Nacha AAP (Accredited ACH Professional) Exam Guide 2026: Blueprint, 2026 Rules & Free Practice

Nacha AAP 2026: learn the decision behind the rule

The Accredited ACH Professional (AAP) exam tests ACH operations, rules, risk, file formatting and other payment systems. The 2026 testing window is October 5–31, with 120 multiple-choice questions in three hours. Twenty questions are unscored pilots. This guide is checked as of October 30, 2026: registration for this cycle has closed, although the testing window has not yet ended.

An AAP scenario usually turns on a small distinction: consumer versus business account, credit versus debit, authorization versus account validation, or Settlement Date versus statement date. Start with those facts before choosing a return code. Use the cases below alongside the AAP study guide and practice questions.

Exam dates, eligibility and the correct year's fees

Nacha's program policies specify 120 questions, including 20 pilots, and a September 25 final registration deadline for 2026. Late registration ran September 5–25 with an additional $50 charge. Nacha reports pass/no-pass; do not substitute a practice provider's target percentage for an official passing score.

Pearson VUE's AAP instructions confirm the October 5–31 window and three-hour duration. Register with Nacha first, obtain the Authorization to Test email, then schedule using its HumRRO ID. Bring the required government photo identification with signature and either the appointment confirmation or Authorization to Test. Buying a preparation course does not register you for the examination.

The official AAP page states a one-year payments-industry experience minimum, with a waiver route, and recommends two years. The program policies strongly encourage two years of ACH experience; that recommendation does not itself cancel the minimum. Candidates below one year should follow Nacha's waiver form, which requires a supervisor's or Payments Association representative's signature and submission to Nacha. A signature alone is not automatic permission to test.

Keep the fee year visible. Nacha's 2026 Event Matrix lists $600 for members and $725 for nonmembers. Applying the dated 2026 policy's $50 late surcharge gives:

These are brochure-based figures; use your actual registration confirmation for the amount charged or any group rate. Some preparation pages list a different nonmember base. The live fees-and-dates page now displays 2027, so its prices cannot verify a 2026 purchase. Never combine a base price from one cycle with another cycle's surcharge.

The five-domain blueprint and what to practice

Nacha's accreditation FAQ gives the following AAP weights. The practice tasks are our editorial interpretation of how to study each domain.

Operations plus rules total 67%; adding risk makes 87%. Those sums justify substantial practice in the first three domains, but do not predict an exact question count in your form. Pilot questions also prevent converting every percentage into a guaranteed number of scored items.

For each missed practice question, write five fields: party, account type, transaction direction, evidence and deadline. “R11” without the authorization facts is an incomplete answer. “Two days” without the starting event and the type of day is equally incomplete.

Choose the SEC code before the exception process

Use Nacha's SEC reference to distinguish the underlying payment application:

A code is not proof that the payment was authorized. For WEB debits, account validation applies before first use of an account number and after relevant account-number changes. It checks account validity; the minimum standard does not establish ownership or replace authorization. Do not extend that specific WEB-debit requirement indiscriminately to WEB credits.

Application case: a gym has an electronically authenticated debit authorization, but its customer supplies a new account number. Keeping the authorization record does not eliminate the validation step for the new WEB-debit account. Conversely, validating an open account does not authorize the gym to collect any amount it chooses. Treat authorization, account validity and fraud controls as separate questions.

For check conversion and RCK, consult the applicable source-document eligibility, notice, presentment and formatting rules. An RCK entry is not simply an ordinary ACH debit returned for insufficient funds and submitted again. Avoid transferring reinitiation instructions between these different workflows.

Returns, corrections and the two consumer clocks

First identify what went wrong. An RDFI return, a Notification of Change and an Originator reversal solve different problems.

• Return: sends an entry back for an applicable reason. Routine deadlines are short; an unauthorized corporate debit does not inherit a consumer extended-return period.
• Notification of Change: communicates corrected information for future entries. For the usual recurring-entry case, the Originator changes the data within six banking days after receiving the NOC or before the next entry, whichever is later. Prenotifications and specified single-entry applications have separate treatment. See Nacha's Originator Essentials.
• Reversal: corrects a qualifying sender error. It is not a general refund, a substitute for an expired return deadline, or a way to retrieve money deliberately sent to a fraudster. Nacha's reversal guidance describes the five-banking-day timing and required REVERSAL description.

