Customer opens an account with $250.
We receive an ACH into the account for $30,000
Customer withdraws $30,000
within 60 days Other bank gives us a notice that the original ACH is no good and wants money back.

Looks like we would be out the money in this instance. What controls should we have in place. My understanding is we cannot place a hold on suspicious ACH receipt

They want an ACH back. What are they smoking?

Was your bank the ODFI or the RDFI for the $30,000?

you have no obligation as the RDFI to accept or honor the request for the return of funds if they are no longer in the account. politely tell them funds are not available and have a nice day.

we were the receiving bank. can we after the fact return it, even if several days later?

if you want to return it, realize this is the bank's money you are sending back, as your customer already withdrew the $30,000, so there is nothing to take from the customer to return.

and speaking in very loose and general terms, if there were funds still in the account to cover the requested return, at a minimum you would want some form of indemnification letter from the ODFI that protects your bank when your customer comes after you for taking back a deposit in their account.