The product needs a different release rule. ACH returns, bank-account claims and sponsor recourse can survive settlement. Ordinary supplier payouts should follow an approved release calendar and reconciled return reporting. Any earlier payment should use separately approved funding, with an enforceable allocation of the remaining exposure.
First establish the account type, contractual roles and complete international payment route. Then distinguish a network return from an authorisation-warranty claim, an account-law remedy and a contractual reserve charge. Each has its own conditions and consequences.
The recommended model combines conditional payout availability, documented debit authority and reserves sized to the exposure actually retained. An accelerated payout is a funding decision. The Colombian collection, financing and foreign-exchange route must support that decision before the product promises it.
Identify the Originator and the international payment
The US customer is the Receiver of the ACH debit, even though it supplies the money. Its bank is the Receiving Depository Financial Institution, or RDFI. The originating bank is the Originating Depository Financial Institution, or ODFI. A sponsor is the ODFI only if it actually performs that role.
The Originator is the party initiating the entry under its arrangement with the Receiver. A fintech transmitting entries for another Originator without that Originator's direct agreement with the ODFI can be a Third-Party Sender. A provider performing processing functions can instead be a Third-Party Service Provider. A Third-Party Sender is a particular type of service provider; the categories are not interchangeable. Record every intermediary, including any nested sender. (Nacha, Third Parties in the ACH Network; ACH Guide for Developers, “How ACH Works”.)
The supplier is not automatically the Originator because it issued the invoice. Nor does an agency label settle the fintech's role. Match the customer authorisation, origination agreement, bank agreement and funds flow.
Next determine the Standard Entry Class, or SEC. CCD and CTX are corporate formats; WEB is not the default merely because a business authorised payment online. Account purpose and payment structure matter. (Nacha, ACH Guide for Developers, “Corporate Transaction Types” and “Consumer Transaction Types”.)
For this cross-border collection, investigate International ACH Transaction, or IAT, classification before approving a domestic format. The definition effective 18 September 2026 addresses the US ACH component of an international payment involving a foreign financial agency's account or facilities. Splitting collection and Colombian disbursement between accounts, payment methods or processing stages does not necessarily remove that connection. Nacha's Scenario H expressly addresses intermediary collection followed by foreign payment. (Nacha Operating Rules, art. Eight, §8.55; Nacha, IAT Scenario H: Money Transmitters/Third-Party Service Providers.)
The fintech's nationality alone does not decide IAT status. Require the ODFI to approve the complete route, required party data and any Gateway role. IAT entries are ineligible for Same Day ACH. That restriction must shape the payment promise. (Nacha, Definition of IAT Entries, effective 18 September 2026.)
Separate settlement from the available claims
Settlement records an interbank transfer. It does not answer whether the payer authorised the debit or whether the fintech owes its sponsor reimbursement. For FedACH, Operating Circular 4 expressly preserves debit-return machinery alongside settlement and funds availability. Its credit-item finality provisions should not be applied indiscriminately to debit collections. (Federal Reserve Banks, Operating Circular 4, effective 5 January 2026, §§10.2, 11.1–11.2 and 14.1.)
There is no single ACH returns time frame that ends every exposure. For ordinary unauthorised domestic CCD or CTX debits to non-consumer accounts, Nacha describes the return deadline as availability to the ODFI by opening of business on the second Banking Day following settlement. Separately, its authorisation-warranty rule allows an RDFI claim against an ODFI for a non-consumer entry for one year from settlement. The latter is a different claim, not an extension of the ordinary return deadline. (Nacha, Limitation on Warranty Claims, effective 30 June 2021, “Details” and FAQs.)
International entries require a separate analysis. The recredit provisions include qualifying unauthorised IAT debits to non-consumer accounts, subject to their conditions and waiver rules. Do not approve a two-day release calendar for an IAT programme merely because the payer is a company. Confirm the applicable return, recredit and exception provisions with the ODFI. (Nacha Operating Rules, §3.11, existing text reproduced in Nacha, First-Party Fraud Topics: RDFI Obligation to Recredit Receiver, proposed modifications, 8 October 2026.)
