ACH Operations
35%of exam
Rules & Regulations
32%of exam
Risk Management
20%of exam
Exposure LimitsTPS Registration2026 Fraud RulesAccount ValidationData SecurityMicro-Entries
ACH File Formatting
8%of exam
Record TypesEntry DetailAddenda RecordsEntry Hash
Other Payment Systems
5%of exam
Quick Facts
- Exam
- AAP
- Credential
- Accredited ACH Professional
- Format
- 120 MC, 100 scored
- Time
- 3 hours
- Pass
- Pass/no pass only
- 2026 Window
- Oct 5-31, 2026
- Fee
- $600 member / $700 nonmember
- Renewal
- 60 CE credits / 5 years
SEC Code Families
Consumer, business, check-conversion, or cross-border
PPD, WEB, TEL: consumer debitsCCD, CTX: business entriesARC, BOC, POP: check conversionRCK, XCK: check collection fixesIAT: crosses a border
ODFI vs RDFI
ODFI
- Originator's bank
- Warrants each entry
- Sets exposure limits
RDFI
- Receiver's bank
- Posts and returns entries
- Sends NOCs
Sends entries vs receives entries
SEC Code Picker
- Recurring consumer debit, written auth→PPD(Signed or similar auth)
- Online or mobile consumer debit→WEB(Covers all P2P credits)
- Phone-authorized consumer debit→TEL(Record it or send notice)
- B2B payment, one addenda→CCD(1 addenda record max)
- B2B payment, full remittance→CTX(Up to 9999 addenda)
- Cross-border payment leg→IAT(7 mandatory addenda records)
- Paper check at point of sale→POP(Void and return the check)
- Mailed bill-pay check received→ARC(Notice to the check writer)
ACH Participants
- Originator
- Initiates entry via ODFI agreement
- ODFI
- Originator's bank; warrants entries
- RDFI
- Receiver's bank; posts and returns
- Receiver
- Authorizes debit/credit to account
- ACH Operator
- Switches entries; FedACH or EPN
- Third-Party Sender (TPS)
- Holds ODFI agreement for Originators
Return Timing Windows
2 days routine; 60 days unauthorized
R01/R02/R03/R04: 2-day windowR05/R07/R10/R11: 60-day windowR29: business claim, still 2-daySigned WSUD unlocks the 60-day window
PPD vs CCD
PPD
- Consumer account
- Payroll, bills, deposits
- Written consumer authorization
CCD
- Business account
- Vendor or payroll funding
- 1 addenda record max
Consumer vs business account
Return Code Picker
- Account has insufficient funds→R01(2 banking days)
- Account is closed→R02(2 banking days)
- Consumer says never authorized→R10(60 days, needs WSUD)
- Consumer revoked their authorization→R07(60 calendar days)
- Business account, unauthorized debit→R29(2 banking days, no Reg E)
- Customer placed a stop payment→R08(2 banking days)
Consumer SEC Codes
- PPD
- Prearranged consumer debit/credit, written auth
- WEB
- Internet/wireless debit; all P2P credits
- TEL
- Phone-authorized debit; record or notice
- CIE
- Consumer-pushed credit to business
- MTE
- ATM-initiated consumer terminal entry
2-Day vs 60-Day Returns
2-Day Codes
- R01, R02, R03, R04
- Administrative or funds issue
60-Day Codes
- R05, R07, R10, R11
- Unauthorized or revoked, needs WSUD
Routine error vs authorization dispute
Business & Check SEC Codes
- CCD
- B2B entry; 1 addenda max
- CTX
- B2B remittance; up to 9999 addenda
- IAT
- Cross-border leg; 7 mandatory addenda
- ARC
- Mailed bill-pay check conversion
- BOC
- Back-office check conversion
- POP
- Point-of-purchase check conversion
- RCK
- Re-presents NSF check under $2,500
- XCK
- Collects a lost or destroyed check
NOC vs Reversal
NOC
- Fixes wrong data
- 6 banking days to act
- RDFI initiates it
Reversal
- Fixes a wrong entry
- 5 banking days limit
- Originator or ODFI initiates
Correct info vs correct entry
Same Day ACH
- 2026 limit
- $1,000,000 per entry
- 2027 limit
- $10,000,000 effective Sept 17, 2027
- IAT entries
- Not eligible for Same Day ACH
- Settlement
- 3 processing windows per day
- Cutoffs
- Set by each ACH Operator
2-Banking-Day Return Codes
- R01
- Insufficient funds (NSF)
- R02
- Account closed
- R03
- No account/unable to locate
- R04
- Invalid account number structure
- R08
- Payment stopped by customer
- R09
- Uncollected funds
- R29
- Corporate customer advises not authorized
60-Calendar-Day Return Codes
- R05
- Unauthorized debit via business SEC code
- R07
- Authorization revoked by customer
- R10
- Receiver says debit not authorized
- R11
- Entry violates authorization terms (2020+)
NOC & Reversal Rules
- NOC purpose
- RDFI flags wrong entry data
- NOC action window
- 6 banking days or next entry
- Refused NOC
- ODFI corrects a bad NOC
- Reversal window
- 5 banking days after settlement
- Reversal label
- Description must say REVERSAL
- Bad reversal return
- R11 consumer; R17 otherwise
Rules Framework
- Nacha's role
- Private rule-maker, not a regulator
- ODFI warranty
- Entry is authorized and compliant
- Rule adoption
- Member ballot approves each change
- Payments Association
- Education and audits, not enforcement
Compliance & Enforcement
- Annual audit
- Due by Dec 31 each year
- Audit records
- Keep proof for 6 years
