An ACH exposure limit is the maximum dollar amount an originating bank allows one business customer to originate in a settlement day or period, set from that customer's creditworthiness and its own funding pattern and reviewed periodically. Nacha's rules require every originating bank to set one for each originator, and examiners test whether the number is reasonable, reviewed and enforced. The hard part is the evidence: a defensible limit comes from the client's own settlement history, its financial capacity and what it owes the bank elsewhere, and those sit in three systems. Botminds' ACH Originator Risk Assessment reads ninety days of the client's files, proposes a limit with the arithmetic on the page, and leaves the decision to a named credit officer.
The worked example below comes from a fictional sample bank, Corvane, and its fictional originator Pinecrest Membership Clubs, a chain of 112 fitness clubs that debits 204,000 members each month. Every figure about them is sample data from the solution. The rules and guidance are quoted from Nacha, the OCC and the FFIEC, linked where they appear.
One originator's exposure, measured from its own files
63
settlement days with a file in the last ninety
$54,306,000 originated
$1.8M
largest single settlement day, on October 1
$1,842,400; the average day was $862,000
98%
of the $2,000,000 limit used at the peak, once returns in flight are added
$1.2M
the limit the credit officer approved, with prefunding above it
What is an ACH exposure limit? The examiners' definition
An ACH exposure limit is a ceiling on what one originator may send, not a credit line it may draw. The FFIEC's examination handbook defines it as "the maximum amount an ACH originator is allowed to originate. This amount can be based on the originator's credit rating, historical or predicted funding requirements, and the type of obligation" (FFIEC IT Handbook, Retail Payment Systems glossary). Three inputs, then: how good the credit is, how much the client actually moves, and what kind of entries it sends.
Nacha's Risk Management Advisory Group puts the same idea in operational terms for originators: "Credit and Debit exposure limits are limits set on the dollar value of Credits and Debits an Originator may send over a given period" (Nacha RMAG, Originator Essentials, 2024). The period matters. The OCC expects approved limits for both daily and multi-day settlements: a day is when the bank settles with the ACH Operator, but the exposure itself runs across several settlement dates, which is why the monitoring has to accumulate entries rather than look at one file at a time.
The limit is not a loan. Pinecrest has no credit facility at Corvane; its financial review records the loan facility as "None — settlement exposure only". Yet the bank still carries risk on every file it releases: on credits until the client funds them, and on debits until the receivers can no longer send them back. The limit is the bank's statement of how much of that unsecured exposure it accepts from this client on any one day.
Why does Nacha require an exposure limit for every originator?
Because the originating bank answers to the network for every entry it sends, whoever keyed it. Nacha's staff summarise the rule in plain words: "The Nacha Rules require financial institutions to establish, implement, and periodically review exposure limits for their Third-Party Sender (TPS) customers and for their Originator customers" (Nacha, "Why are Exposure Limits So Important?", March 2025). The same article adds that the rules require monitoring of origination and return activity across multiple settlement dates and enforcement of the limits once set.
The Advisory Group's argument for limits goes beyond credit. It lists four things a limit lets a bank catch before money leaves, and only one of them is a client failing to pay.
Four things an exposure limit catches before the file leaves the bank
- A file far larger than the client normally sends
Fraud, a keying error or a duplicate all show up first as an amount that does not fit the pattern.
- A run of files that adds up over several days
In the Advisory Group's words: "Variances in credits and debits over multiple days that may be originated due to fraud, error, or as duplicates."
- An entry class the client should not be using
A consumer debit code on a business-to-business client, or a code its origination agreement does not permit.
- The credit exposure left by returned debits
Debits that come back after the bank has given the client the money, which the client must then repay.
The payroll example in the same article is the one most treasury teams will recognise. When a payroll provider sends a duplicate or an extra cycle, the employer may well have the money in its account, so a funds check passes; the limit is what holds the file long enough for someone to call the client. That is also why prefunding is not a substitute for a limit, a point Nacha makes in so many words.
What is ACH exposure? Credits, debits and the days in between
ACH exposure is the money a bank has committed on an originator's behalf and not yet secured. On a credit file the bank is exposed from the moment it sends the file until the client funds it at settlement. On a debit file the bank credits the client at settlement and is exposed until the debits can no longer be returned, which for consumer entries returned as unauthorized can be weeks later. The two run on different clocks, which is why the OCC asks banks to set both credit and debit exposure thresholds for each originator, and why the return window behind a debit file is the part most spreadsheet limits leave out.