Corporate case: an unauthorized CCD debit settles Monday. Assuming Tuesday and Wednesday are banking days, the normal R29 return must be available to the ODFI by opening of business Wednesday. Discovering the problem fourteen banking days later does not create a fresh two-day period. A permissible late CCD/CTX return using R31 requires ODFI agreement, as Nacha's return-code mapping confirms; it is not a unilateral extension or a consumer-debit remedy. Contractual or other recovery routes need separate evaluation.

Consumer case: a gym is authorized to collect $50 on the fifteenth, but collects $150 on the fifth. There is an existing authorization with an amount/date defect: R11, rather than “no relationship/no authorization” R10, communicates that distinction. Nacha's R11 explanation requires a Written Statement of Unauthorized Debit (WSUD) and provides the extended 60-day return timeframe. Revoked authorization and a stop-payment instruction are different facts, not interchangeable explanations.

That extended period is not permission to warehouse a completed claim. Nacha's May 2026 clarification explains the requirement to send the return within six banking days after completing review of the WSUD, alongside prompt recredit obligations. Apply the applicable outer return limit as well.

Regulation E uses another clock. Under 12 CFR 1005.11, qualifying notice generally arrives within 60 days after the institution sends the statement first showing the error. Investigation normally has a ten-business-day period; extending it to 45 days generally requires provisional credit, subject to the regulation's conditions and exceptions. Do not wait for a signed WSUD before beginning a required investigation.

Worked timeline: an entry settles on day 0, the first statement showing it is sent on day 20, and the consumer reports it on day 70. The report is 70 days after settlement but only 50 days after the statement. Missing a network return window does not, by itself, eliminate timely Regulation E duties. Nor does it automatically establish that the claimed error occurred. Investigate and evaluate recovery separately; do not relabel the consumer debit R31. Nacha explains these parallel responsibilities.

Apply the 2026 changes without importing 2027 rules

Fraud monitoring follows the participant's role

Phase 1, effective March 20, covered all ODFIs; nonconsumer Originators, TPSPs and TPSs with at least six million 2023 originations; and RDFIs with at least ten million 2023 receipts. Phase 2 covered the remaining affected parties on June 19, with June 22 as the practical date because June 19 was a federal holiday.

The rules require risk-based processes, relevant to each role, and at least annual review. They do not prescribe one vendor or universally require screening before posting. An RDFI's controls do not discharge an Originator's responsibilities.

Fraud case: a supplier-change email requests a new account for a large invoice. The employee genuinely approves the payment, but an impersonator supplied the account. Approval therefore does not rule out False Pretenses fraud. Independently verify the change through a trusted contact, assess anomalies and escalate concerns. A successful account-format check alone does not confirm that the supplier owns the destination.

Nacha's third-party definitions also matter. A TPS is a particular kind of TPSP, involving origination without a direct Originator–ODFI agreement. Map the contracts and services before deciding who has which obligations. Outsourcing processing does not make risk assessment, appropriate audits or oversight disappear.

Descriptions identify purpose, not every transaction in an SEC class

The March 20 description rule requires PAYROLL for applicable PPD compensation credits. PAYROLL occupies the leftmost seven characters; the final three may add descriptive information. For example, PAYROLL424 is permitted. Do not reject every suffix.

PURCHASE applies to consumer online purchases of tangible goods, including qualifying recurring purchases. These normally use WEB debits, with a standing-authorization TEL exception. It is not required merely because a utility or gym payment was authorized online. A monthly vitamin shipment and an online gym membership therefore need different purpose analysis.

Availability and Same Day eligibility are separate tests

Since September 18, 2026, non-Same Day ACH credits must be available for withdrawal by 9:00 a.m., RDFI local time, on Settlement Date. The former prior-day 5:00 p.m. receipt condition was removed.