- Enforcement Panel
- Classifies Egregious Violations
- Egregious threshold
- 500+ entries or $500k+
- Class 3 sanction
- Up to $500,000 per occurrence
Regulation E & UCC 4A
- Reg E timeline
- 10-20 business days to decide
- Reg E extension
- 45-90 days if credited first
- Liability tiers
- $50 within 2 days; $500 later
- Business debit dispute
- No Reg E; use R29
- UCC Article 4A
- Covers non-EFTA ACH credits
BSA, OFAC & Gov't Rules
- BSA/AML
- Federal duty, not Nacha-made
- OFAC screening
- ODFI screens Originator; RDFI Receiver
- 31 CFR Part 210
- Governs federal ACH payments
- 31 CFR Part 212
- Protects 2 months of benefits
2026 Risk Rule Phases
Phase 1 March 20; Phase 2 June 22
Phase 1: ODFIs plus big volumePhase 2: everyone, no thresholdRDFI credit monitoring mirrors thisPAYROLL/PURCHASE labels start Phase 1
TPS vs TPSP
Third-Party Sender
- Holds the ODFI agreement
- Performs ODFI's warranties
Third-Party Service Provider
- No ODFI agreement itself
- Just builds or sends files
Holds agreement vs just processes
ODFI Risk Controls
- Exposure limit
- Set, monitored, and reviewed
- TPS registration
- ODFI registers TPS within 30 days
- Nested TPS
- Flagged in Risk Mgmt Portal
- ODFI duty
- Underwrite and monitor Originators
2026 Fraud Monitoring Rules
- Phase 1 date
- March 20, 2026
- Phase 1 scope
- ODFIs plus big Originators and TPSs
- RDFI Phase 1
- 10M-receipt RDFIs by Mar 20
- Phase 2 date
- June 19, practically June 22
- False Pretenses
- Fake identity or authority claim
- New descriptions
- PAYROLL and PURCHASE required
Account & Data Security
- WEB validation rule
- Effective March 19, 2021
- Micro-Entries defined
- Credits under $1, since 2022
- Micro-Entry fraud check
- Required since March 17, 2023
- Data security rule
- Encrypt, truncate, or tokenize numbers
ACH File Record Hierarchy
1 File, 5 Batch, 6 Entry, 7 Addenda
1: File Header5: Company/Batch Header6: Entry Detail7: Addenda, optional8: Batch Control9: File Control
ACH Record Types
- Type 1
- File Header
- Type 5
- Company/Batch Header
- Type 6
- Entry Detail
- Type 7
- Addenda (optional)
- Type 8
- Batch Control
- Type 9
- File Control
File Field Details
- Record length
- 94 characters, fixed format
- Entry hash
- Sum of routing numbers, rightmost 10
- Trace number
- Tracks one specific entry
- IAT addenda
- 7 mandatory records always
Fedwire vs CHIPS
Fedwire
- True RTGS
- Settles instantly, individually
- Fed guarantees the payment
CHIPS
- Continuous net settlement
- Uses prefunded balances
- Not RTGS
Gross settlement vs net settlement
Payment Rail Picker
- Need RTGS finality right now→Fedwire(Central-bank money)
- Large USD, want liquidity savings→CHIPS(Netted, not RTGS)
- Need instant 24-hour push credit→RTP or FedNow(Seconds, no ACH batch)
- Batch many debits and credits→ACH(Scheduled settlement windows)
Fedwire & CHIPS
- Fedwire
- RTGS; settles each wire now
- CHIPS
- Nets continuously, not RTGS
- Both rails
- Credit-only, UCC 4A governed
- CHIPS funding
- Uses prefunded participant balances
RTP/FedNow vs ACH
RTP/FedNow
- Instant, 24/7 settlement
- Credit-push only
- Up to $10M each
ACH
- Scheduled batch windows
- Debits and credits
- Lower cost per entry
Instant vs batched settlement
RTP & FedNow
- RTP
- Clearing House instant rail, nonstop
- FedNow
- Federal Reserve instant rail, nonstop
- Payment limit
- Both allow up to $10M
- vs. ACH
- Push-only; ACH also pulls debits
Common Traps
NSF vs Unauthorized Timing
R01 NSF: 2 banking days ≠ R10 unauthorized: 60 calendar days
R11 Changed Meaning in 2020
Old R11: check truncation, 2-day ≠ New R11: terms violation, 60-day
ODFI Duties vs RDFI Duties
ODFI warrants and underwrites entries ≠ RDFI posts, returns, and recredits
TPS Holds the Agreement, Not TPSP
TPS signs the ODFI agreement ≠ TPSP just builds or sends files
Fedwire Settles Gross, CHIPS Nets
Fedwire: RTGS, each payment alone ≠ CHIPS: continuous multilateral netting
AAP Cut Score Is Not Published
Result is pass or no-pass ≠ No percentage or raw score given
Same Day Limit Is Still $1M
$1,000,000 per entry through 2026 ≠ $10,000,000 starts September 17, 2027
Last Minute
- 1.Ops 35%; Rules 32%; Risk 20%
- 2.File 8%; Other systems 5%
- 3.2-day returns; 60-day unauthorized claims
- 4.R11 now means terms violation
- 5.Same Day limit $1M through 2026
- 6.$10M Same Day limit starts 2027
- 7.Fraud Phase 1 hits March 20
- 8.Fraud Phase 2 hits June 22
- 9.NOC: fix within 6 banking days
- 10.Reversals need REVERSAL label, 5 days
- 11.Fedwire is RTGS; CHIPS nets only
- 12.Result is pass or no-pass only
Third-party resources · We may earn a commission from purchases.
AAP Exam Unofficial Practice Questions for the Accredited ACH Professional exam: AAP is the trademark of Nacha. We are not affiliated with Nacha. We ... name only to identify the exam per fair use.
By ExamREVIEW, Yu, Mr Mike
$29.95 · 