For setting a limit, the practical measure is the largest amount the client puts through on one settlement day, plus what is still exposed behind it. At Pinecrest that second term is $124,600 of debits that had settled but could still come back when the October 1 file went out. A limit sized on the file alone would have looked comfortable at 92% of $2,000,000; with the returns in flight the peak need was $1,967,000, or 98%.
How to calculate an ACH exposure limit from ninety days of files
To calculate an ACH exposure limit, read every settlement day in a recent window from the origination records, find the average and the peak, add the debits still open to return behind the peak, apply the basis your policy assigns to the client's risk tier, and cap the result against the client's capacity. The table follows each step on the sample originator, so every figure can be checked against the one before it.
ACH exposure limit calculation, step by step, on one originator
| Step | What is read or computed | Result |
|---|---|---|
| 1. The window | Every settlement day with a file in the last ninety calendar days, credits and debits apart | 63 settlement days |
| 2. Total originated | Sum of debit entries settled in the window | $54,306,000 |
| 3. Average settlement day | $54,306,000 ÷ 63 | $862,000 |
| 4. Largest settlement day | Thursday October 1, a month-start billing file | $1,842,400 |
| 5. Returns in flight behind the peak | Debits settled before October 1 that could still be returned | $124,600 |
| 6. Peak measured need | $1,842,400 + $124,600 | $1,967,000 |
| 7. Against the current limit | $1,967,000 ÷ $2,000,000 | 98% utilization |
| 8. The capacity cap for the client's tier | 65% × tangible net worth of $14,700,000 | $9,555,000 |
Three choices in that table are policy, not arithmetic. The window: ninety days catches a quarter's billing cycles and the month-end peaks, but a seasonal business (a tax preparer, a school collecting tuition) needs the same window from last year as well. The scope: a client that sends both credits and debits needs each measured on its own, because a payroll credit file and a collections debit file carry different risks. And the treatment of returns in flight: adding them is conservative, and it is the term that turned a comfortable limit into a full one.
Average, peak or a multiple: choosing the basis for the limit
The basis is the rule that turns measured volume into a limit, and it should tighten as the risk tier rises. A low-risk payroll client can be given headroom above its average day; an elevated-risk client should be held near its own peak, with a cap tied to what it could absorb if its files went bad. The sample bank writes four bases into its policy, one per tier.
Four limit bases, applied to the same ninety days
| Risk tier | Basis in the sample policy | What it gives for Pinecrest | What it is good at |
|---|---|---|---|
| 1 · low | 2 × the average settlement day | $1,724,000 | Stable payroll and vendor files: room for growth without a request every month |
| 2 · standard | 1.25 × the peak settlement day | $2,303,000 | Clients with a month-end peak: the peak always fits, with a margin |
| 3 · elevated | The peak day, capped at 65% of tangible net worth | $1,842,400 (cap $9,555,000) | Growing or watch-rated clients: no headroom beyond what they have shown |
| 4 · high | The peak day, capped at 40% of tangible net worth, prefunding on every file | $1,842,400 (cap $5,880,000) | Clients in remediation or with a weak credit |
The basis is a starting point, not the decision. Pinecrest moved from tier 2 to tier 3 because its unauthorized return rate had climbed over Nacha's 0.50% line, and the credit officer approved $1,200,000, below every basis in the table, with any file above it to be prefunded. That is a deliberate cut: at $1,200,000 the client's ordinary billing days pass untouched, and its four largest files wait for collected funds while the cause of the returns is fixed. The approval carries a reason code and a remediation plan, which is how a judgment that departs from the formula stays explainable to an examiner a year later.
Only four settlement days in ninety exceed the approved $1.2 million
Capping the limit against capital and everything else the client owes
A limit built from volume alone grows with the client's success and never asks whether the client could cover a bad week. The FFIEC's handbook says that "the risk in large volume relationships, and the institution's legal lending limit and capital position should be recognized in establishing exposure limits for each customer" (FFIEC IT Handbook, Credit Risk). Its examination procedures then ask whether "the limit is reasonable relative to the originator's exposure across all services (lending, cash management, foreign exchange, etc.)" (FFIEC, Appendix A, ACH ODFI responsibilities).