A one-year warranty period does not establish a mandatory one-year supplier hold or extinguish every other claim after a year. The sponsor agreement may allocate exposure differently. Calculate operational deadlines using the ACH operator's Banking Days, reporting cut-offs and the sponsor's delivery schedule. (Nacha, Minor Topics Rule Changes, effective 1 January 2026, amendment to §8.15.)
Apply the law of the actual bank account
Regulation E generally protects a natural person's account established primarily for personal, family or household purposes. A genuine company business account falls outside that definition. A business invoice alone does not establish the purpose of the account being debited. (12 C.F.R. §§1005.2(b)(1), 1005.2(e) and 1005.3(a).)
Where Regulation E applies, its ordinary error-notice period runs from the institution's transmission of the statement first showing the error. That 60-day clock is not measured from ACH settlement. Consumer network rules and federal account-law protections require separate treatment. A product limited to business accounts needs an exception process when onboarding evidence contradicts that classification. (12 C.F.R. §1005.11(b)(1)(i).)
For commercial accounts, identify the governing state's law and the account agreement. Uniform Commercial Code Article 4A does not automatically govern a payee-initiated debit. New York's definition, for example, requires the receiving bank to obtain reimbursement from the sender; a credit transfer and a debit collection need separate characterisation. Article 4, contractual notice duties and other account-law remedies also require their own applicability analysis. (N.Y. U.C.C. §§4-A-103(1)(a)(ii), 4-103, 4-104, 4-401 and 4-406.)
The Single Euro Payments Area direct-debit analysis addresses a different mandate and refund framework. Its timelines should not be imported into a US commercial collection product.
Trace the reserve debit before allocating the loss
Obtain the original entry, settlement date, SEC, return code, bank notices and claim correspondence. Establish whether the sponsor acted on a timely return, a separate warranty demand, another bank claim or its own contractual reserve power. A customer's complaint alone does not identify the applicable remedy.
The ODFI's network obligation and the sponsor's right against the fintech are separate questions. Check the sponsor agreement and applicable law for authority to impose the reserve charge. Check the covered liability, evidence requirements, notice, challenge procedure and any duty to pursue or credit recoveries. The charge may determine who funds the dispute immediately without settling who ultimately bears it.
The fintech's recovery from the supplier then depends on their agreement and the legal character of the payout. An advance with recourse, a non-recourse receivable purchase and a provisional release of collected money produce different results. Supplier misconduct, defective invoice rights and missing debit authority also require separate treatment.
An invoice can remain payable after an unauthorised debit is returned. Conversely, proof that goods were delivered does not establish authority to debit a particular bank account. Identify the creditor entitled to pursue the invoice, respect any defences, and credit every recovery against the same loss. Do not make the supplier reimburse a loss twice.
Use a permitted route from the US into Colombia
Classify the underlying invoices as goods or services. Colombian residents' goods-export proceeds are subject to mandatory foreign-exchange channelling. Service-export payments have a different framework, including voluntary channelling through an authorised foreign-exchange intermediary, or IMC. Associated borrowing can trigger separate requirements. (Banco de la República, Resolución Externa 1 de 2018, arts. 41(1)–(2) and 74; Circular Reglamentaria Externa DCIP-83, §10.10.)
For goods, a qualifying resident payment aggregator has a specific IMC collection route and reporting duties. It can also agree delivery to the exporter's compensation account. The fintech must actually qualify for that role. Its own compensation account is not a general collection account for other exporters' transactions. (DCIP-83, §§4.6.1 and 8.1; Decreto 2555 de 2010, art. 2.17.1.1.1(3).)
Early payment also needs a legal funding structure. A loan, collection mandate and purchase of an export receivable are different operations. The foreign-currency export-instrument rules identify authorised IMCs and non-resident purchasers; they do not establish unrestricted purchasing rights for every Colombian fintech. (Resolución Externa 1 de 2018, art. 79; DCIP-83, §4.4.)
A US reserve debit is not automatically an export refund. Classify each resulting payment and apply any declaration requirements for its actual legal character. Nor should broad set-off language automatically divert unrelated goods-export proceeds to a sponsor loss. The foreign-trade restriction on set-off must be distinguished from permitted export expenses and documented discounts. (DCIP-83, ch. 4 opening provisions, §§4.5 and 10.11; Resolución Externa 1 de 2018, art. 78.)
