9.8 Nacha's Risk Management Portal: Contact Registry, TPS & Direct Access Registration, Terminated Originator Database
Key Takeaways
- Nacha's Risk Management Portal, launched in 2017, is the single access point for the ACH Contact Registry, Proof of Audit requests, Third-Party Sender Registration, Direct Access Debit Participant Registration and the Terminated Originator Database.
- The ACH Contact Registry became effective July 1, 2020 and requires every Participating DFI to register contacts for ACH Operations and for ACH Fraud/Risk Management; registration had to be completed by October 30, 2020 with enforcement grace through July 31, 2021.
- Failing to register a Third-Party Sender, an ACH contact, or Direct Access status is one of Nacha's named Class 2 Rules Violation triggers, carrying fines of up to $100,000 per month until resolved.
- Effective July 24, 2026, the U.S. Treasury's Bureau of the Fiscal Service was added to the ACH Contact Registry; effective January 1, 2027, Participating DFIs must register IAT contacts.
- Financial institutions may designate up to six Portal administrators and create up to 100 user accounts, and Nacha recommends multiple users so proof-of-audit and exception requests are never missed.
9.8 Nacha's Risk Management Portal: Contact Registry, TPS & Direct Access Registration, Terminated Originator Database
Quick Reference: Nacha's Risk Management Portal (launched 2017) is the operational front door for the Rules' registration and information-sharing obligations. Everything in this section is enumerable and dated, which makes it high-yield: the exam can ask what must be registered, when, and what happens if you do not.
1. What Lives Inside the Portal
Nacha Risk Management Portal
┌─────────────────────────────────────────────────────────────────────────┐
│ 1. ACH Contact Registry 4. Direct Access Debit Participant │
│ (mandatory for all DFIs) Registration │
│ │
│ 2. Proof of Audit Requests 5. Terminated Originator Database │
│ (automated since Oct 2025) (TOD) │
│ │
│ 3. Third-Party Sender Registration 6. Secure Exchange services │
│ (ODFI obligation) (RDFI return-request responses, │
│ funds-availability exception │
│ notices, IAT requests for │
│ information, Letters of │
│ Indemnity) │
└─────────────────────────────────────────────────────────────────────────┘
Access mechanics. Portal credentials are separate from a nacha.org login. A financial institution may designate up to six administrators and create up to 100 user accounts. Spread access across compliance, operations and risk: proof-of-audit requests and exception notices arrive in the Portal, and a single-administrator setup is how institutions miss a 30-calendar-day proof-of-audit attestation or a separate 10-Banking-Day supplemental-information clock.
2. The ACH Contact Registry
Purpose. To let financial institutions reach each other quickly about ACH operations, exceptions and risk — the ACH equivalent of a working phone book. Before the registry existed, an RDFI chasing a suspicious credit at 4:00 p.m. had no reliable way to find the right person at the ODFI.
| Item | Requirement |
|---|---|
| Who must register | All Participating DFIs — ODFIs and RDFIs alike |
| Mandatory contact categories | ACH Operations, and ACH Fraud/Risk Management |
| Acceptable contact format | Name, title, email and phone for at least one primary and one secondary contact person; or department contact information with a working email address and telephone number |
| Effective date | July 1, 2020 — the date the registry opened |
| Compliance deadline | October 30, 2020 |
| Enforcement grace period | Through July 31, 2021, after which failure to register became an enforceable Rules violation |
| Ongoing duty | Keep the information current; annual verification is commonly performed alongside the annual Rules compliance audit |
| Who may see it | Registered financial institutions, the ACH Operators, and Payments Associations |
Two dated changes you should carry into the exam:
- July 24, 2026 — the U.S. Treasury's Bureau of the Fiscal Service was added to the ACH Contact Registry, giving financial institutions a registered route to Treasury on federal payment issues.
- January 1, 2027 — IAT contacts become mandatory for all Participating DFIs, aligning international-transaction handling with the existing ACH Operations and Fraud/Risk categories.
Registering does not create a new substantive obligation to answer every inquiry — it creates a reachable address. But an institution that registers a stale mailbox has, in practical terms, not registered.
3. Third-Party Sender Registration
| Item | Requirement |
|---|---|
| Who registers | The ODFI, not the Third-Party Sender |
| What is registered | Each TPS customer, including identification of any TPS that permits Nested Third-Party Senders |
| Initial timing | Within 30 days of the TPS Transmitting its first Entry |
| Nested TPS identification | The later of that 30-day window or 10 days of the ODFI becoming aware of the Nested TPS |
| Updates | Within 45 days of any change to the information previously provided |
| Nil return | An ODFI with no TPS relationships must still submit a statement to that effect |
| Supplemental information on request | Within 10 Banking Days of a written Nacha request during a risk event |
The registry exists to give Nacha baseline visibility, to reveal when one TPS uses multiple ODFIs, to surface a TPS terminated by one ODFI but still registered by another, and to support risk investigations. A risk event is defined as a case where Nacha believes a TPS poses an escalated risk of financial loss to Participating DFIs, Receivers or Originators; of violation of the Rules or Applicable Law; or of excessive Returns.
4. Direct Access Debit Participant Registration
Direct Access describes an arrangement where an Originator, Third-Party Sender or Third-Party Service Provider transmits debit Entries directly to an ACH Operator using the ODFI's routing number, rather than delivering files to the ODFI first. It compresses the ODFI's ability to inspect a file before it enters the Network, so Nacha requires ODFIs to register their Direct Access status through the Portal — including an affirmative statement when the ODFI has no Direct Access Debit Participants.
5. The Terminated Originator Database (TOD)
The TOD lets an ODFI record Originators and Third-Party Senders it has terminated for cause, and lets other ODFIs check a prospective customer against those records during onboarding. It is a due-diligence aid, not a blacklist with legal force: a TOD hit is a prompt to ask harder questions, not an automatic disqualification. Practically, the TOD is the network's answer to the terminated-merchant problem, where a shut-down Originator simply reappears at the next bank.
6. Enforcement — Why Registration Is Not Optional Paperwork
Nacha names registration failures explicitly among its Class 2 Rules Violation triggers, alongside failing to respond to an official Nacha notice and failing to establish or implement a Return Rate reduction plan:
failing to register Third-Party Senders, ACH contacts, or Direct Access status
Class 2 violations carry fines of up to $100,000 per month until resolved. A Class 2 violation that remains unresolved for three consecutive months — or that the ACH Rules Enforcement Panel assesses as egregious — escalates to Class 3, up to $500,000 per month plus a directive to suspend origination privileges.
Exam framing: a scenario describing an ODFI that never registered a TPS, or a bank with an unregistered fraud contact, is pointing at Class 2, not Class 1. Class 1 is the progressive-fine tier for repeated minor or technical infractions.
Which contact categories must every Participating DFI register in Nacha's ACH Contact Registry?
An ODFI onboards a Third-Party Sender that transmits its first Entry on March 3. The TPS later changes its principal business address on August 10. What are the ODFI's registration deadlines?
An examiner discovers that a bank has never registered its ACH Fraud/Risk Management contact and has two unregistered Third-Party Senders. Under Nacha's National System of Fines, what class of violation and what exposure does this represent?
What is the function of the Terminated Originator Database in Nacha's Risk Management Portal?