9.9 ACH Risk Assessments, Regulatory Expectations & Operational Resilience

9.9 ACH Risk Assessments, Regulatory Expectations & Operational Resilience

Core Principle: Nearly every other obligation in the Risk Management domain — exposure limits, Third-Party Sender due diligence, fraud monitoring design, funds-availability decisions — is supposed to be calibrated by a risk assessment. Candidates who can articulate the difference between a risk assessment and a Rules compliance audit get a disproportionate number of Risk Management items right.

---

1. Risk Assessment vs. Rules Compliance Audit

These are two different exercises with different questions, different cadences and different outputs. Merging them is the classic AAP error.

The relationship runs one way: the risk assessment should shape the audit scope. An institution originating high-risk WEB debits for thinly capitalized merchants should have a materially deeper WEB testing programme than one that originates nothing but its own payroll.

---

2. The Third-Party Sender Risk Assessment Requirement

The Third-Party Sender Roles and Responsibilities rule — effective September 30, 2022, with a six-month grace period for certain aspects — did two things:

1. It defined the Nested Third-Party Sender: a Third-Party Sender that has an agreement with another Third-Party Sender to act on behalf of an Originator, and that does not have a direct agreement with the ODFI. The rule established the "chain of agreements" so that an Origination Agreement exists between a TPS and its Nested TPS.
2. It made explicit the requirement that a Third-Party Sender conduct a Risk Assessment. Nacha framed this as clarifying an existing obligation rather than creating a new one — a TPS was always expected to manage the risk it introduced.

A TPS risk assessment that will survive an ODFI review covers, at minimum: the Originators it serves and their lines of business, origination volumes and SEC codes used, return-rate performance by Originator, the exposure limits it sets downstream, its own settlement and funding arrangements, its nested relationships, and its fraud monitoring under the 2026 Rules.

---

3. Building the Assessment: A Workable Method

   1. SCOPE            2. INHERENT RISK       3. CONTROLS        4. RESIDUAL RISK    5. ACTION
   ┌──────────┐        ┌──────────────┐       ┌───────────┐      ┌──────────────┐   ┌─────────┐
   │ Which ACH│        │ Volume, value│       │ Exposure  │      │ Inherent     │   │ Accept, │
   │ roles &  │───────>│ SEC mix,     │──────>│ limits,   │─────>│ risk net of  │──>│ mitigate│
   │ functions│        │ customer     │       │ validation│      │ control       │   │ or exit │
   │ do we    │        │ base, return │       │ monitoring│      │ effectiveness│   │         │
   │ perform? │        │ history      │       │ agreements│      │              │   │         │
   └──────────┘        └──────────────┘       └───────────┘      └──────────────┘   └─────────┘

Step 1 — Scope. Enumerate every ACH role the entity performs: ODFI, RDFI, Originator for its own payroll, Sending Point, Receiving Point, Third-Party Service Provider for an affiliate. Roles drive obligations.

Step 2 — Inherent risk. Quantify: daily and peak origination volume and value, SEC code mix (WEB and TEL debits carry more authorization risk than PPD credits), Originator industry concentration, historical return rates against the 0.5% / 3.0% / 15.0% benchmarks, Same Day ACH usage, IAT exposure, and nested Third-Party Sender chains.

Step 3 — Controls. Map controls to the five risk types covered in Section 9.1 — credit, operational, fraud, systemic and compliance. Typical controls: single-day and multi-day exposure limits with automated hard stops, account validation for WEB debits, prefunding or reserve requirements for weak Originators, dual control over file release, fraud monitoring under the 2026 Rules, and OFAC/BSA screening.

Step 4 — Residual risk. Rate inherent risk net of demonstrated control effectiveness. "Demonstrated" is the operative word: an exposure-limit policy that operations routinely overrides is not a control.

Step 5 — Action. Accept, mitigate or exit. Document the decision and the owner. Unremediated high residual risk with no owner is the finding examiners write up most often.

Worked Scenario

Two ODFIs each originate 500,000 Entries a month.

• Bank A originates PPD credits for 40 municipal payroll customers. Inherent credit risk is low (credits are prefunded from known deposit relationships), authorization risk is minimal, return rates run under 0.1%.
• Bank B originates WEB debits for 12 subscription merchants, two of which use Third-Party Senders with nested relationships. Inherent risk is materially higher: debit-pull exposure, authorization disputes, unauthorized return-rate pressure, and limited visibility into the nested chain.

Identical volume, entirely different control requirements. A risk assessment that produced the same exposure limits and the same audit scope for both banks would fail on its face.

---

4. Regulatory Expectations Layered on the Nacha Rules

The Nacha Rules are a private contract; federal examination authority is separate and additional. Under FFIEC guidance, examiners from the OCC, FDIC, Federal Reserve Board, NCUA and state banking authorities routinely review:

• the institution's ACH risk assessment and its currency;
• the annual Rules compliance audit report, findings and corrective action plans;
• third-party risk management over TPSPs and Third-Party Senders — a perennial examination theme;
• BSA/AML and OFAC integration with ACH processing;
• Regulation E error-resolution performance on consumer disputes.

Deficiencies identified in an ACH audit can surface in an examination report, and third-party risk management findings can constrain a bank's ability to grow its payments business.

---

5. Operational Resilience for ACH

Business continuity is easy to under-specify because ACH runs invisibly until it does not.

• File transmission continuity. Alternate transmission paths to the ACH Operator, tested — not merely documented. Know your Operator's deadlines and your own internal cutoffs relative to them.
• Remake and re-transmission procedures. Written procedures for a corrupted or duplicated file, including who authorizes a remake and how duplicates are suppressed. A duplicate file released in a panic is a far more expensive incident than a late file.
• Settlement contingency. Understand what happens to your settlement position if a file is late or a customer fails to fund, and who has authority to act.
• Escalation paths. Your ACH Operations and ACH Fraud/Risk contacts in the ACH Contact Registry must be current and monitored, because that is how another institution reaches you during an incident.
• Incident response integration. ACH incidents should feed the same incident-response and, where applicable, SAR-filing processes as any other suspected fraud.