ACH originator risk assessment that sets the exposure limit from the client's own files
Every originator measured against all three Nacha levels every day, not once a year.
See one case, screen by screen ↓ACH originator risk assessment is the work a sponsoring bank does to decide how much settlement risk each business it originates ACH files for is allowed to create, and to prove it has done so. It covers the exposure limit and its periodic review, the originator's return rates against the Nacha levels, its financial standing, and its own controls. ACH Originator Risk Assessment does that work with seven agents: they measure the rates nightly, derive the limit from the client's own ninety days of files, spread the statements with every value cited, and test the controls against the rules — and a named credit officer approves and a second person checks before anything reaches the payments hub.
AI use cases in banking: a buyer's guide to agentic AI for bank and credit union operations →
Updated
An ACH originator risk assessment has to answer three questions at once, and they live in three different systems. How much settlement risk does this originator actually create — which only ninety days of its own files can say. Are its return rates inside the Nacha levels of 0.50% unauthorized, 3.00% administrative and 15.00% overall, each measured over the preceding sixty days. And are the originator's own controls good enough under the fraud monitoring rules that took effect on March 20 and June 19, 2026, which make the sponsoring bank answerable for its originators' processes as well as its own.
So an analyst exports daily reports into a spreadsheet to build a ninety-day picture, rebuilds the sixty-day return rates by hand, pulls a statement that is often a year old, emails a questionnaire that comes back in free text weeks later, and writes a memo. The approval is an email in somebody's mailbox; the limit is retyped into the payments hub. Nobody sees a rate that is climbing but still inside a level — it is invisible until it crosses, and then the bank has thirty days to fix it. When an examiner asks for twenty-five assessments, the evidence is scraped out of email and Word files for a fortnight.
Estimated split for one off-cycle originator review at a regional bank, by hand and with the solution.
Seven agents measure the returns, derive the limit from the files, read the statements and test the controls; a credit officer approves and a second person checks.
Pinecrest Membership Clubs, Inc. runs 112 fitness and racquet clubs and bills 204,000 members every month by internet-authorized ACH debit. Its exposure limit has been $2,000,000 a settlement day since January. On September 2 its rolling unauthorized return rate passed the bank's own warning level of 0.35%, and an off-cycle review was scheduled. On October 19 it crossed the Nacha level of 0.50%, which starts a thirty-day clock. This is the morning of October 20.
The three return rates are recomputed over the rolling sixty days for all 9,800 originators every night, and the seven that crossed a level are put at the top of the desk. Pinecrest is first: unauthorized 0.62% against 0.50%. Four more are over the unauthorized level, one over the 3.00% administrative level and two over the 15.00% overall level.
A rate that is rising but still inside a level is what an annual review cannot see. The warning level is where the bank acts first.
The orchestrator gathers from the payments hub, the ACH origination platform, the core banking system, the commercial credit system and case management, then runs the Returns, Exposure, Financials and Monitoring agents, then Remediation and Evidence. Four minutes and twelve seconds later there is one recommendation, with every value traced to the file, the return code, the statement page or the rule it came from.
The lowest confidence on the assessment is 0.91. Nothing the agents are less sure of than 0.90 is asserted — it goes to a person as a question.
Three gauges: unauthorized 0.62% over its level, administrative 1.18% and overall 4.90% both well inside theirs. Below them, ninety days of daily debit origination with the $2,000,000 limit drawn across it and the proposed $1,200,000 beside it. Then the recommendation in one sentence, and one next step.
Of the 2,560 unauthorized returns, 1,818 are on members debited within forty-five days of enrolling, and 1,673 of those came through the seven-day free trial launched on May 4, which converts to a $59.99 monthly debit on day eight with no second authorization. R10 — the customer says the entry was not authorized — is 84% of the total. Members who enrolled before May 4 return at 0.11%.
The window, the denominator of 412,900 debit entries and the numerator by return code are all on the page, so two analysts get one answer.
Sixty-three settlement days with a file in ninety days, $54,306,000 originated, an average day of $862,000 and a largest day of $1,842,400 on October 1. With the $124,600 of returns in flight behind that file, the peak measured need was $1,967,000 — 98% of the limit set in January. At $1,200,000, fifty-nine of the sixty-three days are inside the limit and four would be prefunded.
Step the limit and the number of days needing prefunding changes with it. The tier cap — 65% of tangible net worth, or $9,555,000 here — says when it binds.
FY2025 revenue of $184,600,000, EBITDA of $21,300,000, funded debt of $62,400,000, tangible net worth of $14,700,000, leverage of 2.93 times. Every value opens the statement page it came from, and any of them can be disputed with a reason that stays on the record. The internal rating is unchanged at 5, Pass/Watch — and the FY2026 interim statements, due August 31, are fifty-one days late.
The approved limit was set on the FY2025 year. The agents ask for the interim statements and put the request in the plan rather than guessing.
One pass and four gaps, from the questionnaire returned on September 24 and its officer attestation. Authorization capture passes. There is no second authorization when a trial converts; 14% of new accounts are debited before validation completes, which the WEB debit rule has required since March 19, 2021; revocations take a median of nine business days to stop; and the written monitoring process is dated February 2024 and has never been reviewed.