Two caps follow. The first is the client's own capacity: a share of tangible net worth, or of liquidity, that the bank believes the client could pay back if a day's debits came back. The sample policy uses 65% of tangible net worth for elevated clients and 40% for high-risk ones; on Pinecrest's $14,700,000 that is $9,555,000 and $5,880,000, so neither binds against a $1.8 million peak. The second is the bank's side: the limit is unsecured exposure to one name, and it should sit inside the same house limit for that name as its loans, its card program and its wires.
The capacity cap is the term that matters for a fast-growing originator. A client that doubles its volume in a year doubles a volume-based limit; its equity rarely moves as fast. When the cap starts to bind, that is the signal for a conversation about prefunding, a reserve or a parent guarantee, before the limit is raised. How the client's request for a higher limit is verified and routed before anyone changes the payments hub is covered in the ACH limit increase guide.
The limit comes from the client's files, with the arithmetic on the screen
ACH credit exposure limit vs debit exposure limit
A client that sends both credits and debits should have two limits, because the risks are different in kind. A credit limit protects the bank against a client that cannot fund its payroll; a debit limit protects it against returns after it has already paid the client. The OCC goes one step further for internet-authorized consumer debits: "Consistent with NACHA requirements, banks should establish separate exposure limits and monitoring practices for WEB entries" (OCC Bulletin 2006-39).
Two limits for one client, because credits and debits fail differently
ACH credit exposure limit: The client not funding a file the bank has already sent: payroll, vendor payments, tax payments.
ACH debit exposure limit: Debits returned after the bank has made the money available to the client.
ACH credit exposure limit: From release until the client's account covers the file, usually around settlement.
ACH debit exposure limit: From settlement until the entries can no longer be returned; much longer for consumer debits returned as unauthorized.
ACH credit exposure limit: The largest credit file and the client's collected balances.
ACH debit exposure limit: The largest debit file plus the returns still in flight behind it.
ACH credit exposure limit: Prefunding: the file is released only against collected funds.
ACH debit exposure limit: A return reserve and a hold on debit proceeds, sized from the client's own return rates.
ACH credit exposure limit: Account takeover: a fraudster with access sends a large credit file the account can cover.
ACH debit exposure limit: A product change that brings unauthorized returns, as with Pinecrest's seven-day trial.
Pinecrest is a debit originator, and its WEB entries are the ones that came back. Of its 2,560 unauthorized returns in the sixty days to October 16, 1,673 came through a seven-day free trial launched on May 4 that converted to a $59.99 monthly debit with no second authorization. A separate WEB limit would have put that channel's growth in front of an analyst on its own, rather than blended into one daily total.
How often should ACH exposure limits be reviewed?
At least once a year for every originator, more often as the risk tier rises, and at once when something changes. Nacha's public summaries of the rule speak of periodic review without naming an interval; the OCC asks lending and ACH operations staff to confirm each originator's financial condition at least annually, and examiners look for a cadence the bank wrote down and kept, and for evidence that limits move when credit ratings and activity levels move. The sample bank reviews tiers 1 and 2 annually, tier 3 twice a year and tier 4 quarterly.
A calendar alone misses the originator that changes between reviews, which is where exposure grows without anyone looking. Pinecrest's limit was set in January on its FY2025 statements. In May it launched a trial product; by October its peak day needed 98% of the limit and its interim statements, due August 31, were fifty-one days late. Nothing in an annual cycle would have looked at it again until March 2027.
What triggers an ACH exposure limit review?
A review should be triggered by any event that changes the inputs the limit was built on: credit, volume, returns or the kind of entries. The FFIEC's examination procedures ask whether rising debit return volume prompts a re-evaluation of the limit and whether limits are adjusted for changes in credit rating and activity. The sample bank's policy turns that into off-cycle triggers that put the originator on the analyst's desk; the table adds two more we would set.
