produce the WSUD within 10 banking days, the ODFI may initiate a Dishonored Return (R68/R69) or pursue a formal Nacha Rule violation claim.

---

4. Nacha Unauthorized Return Rate Threshold (0.5%)

To safeguard consumer confidence and eliminate rogue billers from the ACH Network, Nacha enforces a strict, low-tolerance threshold for unauthorized returns.

+---------------------------------------------------------------------------------------------------------+
|                               UNAUTHORIZED RETURN RATE THRESHOLD: 0.5%                                  |
+---------------------------------------------------------------------------------------------------------+
| Formula:                                                                                                |
|                            (Count of R05 + R07 + R10 + R11 + R29)                                       |
|   Unauthorized Return Rate = ------------------------------------  x 100                                |
|                                 Total Debit Entries Originated                                          |
|                                                                                                         |
| Maximum Permissible Threshold: 0.5% (50 basis points / 1 out of every 200 debits)                       |
+---------------------------------------------------------------------------------------------------------+

Nacha Network Enforcement Hierarchy

• Exceeding the 0.5% Unauthorized Entry Return Rate Threshold triggers Nacha's request-and-reduction process. The ODFI must respond within 10 Banking Days with a plan, reduce the rate below 0.5% within 30 days, and maintain it below the threshold for 180 additional days.
• Failure to establish or implement the required plan can become a Class 2 Rules Violation under Appendix Nine; suspension is a potential Class 3 remedy, not an automatic response to the initial threshold breach.