Last year the same client answered that every new account was validated before the first debit, and that revocations took three business days. The comparison is on the screen.
The dialog shows exactly what changes: $2,000,000 to $1,200,000, prefunding and a $210,000 return reserve where there were none, risk tier 2 to 3, the next review moving from March 2027 to January 20, 2027. He picks LC-02 — return rate above a Nacha level — which cannot be approved without a remediation plan, writes a note for the record and types his name to sign.
She checks that the rate is measured on the rolling sixty days with the right denominator, that the limit matches the tier basis and sits inside the cap, that the approval was inside Caleb's authority, that a plan exists with a deadline, and that the evidence pack is complete. Then she releases it. The payments hub confirms at 10:36 a.m., effective with the file of October 21. Nothing was retyped.
Where the same person would be both preparer and checker, the assessment goes one level up. There is no override.
Five actions with owners and dates inside the November 18 deadline, four weekly checkpoints, and an escalation to the Treasury Credit Committee at day twenty. The rate is re-measured every night and posted against the plan each Monday; a flat week puts the assessment back on Renata's desk the same morning. The treasury officer sends the client letter the agents drafted — the limit, the prefunding, the reserve, the plan and the dates, and nothing else.
An action is closed by a person with evidence attached, never by an agent.
The same originator, seen by the four people who carry the decision — what their quarter looked like, and what it looks like now.
Seven agents measure the returns, derive the limit from the files, read the statements and test the controls; a credit officer approves and a second person checks.
Schedules each review from the tier's cadence and from off-cycle triggers such as a warning level being crossed, gathers from the five systems of record, runs the four specialists and then the Remediation and Evidence agents, and assembles one recommendation.
Recomputes the unauthorized, administrative and overall return rates over the rolling sixty days for every originator every night, raises the bank's own warning level, and groups unauthorized returns by code, by days since enrollment and by the funnel the customer came through so the cause is named.
Reads ninety days of actual files — every settlement day, standard entry class code, credit or debit, Same Day or next day — and proposes a limit, a prefunding rule and a return reserve, with the arithmetic shown on the page.
Spreads the statements, the tax return and the credit memo onto the bank's own template, citing every value to the page it came from, and flags a statement that is stale or missing against what the credit memo requires.
Tests the originator's own risk-based processes against the Nacha fraud monitoring rules and the account-validation rule for internet-authorized debits — authorization capture, re-authorization, account validation, revocation handling, file controls — quoting the sentence each answer was judged on and comparing it with last year's.
Drafts the plan from the named gaps and the named cause, with owners, dates and weekly checkpoints inside the thirty-day deadline, tracks the clock, drafts the client letter and escalates at day twenty.
Assembles the assessment, the arithmetic, the approvals, the evidence and the audit trail into one indexed file with a manifest and a fingerprint, for an examiner, internal audit, the financial-crime officer or a network inquiry.
Approves; a second person checks. The agents propose; a named person decides.
Ask about a rate, a limit, a rule or a client — or say what to change. Every answer points to the file, the return code, the statement page or the rule it came from.
Why is the unauthorized rate over the level?
Because of one change in the client's business. 1,673 of the 1,818 unauthorized returns on members debited within forty-five days of enrolling came through the seven-day trial launched on May 4, 2026, which converts to a $59.99 debit on day eight with no second authorization. R10 is 84% of the 2,560. Members who enrolled before May 4 return at 0.11%.
Would $1.5 million be enough?
At $1,500,000, sixty-one of the sixty-three settlement days would be inside the limit and two would need prefunding. At $1,200,000 it is fifty-nine inside and four prefunded. The tier 3 cap, 65% of tangible net worth, is $9,555,000, so it does not bind either number.
What happens if the rate is still over the level on November 18?
The breach stays open and the matter escalates. The bank's own escalation is at day twenty, Monday November 9; on November 18 the rate must be under 0.50% or the originator goes to the Treasury Credit Committee with prefunding on every file, which is tier 4. Then 180 days of monitoring.
Which control gap matters most?
The missing second authorization when a trial converts. It is the direct cause of the R10 returns, it is the one gap the client can close in a week, and the fraud monitoring rules put entries authorized under false pretenses squarely in scope from March 20, 2026. Account validation before the first debit is next, and has been required for internet-authorized debits since March 19, 2021.
13 screens from the working solution, on its sample data. Pick one to see it large.