Six events that reopen an exposure limit before its review date
| Trigger | Why it changes the limit | How it can be set |
|---|---|---|
| A warning level crossed on returns | Returns are debit-side credit exposure, and a rising rate is often a product or authorization problem | Unauthorized rate over 0.35%, set below Nacha's 0.50% line |
| A limit increase request | The client is asking the bank to carry more unsecured exposure | Any request, before the payments hub is changed |
| A change in the internal rating | The limit was approved on a credit that no longer exists | Any downgrade, and any move to watch (our suggestion) |
| Stale or missing financial statements | The capacity cap rests on numbers the bank can no longer rely on | Statements past their due date (our suggestion) |
| A change of control | The owners whose standing supported the limit may be gone | Notice of a sale, merger or new majority owner |
| A new higher-risk entry class | Consumer internet or telephone debits carry more unauthorized returns than corporate entries | First use of WEB or TEL by a client approved for other codes |
The return trigger is where nightly measurement pays for itself. At the sample bank, a 0.35% warning level brings 286 originators onto the desk for an off-cycle review this quarter, and Pinecrest crossed it on September 2, seven weeks before it crossed Nacha's line. How the three return rates behind that trigger are calculated, and what Nacha does when one is crossed, are set out in the guide to ACH return rate calculation.
Monitoring files against the limit across settlement dates
A limit only works if every file is checked against it before release, and if files are added up across days rather than judged one at a time. The FFIEC's procedures ask whether the monitoring is automated, whether it accumulates entries for at least the average debit return period, which the handbook puts at sixty to seventy-five days, and whether anything over the limit is approved in advance by a credit officer. The Advisory Group adds the client-service view: a call about an over-limit file is "a positive touchpoint", and banks report that clients quickly approve their own special runs, such as a bonus payroll, and value the extra control.
The point where most limits fail is the handoff from approval to enforcement. A limit approved in a memo and then retyped into the payments hub can be mistyped, loaded late or not loaded at all, and the evidence that the approved number is the enforced number has to be rebuilt at exam time. In the solution the approved limit, its prefunding rule and its reserve go to the payments hub only after a second person who did not prepare the assessment has checked them; at Corvane the hub confirmed Pinecrest's $1,200,000 at 10:36 a.m., effective with the next morning's file, and nothing was retyped.
One page with the rates, ninety days of files and both limits drawn across them
The limit is one element of a larger assessment; how it sits beside the return rates, the financial spread and the originator's own controls is laid out in the ACH originator risk assessment template. To see the limit derived from your own originators' files, start from ACH Originator Risk Assessment.
Questions people ask
Is an ACH exposure limit the same as a daily limit?
Usually it is expressed as one: a dollar amount per settlement day that no file, or no combination of files settling that day, may exceed without approval. But the exposure behind it spans several days, so a sound limit is also monitored cumulatively across settlement dates. The OCC asks banks to approve limits for both daily and multi-day settlements.
Can an originator send a file above its exposure limit?
Only with an approval made before the file is released. The FFIEC expects over-limit entries to be approved in advance by a credit officer, and the OCC expects those approvals to be consistent with the bank's policy for unsecured credit. A common alternative is to release the file only if the amount above the limit is prefunded, which is what the sample bank requires of Pinecrest.
What is a return reserve, and how is it sized?
A return reserve is cash the client keeps at the bank against debits that may still come back. One simple sizing is the average settlement day times the client's overall return rate, times the number of days of returns the bank wants covered. For Pinecrest that is $862,000 × 4.90%, about $42,238 a day, over five days: $211,190, held as $210,000.
Who approves an ACH exposure limit?
Whoever the bank's credit policy names for unsecured exposure of that size. At the sample bank the ACH risk manager approves to $1,000,000, the treasury credit officer to $5,000,000, the credit committee to $25,000,000 and the chief credit officer above that, and a second person who did not prepare the assessment checks it before it reaches the payments hub.
Does a client that prefunds every file still need a limit?
Yes. Nacha's Advisory Group is clear that prefunding cannot stand in for a limit, because it does nothing about fraud or returns: a fraudster with access to a prefunded account can still send a large credit file the balance covers. A limit is what stops that file for a call to the client.
How does a third-party sender's limit differ from an originator's?
Nacha requires banks to set limits for third-party senders as well, and requires the sender to set limits for each of its own originators. The bank's limit for the sender has to reflect the creditworthiness of the sender relative to everything it originates for others, which is reviewed on the same desk in the solution with its originators' returns rolled up to it.