ACH origination software lets a bank's business clients create or upload ACH files, approve them under dual control, and send them to the bank, which checks them against limits and funding and releases them to the ACH Operator. It moves money and enforces the limits it is given. What it does not do is decide those limits: whether a client should originate at all, which entry classes it may send, how much, under what prefunding, and how often that is reviewed. That decision is a risk review of about twelve tasks, and where it is done by hand it runs on exported reports, a spreadsheet and email. Botminds' ACH Originator Risk Assessment sits beside the origination platform, takes the seven tasks that are reading and arithmetic, and leaves the five that are judgment and authority with named people.
The examples come from a fictional sample bank, Corvane, and its fictional originator Pinecrest Membership Clubs; their figures are sample data from the solution.
Twelve tasks in one originator review: seven move to agents, five stay with people
| Task | By hand today | With the agents | Who owns it |
|---|---|---|---|
| 1. Gather ninety days of files | Export daily reports from the payments hub and origination platform into a spreadsheet | Agent reads every settlement day, entry class, credit or debit | Agent |
| 2. Measure the three return rates | Rebuild sixty days of returns and originations by hand | Re-measured every night for every originator, window and denominator shown | Agent |
| 3. Find the cause of the returns | Rarely done; the rate is reported without a reason | Returns grouped by code, days since enrollment and sign-up channel | Agent |
| 4. Spread the financial statements | Chase a statement, often a year old, and re-key it | Spread onto the bank's template, each value cited to its page; late statements flagged | Agent |
| 5. Read the controls questionnaire | Email it, wait weeks, read free text | Each answer quoted against the rule and last year's answer | Agent |
| 6. Propose limit, prefunding and reserve | A number carried from last year, adjusted by feel | Derived from the files with the arithmetic on the page, inside the tier cap | Agent |
| 7. Draft the plan, letter and evidence | Written from scratch; evidence gathered at exam time | Plan with owners and dates, a client letter and an indexed evidence pack drafted | Agent |
| 8. Judge and send the recommendation | Analyst writes a memo | Analyst reads the page, challenges any value, sends it for approval | Analyst |
| 9. Rate the credit | Credit team | Credit team; the agents never rate | Credit |
| 10. Approve the limit | Reply to an email | Named credit officer, within authority, with a reason code and signature | Credit officer |
| 11. Check and release to the payments hub | Often skipped on a cut; limit retyped | A risk manager who did not prepare it checks and releases; nothing retyped | Risk manager |
| 12. Send the letter, close the actions | Ad hoc | Treasury officer sends the drafted letter; a person closes each action with evidence | Treasury officer |
What does ACH origination software do?
It turns a client's payment instructions into Nacha-formatted files the bank can release, and it applies controls on the way out (what a file check can and cannot catch is in the guide to Nacha file validation tools). On the client side that means file creation or upload, entitlements, dual approval and templates. On the bank side it means checking each file against the client's limit and available funds before release. The FFIEC's examination procedures describe the bank's half of that job: examiners assess the release process and "determine whether assurances are obtained that sufficient collected funds (e.g., on deposit or prefunded) or credit facilities are available" (FFIEC, Appendix A, ACH funding and credit).
Where a client or a processor has direct access to the ACH Operator, the OCC describes the contract terms that let the bank keep control: bank-set dollar limits for files, and a rule that a file over them is brought to the bank first, which can approve it as an exception or require it to be held until the next business day (OCC Bulletin 2006-39). Those are enforcement controls. Every one of them assumes a limit someone has already set well.
Does ACH origination software set exposure limits?
No. It stores and enforces a limit; setting one is a credit decision with an approval behind it. The OCC is explicit about the order: limits are set, and approved inside the bank, before the first ACH transaction is initiated (OCC Bulletin 2006-39; who signs that approval is in the treasury management checklist before go-live). A platform that lets an operations user type a new limit into a field keeps the setting and drops the approval.
The distinction matters most when the number goes down. At the sample bank the treasury credit officer cut Pinecrest's limit from $2,000,000 to $1,200,000 after its unauthorized return rate crossed Nacha's 0.50% line. In a by-hand process the cut would be emailed to operations and retyped. In the solution the approved limit, its prefunding rule and its $210,000 reserve go to the payments hub only after a second person checks them, and the hub's confirmation lands on the same trail as the approval.