Availability case: a non-Same Day payroll credit reaches the RDFI after 5:00 p.m. the previous banking day. That late receipt no longer postpones the stated 9:00 a.m. deadline. The rule does not mean every ACH debit or Same Day credit has the same availability requirement.

The current Same Day ACH limit remains $1 million per entry. The approved increase to $10 million takes effect September 17, 2027. Thus a $1.2 million payment does not qualify in October 2026 merely because the increase has been announced. IAT remains ineligible; bank deadlines and other eligibility requirements still matter.

Reconcile a file instead of memorizing its appearance

Nacha's file overview describes 94-character records: 1 opens a file, 5 opens a batch, 6 carries an entry, 7 carries addenda, 8 closes a batch and 9 closes a file. Padding rows of nines complete the blocking factor of ten when necessary. A padding row is not another payment.

For the batch Entry Hash, add the eight-digit Receiving DFI Identification values, excluding routing check digits. Retain the rightmost ten digits if necessary and zero-pad a shorter result. The file hash combines batch hashes. The field specifications distinguish these controls from dollar totals and entry/addenda counts.

Worked hash: three fictional entry fields are 02100002, 01100001 and 12100024. Their sum is 15,300,027, so the ten-character field is 0015300027. Adding a $100 payment amount to that sum would mix unrelated controls. Adding an addenda record changes the entry/addenda count, not the routing hash.

Now test your interpretation: a matching hash does not prove that each account number, amount or authorization is correct. A reconciliation control can detect particular discrepancies while leaving others untouched. Investigate the mismatched field instead of treating one passing total as complete payment validation.

Risk and other rails: match the control to the exposure

A prefunded payroll file may reduce funding exposure while still paying the wrong people. Nacha's risk guidance distinguishes prefunding from exposure limits and fraud controls. Ask separately whether funds exist, the request is authentic, the payment is authorized and processing will occur correctly.

Know the return-monitoring benchmarks: 0.5% unauthorized, 3% administrative and 15% overall. Nacha's enforcement explanation distinguishes the unauthorized threshold from the administrative/overall inquiry levels; exceeding the latter is not automatically a Rules violation. Use the defined debit population and measurement period, not dollar volume. Its older code list must be read with the subsequent R11 change.

Arithmetic drill: using the permitted preceding-60-day method, an Originator has 100,000 debit entries originated and 400 qualifying unauthorized debit returns during that period. The rate is 400 ÷ 100,000 × 100 = 0.4%. Being below 0.5% does not prove there is no fraud or remove the need to investigate suspicious activity.

For Payment Systems, compare Fedwire's real-time gross settlement with ACH's batch processing. Fedwire handles time-critical credit transfers. FedNow and RTP provide instant payments; RTP is credit-push and operates continuously. Instant payment infrastructure is not Same Day ACH, and an ACH return code cannot simply be used on another rail.

An eight-week practice plan and renewal checklist

This is an editorial plan, not a required study duration or a claim about how long most candidates need.

1. Weeks 1–2: draw the Originator–ODFI–Operator–RDFI–Receiver flow; classify SEC applications and authorization evidence.
2. Weeks 3–4: solve returns, NOCs and reversals; maintain separate settlement, statement and notice clocks.
3. Week 5: test fraud, exposure and third-party responsibility decisions against the 2026 changes.
4. Week 6: reconcile sample files and compare other payment systems.
5. Week 7: do mixed timed practice, then explain why every distractor fails.
6. Week 8: revisit errors, verify your appointment requirements and review effective dates. Use the current official candidate materials to determine the exam's assigned references.

Use flashcards for retrieval and the cheat sheet for a final map; use questions to test application. If you can name a code but cannot identify which changed fact would change your answer, revisit the underlying rule.

After passing, AAP maintenance normally means 60 continuing education credits across five years, with no more than 20 counted from one year. File credits for the correct reporting year, normally by March 31 of the following year, and retain supporting records for at least three years. Retesting in the fourth or fifth year is another route under Nacha's policies. Plan renewal early rather than attempting to accumulate all 60 credits at the end.