We have a HELOC product in which a customer can access with a check, but the check has a loan number on it not a DDA number. Under NACHA rules, my understanding is that you cannot accept an ACH on a loan. Does this mean that it an ACH is received we must return it?

No. It means that you MAY return it. And, of course, you're concerned with debits here. This is a definite problem area because HELOC checks are not always distinguishable from "conventional" checks, and it's easy to see how they might be converted to POP or ARC (or RCK) ACH items.

Any of these ACH debits can be returned using the R20 return reason code (not a transaction account). They can also be returned as unauthorized if disputed by a customer in case you fail to catch them.

Under NACHA rules you can't debit a loan account using the ACH network, unless it is a reversal of a credit previously sent through. Can't you set up a checking account that sweeps the funds when needed and then just use a checking account number to avoid the hassle??