If we receive an untimely ACH return (Unauthorized - R10), do we have any liability if we post the return to our customer's account instead of rejecting it by sending it back as R68?

That depends upon your deposit contract with the Originator.

Assuming that we (as the financial institution) originated this as a loan payment. As the ODFI, would the customer have any claim if we reversed an old payment (over a year ago) that was made and is now claimed as unauthorized? The payment in question was made from the account of the customer's ex, not of the customer.

I would kick it back as a late return. The other bank only has 60 days to return such an item.

I would prefer to kick it back, but I was asked by management if we would have any liability if we allowed the late return post. I haven't found any reference yet, but I was hoping I would so they'll let me return it.

Focus instead on the liability to you customer if you have the right to send it back, but fail to do so...

Why would you want to place the bank in the middle of a domestic dispute unnecessarily and send a customer into a past due status? Your management is on the wrong side of the fence.

Agreed. You have a deposit contract with your customer. You have no such contract with the other end of this mess (the ex). Since NACHA rules don't permit a late return using the ACH, you should let sleeping dogs lie.

The receiver (the ex) and the RDFI will have to take a warranty claim to the courts to get the funds back.