The twelve tasks of an originator review, and why seven are gathering
Read the OCC's underwriting standards and the FFIEC's monitoring procedures side by side and an originator review falls into twelve tasks. The first seven produce facts: what the client sent, how its returns ran, why, what its statements say, what its controls questionnaire says, what limit its files support, and what plan and evidence follow. The last five turn facts into decisions: an analyst's recommendation, a credit rating, an approval, an independent check and release, and the letter and actions that follow.
By hand, the fact-finding takes most of the time. Our estimate for one off-cycle review at a regional bank, built from the steps above, is about eleven days from trigger to loaded limit, of which seven and a half go to building the file history, rebuilding rates, chasing statements and reading the questionnaire. The sample bank's own estimate is about three analyst hours a review, across 2,450 reviews a quarter: roughly 7,350 hours a quarter, the working time of about fourteen full-time analysts, before anyone has made a decision. That is the workload origination software leaves untouched, because none of it happens at file release.
One originator assessed by agents, from five systems, in minutes
7
agents run on one assessment, from scheduling to the evidence pack
5
systems read: payments hub, origination platform, core, credit system, case management
4:12min
from the first read to one recommendation, every value traced
0.90
confidence floor: below it nothing is asserted, it goes to a person
What tasks can be automated in an ACH originator review?
The seven that are reading, measuring and drafting: tasks where the right answer is in a file, a statement, a questionnaire or a rule, and the work is finding it and showing it. This is the kind of work the Treasury Department's 2024 review of AI in financial services heard named as near-term: respondents listed risk identification and assessment, and querying and extracting from documents, among the early uses of generative AI (U.S. Treasury, AI in Financial Services, December 2024), views of respondents rather than findings of the Department; their own words are quoted in AI in banking operations.
Automation is only useful here if the output can be checked. Each agent in the solution cites what it used: the settlement day in the file history, the return code in the return file, the page of the statement, the sentence in the questionnaire, the text of the rule. The Returns agent's work on Pinecrest shows why that matters. It did not stop at 0.62%; it found that 1,673 of the 2,560 unauthorized returns came through a seven-day free trial launched on May 4 that converted to a $59.99 monthly debit with no second authorization, and that members who enrolled before the trial returned at 0.11%.
The rate, the arithmetic and the cause on one screen
Which ACH review tasks stay with people, and why?
Five tasks stay with people because they carry authority or accountability that an agent cannot hold: recommending, rating, approving, checking and releasing, and speaking to the client. The OCC's guidance treats ACH exposure as unsecured credit, approved by people with authority under the bank's credit policy; the FFIEC's procedures go further on the limit itself and ask that "Entries in excess of the exposure limit receive prior approval from a credit officer" (FFIEC, Appendix A).
In the solution those limits are built into what the agents may do. No agent approves a limit, checks one, releases it to the payments hub, sends a client letter or closes a remediation action. The review orchestrator never writes a recommendation of its own and stops at analyst review. The Financials agent never rates the credit and never uses a value it cannot cite. The Monitoring agent never attests on the originator's behalf. These are not preferences; they are the reason an examiner can follow who decided what.
One review, task by task: where the agents stop and people decide
Agent
Review orchestratorSchedules the review from the tier cadence or a trigger, gathers from five systems and runs the specialists.
Never: writes a recommendation of its own.
Agent
Returns and Exposure agentsMeasure the three rates, name the cause, and propose a limit, prefunding rule and reserve from ninety days of files.
Never: load a limit or propose one above the tier cap.
Agent
Financials and Monitoring agentsSpread the statements with every value cited, and quote each controls answer against the rule and last year's.
Never: rate the credit or mark a gap closed.
A person decides
ACH risk analystReads the page, disputes any value with a reason that stays on the record, and sends the recommendation for approval.
A person decides
Treasury credit officerApproves within authority, choosing a reason code from the bank's own library and signing.
A person decides
ACH risk managerChecks what she did not prepare and releases the limit to the payments hub.
Agent
Remediation and Evidence agentsDraft the plan, track its clock and build the indexed evidence pack.
Never: send a letter or close an action.