US sponsorship also needs a separate permissions analysis. The federal payment-processor exclusion is conditional; both collection and disbursement matter. State money-transmission requirements and exclusions remain distinct. An ACH collection leg alone establishes neither federal eligibility nor nationwide authority. (31 C.F.R. §1010.100(ff)(5)(ii)(B); FinCEN, FIN-2014-R009; for a state example, N.Y. Banking Law §641(1).)
Align the three contracts
The sponsor, customer and supplier documents should describe the same transaction and allocate each risk expressly. Use the following changes as negotiating instructions, subject to the chosen law and actual structure.
Sponsor agreement. Define settlement, available balance, permitted payout and residual recourse separately. Specify reserve ownership, funding source, calculation, increases, eligible charges, evidence and notice. Include dispute handling, recovery credits, release of undisputed amounts and post-termination release criteria. Allocate losses caused by the sponsor's own breach as well as losses passed through from the network. These issues belong in payment processor selection, before commercial terms lock in the operating model.
Customer authorisation. Identify the authorised Originator, account, amount or agreed calculation, timing and scope of future debits. Verify the signer's authority for the account holder. Keep a durable authorisation and its change or revocation history. Written evidence is a prudent programme condition; do not present it as a universal statutory formality for every business debit. (Nacha, Meaningful Modernization, effective 17 September 2021, non-consumer authorisation clarification.)
Supplier agreement. State whether payout releases collections, creates an advance or purchases a receivable. Define recourse triggers, defences, notice, repayment currency, exchange-rate treatment, fees and security. Allocate responsibility for invoice rights and collection authority. Preserve a recovery ledger and limit set-off to legally available funds. If the fintech purchases invoices, verify assignment and applicable title formalities rather than treating an invoice upload as sufficient transfer evidence.
Implement a release and evidence policy
The operating policy should assign a decision owner and retain the evidence used for each release:
- Legal and compliance approve the route. Record each party's role, account classification, SEC decision, permissions, Colombian channel and contractual allocation. Resolve IAT treatment before accepting a domestic-format assumption.
- Onboarding verifies authority. Retain account-holder identity, business-account evidence, signer authority, authorisation version, consent record and invoice linkage. Account validation alone does not prove authorisation.
- Payment operations reconcile the entry. Preserve entry and trace identifiers, submission and settlement records, return files, notifications and bank correspondence. The evidence must connect the debit, reserve movement and supplier payout.
- Treasury authorises release. For ordinary payouts, require expiry of the applicable initial return period, reconciled sponsor reporting, no unresolved exception and sufficient agreed liquidity. Carry remaining warranty and contractual exposure separately. Fund earlier payouts only through the approved advance structure and exposure limit.
- Disputes staff control subsequent action. Suspend further debits where authority is absent or revoked. Assess correction or reinitiation under the actual return code, authorisation and current rules. Never change identifiers, dates or transaction splitting to evade a restriction. Keep invoice recovery separate from permission to debit again. (Nacha, ACH Network Risk and Enforcement Topics, Reinitiation FAQs; Differentiating Unauthorized Return Reasons, R11 FAQs.)
Retention and response deadlines should follow the applicable rule, contract and law. The sponsor should specify these requirements in the operating schedule, with an internal retrieval deadline that leaves time to respond.
Nacha's 2026 fraud-monitoring requirements also cover relevant non-consumer Originators, Third-Party Senders and service providers, with risk-based procedures and at least annual review. They do not prescribe one universal reserve percentage or payout delay. Set those commercial controls using documented exposure, concentration and recovery assumptions. (Nacha, Risk Management Topics: Fraud Monitoring, Phase 2, effective 19 June 2026; practical implementation 22 June 2026.)
Launch the payment promise the funding supports
Delaying payout reduces the amount advanced while initial returns remain possible, but leaves other exposure to manage. Faster payment requires capital and an agreed allocation of the remaining risk. Asking the payer to send a credit transfer changes initiation and applicable protections; it still needs its own fraud, recall and legal assessment.
Approve the funds flow and account classification first. Complete the sponsor schedule and matching supplier terms next. Then test a disputed collection through return reporting, reserve charging, evidence production, recovery and Colombian reconciliation. Publish payout timing only after those steps work together, with product labels that distinguish settlement from availability and remaining recourse.
Review your US collection programme
Review the legal risk allocation in your collection programme with Licentium.