The tiers, levels, authorities and clocks every assessment runs on are settings — versioned, previewed before they are saved, and on the audit trail.
| Setting | Default | Choose from |
|---|---|---|
| Risk tier limit basis | Tier 3: the peak settlement day, capped at 65% of tangible net worth | Tier 1: 2× the average day · Tier 2: 1.25× the peak day · Tier 4: the peak day capped at 40% of tangible net worth |
| Nacha return rate levels | 0.50% unauthorized · 3.00% administrative · 15.00% overall | Locked — these are the Operating Rules, with the sixty-day window and the originated-entries denominator fixed beside them |
| The bank's own warning level | 0.35% unauthorized | Step it and see how many originators would come onto the desk before you save |
| Approval authority | To $5,000,000, Treasury Credit Officer | To $1,000,000 the risk manager · to $25,000,000 the credit committee · above that the chief credit officer |
| Review cadence | Annual, annual, semiannual, quarterly by tier | Plus off-cycle on a warning level, a breach, a limit increase request, a change of control or a new high-risk entry class code |
| Clocks | Prepared within 2 business days, approved within 3, checked within 1, loaded the same day | Each miss escalates one level up |
| Retention and masking | Five years after the relationship ends; account numbers as the last four | Authorizations two years after the last entry; a full number only on a named request with a reason |
| Agent confidence floor | 0.90 | Below it, nothing is asserted — the value goes to a person as a question |
Every figure is labelled: a target the solution is built to, an estimate, a typical published result, or a proven one.
“demo” = seen in the working solution, on its sample data · “target” = the design goal, measured in the live solution · “estimated” = our estimate, with the split shown · “typical” = published figures (Nacha Operating Rules: unauthorized, administrative and overall return rate levels of 0.50%, 3.00% and 15.00% over the preceding sixty days, Article Two 2.2.3 on exposure limits, and the fraud monitoring rules effective March 20 and June 19, 2026; Nacha: 35.2 billion ACH payments worth $93 trillion in 2025; OCC Bulletin 2006-39 and the FFIEC retail payment systems booklet on ACH risk management; 31 CFR 1010.430 on five-year record retention). The bank, the originators, the people, the account numbers and every figure on the screens are fictional — characters and sample data in the working solution.
ACH originator risk assessment is the work a sponsoring bank does to decide how much settlement risk each business it originates ACH files for is allowed to create, and to prove it has done so. It covers the exposure limit and its periodic review, the originator's return rates against the Nacha levels, its financial standing, and its own controls. ACH Originator Risk Assessment does that work with seven agents: they measure the rates nightly, derive the limit from the client's own ninety days of files, spread the statements with every value cited, and test the controls against the rules — and a named credit officer approves and a second person checks before anything reaches the payments hub.
Four things, and they have to agree with each other. How much settlement exposure the originator's own file history actually creates. Its unauthorized, administrative and overall return rates over the preceding sixty days. Its financial capacity to fund what it originates, from statements and the credit memo. And whether its own risk-based processes meet the fraud monitoring rules. The solution assembles all four, cites every value, and ends in one recommendation a person decides on.
The limit is derived from the client's own files rather than from a number typed into a form: the peak and average settlement day over ninety days, the returns in flight behind them, and the basis the risk tier carries — for an elevated tier, the peak settlement day capped at 65% of tangible net worth. Cadence is a setting, by tier: annual, annual, semiannual and quarterly, plus an off-cycle review whenever a warning level is crossed, a limit increase is requested, control changes hands or a higher-risk entry class code appears.
0.50% for unauthorized returns, 3.00% for administrative returns and 15.00% overall, each measured over the preceding sixty days or two calendar months. In the working solution the rates are recomputed every night for every originator, so a rate that is rising is visible long before it crosses; the bank's own warning level sits at 0.35% and schedules an off-cycle review. When a level is crossed the breach is logged with its thirty-day clock, a remediation plan is required before the limit can be approved, and the rate is re-measured and posted against the plan every week.
There is no loan. The exposure is the settlement risk the bank carries between releasing a file and the originator funding it, plus the returns that come back afterwards — so the question is how large a file the bank is willing to release unsecured, not how much to lend. It uses the same statements and the same internal rating as a credit decision, and it is owned by treasury and operations risk rather than by lending.
They require risk-based processes reasonably intended to identify entries that are unauthorized or authorized under false pretenses, reviewed at least annually — and the sponsoring bank answers for its originators' processes as well as its own. The rules applied from March 20, 2026 to every originating institution and to the largest originators and third-party senders, and from June 19, 2026 to everyone else. In the solution those requirements are five checks inside each assessment, each quoting the answer it was judged on.
Yes — a third-party sender is reviewed the same way, on the same desk, with the same limit basis and the same approval chain, and its own originators' return behavior rolls up to it. The work of registering a third-party sender and testing its rules compliance audit is a separate job and is not part of this solution.
A person, every time. The agents measure, derive, read and draft, and they cite everything; no agent may approve a limit, check one, release it to the payments hub, send a client letter or close a remediation action. Anything the agents are less sure of than the confidence floor is not asserted at all — it goes to a person as a question, and every override carries a reason code with the agents' version kept beside it.
The solution is built and deployed by the Agentic Solution Engine from your policy, your tiers and your file, return and statement feeds, and goes live once every quality gate has passed. The usual first step is a sample: we run it over a set of your own originators' past file and return history and compare the limits it derives with the ones you approved.
A priced proposal in two days, not two weeks, every value cited to a statement line.
1-min demoThird-Party Sender Due DiligenceEvery originator behind the sender screened and measured, not just the sender.
1-min demoTreasury Management Agreement SearchWhat the client agreed, what the log shows, and whether they match.
1-min demoWe'll run ACH Originator Risk Assessment on a sample of your own originators' file and return history.