A person decides
Treasury management officerSends the client letter: the limit, the prefunding, the reserve, the plan and the dates.
Where the origination platform and the agents meet
They meet twice: once when the agents read what the platform knows, and once when an approved limit goes back. The platform and the payments hub hold the ninety days of files, the limits in force, the files released and the return files; the agents read those and do not change them. After approval and an independent check, the new limit, prefunding rule and reserve go to the payments hub, which confirms them. At the sample bank that confirmation came at 10:36 a.m. on October 20, effective with the next morning's file.
Everything the origination platform does at release time stays where it is: dual approval of files by the client, limit and funds checks, holds and exceptions. The solution changes what the platform is told, and how well the number it enforces is supported, not how files move.
Prepared, approved and checked by three different people before the hub takes the limit
What to look for in ACH origination software when risk review is part of the purchase
If the purchase is meant to cover risk review as well as file movement, ask questions that separate enforcing a number from supporting it. A demo that shows a file stopped at its limit proves the first; the second needs the tool to show where the limit came from.
Questions to ask any ACH origination or risk tool before you buy
- Where does the limit come from?
From the client's own settlement history with the arithmetic shown, or from a field someone types into?
- Does it watch the whole book every night?
A rate that is rising but still under a line is invisible to an annual review; the bank's own warning level should be a setting.
- Can it read statements and questionnaires?
Most of an originator review is outside the files. If the tool cannot read them, the analyst still will.
- Who can change a limit, and how?
Look for an approval within authority, an independent check, and release to the hub without retyping.
- Are Nacha's lines locked and the bank's own policy versioned?
The 0.50%, 3.00% and 15.00% lines and the sixty-day window are rules; tiers, triggers and authorities are bank settings that should be previewed before saving.
- What does the examiner get?
One indexed pack per originator, or a sample, with the arithmetic, approvals and evidence, and customer account numbers masked.
Where the solution sits beside an origination platform, and where it stops
ACH Originator Risk Assessment is not origination software and does not replace it. It does not build, approve or transmit files, process returns, or monitor individual entries for fraud, which is one way banks meet the risk-based monitoring Nacha's 2026 rules require of each originating bank and non-consumer originator (Nacha, Fraud Monitoring Phase 1; the rules themselves are set out in the guide to the 2026 Nacha fraud monitoring rules). It reads the origination platform, the payments hub, the core, the commercial credit system and case management, and it hands the payments hub an approved, checked limit.
If a bank's limits are already derived and reviewed well and its problem is file handling, an origination platform is the right purchase and this solution is not. If the platform works and the review behind it is the bottleneck, the comparison of approaches in ACH risk management software vs spreadsheets vs agents is the next read, and the method for the limit itself is in how to calculate an ACH exposure limit. To try the division of work on your own originators, start from ACH Originator Risk Assessment.
Questions people ask
What is the difference between an ACH origination platform and treasury software that makes ACH files?
Treasury or accounting software on the client's side produces payment files and sends them to the bank. The bank's origination platform receives them, applies entitlements, approvals, limits and funding checks, and releases them to the ACH Operator. Neither decides the client's exposure limit; that is the bank's credit decision.
Who approves an ACH exposure limit?
The person the bank's credit policy names for that amount of unsecured exposure. At the sample bank the ACH risk manager approves up to $1,000,000, the treasury credit officer up to $5,000,000, the credit committee up to $25,000,000 and the chief credit officer above that, with a second person who did not prepare the assessment checking it before release.
Can the agents load a new limit into the payments hub on their own?
No. The Exposure agent never loads a limit. An approved limit reaches the payments hub only after a named credit officer has signed it and a risk manager who did not prepare it has checked and released it.
Does origination software meet Nacha's 2026 fraud monitoring rules?
It can contribute, but the rules ask for risk-based processes and procedures, reviewed at least annually, not for a product. Nacha's FAQ treats a robust return and return-rate monitoring program as the minimum for debits, and allows an ODFI's processes to take account of other participants' processes where relying on them is reasonable.
How long does it take to see the agents work on our own originators?
The usual first step is a sample: the solution is run over a set of the bank's own past originators' file and return history, and the limits it derives are compared with the ones the bank approved. The design target for a live review is one day from file history to a limit decided, checked and loaded.