ACH originator annual review: follow each number to its source

An ACH originator annual review is the bank's scheduled re-underwriting of each business it originates ACH entries for: refresh the financial statements, re-measure the return rates, re-read the settlement history, re-test the originator's own controls, and confirm or change the exposure limit with a fresh approval. Regulators expect it at least once a year, and more often for riskier clients. What makes a review defensible is not that it happened but that every number in it can be traced back to where it came from, because an examiner or auditor will pick a number and ask. Botminds' ACH Originator Risk Assessment cites each value to its file, return code, statement page or rule; this guide follows five of them through one review and marks the places where, done by hand, they usually go wrong.

The review followed here is of a fictional originator, Pinecrest Membership Clubs, at a fictional bank, Corvane; its figures are sample data from the solution. It began off-cycle, when a warning level fired, which is when the trail matters most.

What is an ACH originator annual review?

It is the periodic part of ACH underwriting: the same questions asked at onboarding, answered again with current evidence. The OCC's guidance sets the minimum rhythm in one sentence, telling management to "require lending and ACH operations personnel to consult with one another at least annually or more often, if necessary, to confirm that the originator's financial condition has not changed from the time the credit facility was approved" (OCC Bulletin 2006-39). The FFIEC's procedures ask examiners whether exposure limits are reviewed periodically and adjusted when an originator's rating or activity changes (FFIEC, Appendix A).

The OCC also says what the review should leave behind: "The bank should maintain a credit file on the originator that will include the types of ACH transactions that are authorized, the bank's financial analysis and evaluation of creditworthiness, and approved exposure limits for daily and multi-day settlements." Each of those is a number or a list someone has to source: entry classes from the agreement and the files, financial analysis from statements, limits from history and policy. The review is the moment each is refreshed.

How often should ACH originators be reviewed?

At least once a year, more often as the risk tier rises, and immediately when a trigger fires. The annual floor comes from the OCC's annual consultation between lending and ACH operations; the rest is the bank's policy. The sample bank reviews its low and standard tiers annually, its elevated tier twice a year and its high-risk tier quarterly, and it opens an off-cycle review on a warning-level crossing, a limit increase request, a change of control or a new higher-risk entry class.

Since 2026 the annual review has a second annual clock inside it. Nacha's fraud monitoring rules require each non-consumer originator to keep risk-based processes to identify unauthorized entries and entries authorized under false pretenses, and to review them at least annually; for originators below the phase 1 volume threshold the rule date was June 19, 2026, with a practical effective date of Monday, June 22, 2026 (Nacha, Fraud Monitoring Phase 2, read October 26, 2026). A bank's annual review is the natural place to see that the originator's own review happened. Pinecrest's written monitoring process was dated February 2024 and had never been reviewed.

Five numbers in one review, and where each comes from

A review has dozens of values; five carry the decision. Each comes from a different system, is computed a different way and lands in a different place, and each can break between source and decision. The table follows them through Pinecrest's review.

Number one: the unauthorized return rate, from return file to gauge

The rate is the number most easily recomputed two different ways. Nacha's calculation sheet allows two denominators, debits originated in the period or debits contained in the files the returned entries came from, over the preceding sixty days or two calendar months, and lists R05, R07, R10, R11, R29 and R51 as unauthorized codes (Nacha, Calculate Unauthorized Return Rate). Two analysts choosing differently will both be right and will disagree. The fix is to choose once, in policy, and show the choice on every assessment.

Pinecrest's rate is shown with its window (August 18 to October 16, 2026), its denominator (412,900 debit entries originated in the window) and its numerator by code (R10 alone is 2,150 of the 2,560). The number on the gauge, 0.62%, is the same number in the memo, the reason code and the evidence pack, because none of them was retyped. The arithmetic of the three rates in full is covered in the ACH return rate calculation guide.

The rate with its window, denominator and codes, and the cause beside it

The rate also carries a cause, and the cause is what makes the review useful rather than merely compliant. Of the 2,560 unauthorized returns, 1,818 were on members debited within forty-five days of enrolling, and 1,673 of those came through a seven-day free trial launched on May 4 that turned into a $59.99 monthly debit with no second authorization. Members who joined before the trial returned at 0.11%. A review that records 0.62% without that sentence leaves the credit officer to guess what to fix.

Number two: the peak settlement day, from file history to the limit

The peak is the input the limit rests on, and it is easy to understate. Read from the files alone, Pinecrest's largest settlement day in ninety was $1,842,400, on October 1; add the $124,600 of debits that had settled earlier and could still come back, and the peak need was $1,967,000, or 98% of the $2,000,000 limit. A review that takes the peak from a monthly summary rather than from the settlement days misses both the size and the date, and with them the link to the month-start billing file that drives it.

The trail matters here because the peak is the number a client will dispute. When the treasury officer explains a cut, the client's first question is where the number came from; in the solution, the four settlement days above the new $1,200,000 limit are listed with their dates, entry class and amount over, and each opens its file. The full method from peak to limit is in how to calculate an ACH exposure limit.

Number three: tangible net worth, from statement page to cap

Financial capacity enters the review as a cap: the sample bank caps an elevated-tier limit at 65% of tangible net worth. Pinecrest's $14,700,000 comes from page 4 of its FY2025 reviewed statements, so the cap is $9,555,000. The number is only as current as the statement, and the FFIEC asks examiners to check that "Written agreements with originators require the submission of periodic financial information" (FFIEC, Appendix A). Requiring the information is half of it; noticing when it does not arrive is the other half.

Pinecrest's FY2026 interim statements were due on August 31 and, on October 20, were fifty-one days late. The limit had been set in January on the FY2025 year, before a trial product changed the business. The Financials agent spreads what exists, cites every value to its page, and flags the missing interim against the date the credit memo set; the request goes into the plan rather than the old figure going into the cap unremarked.

Number four: the controls answer, quoted and compared with last year

Controls answers are the numbers most often lost in a by-hand review, because they arrive as free text and are summarised as "satisfactory". The value of the questionnaire is in the change from one year to the next, and that only shows if both years' answers are kept in the originator's own words. Nacha's WEB debit rule, in force since March 19, 2021, makes one answer especially worth comparing: whether each new account is validated before its first debit (Nacha, WEB Debit Account Validation).

Read the right-hand column against the returns and the review explains itself: the trial without a second authorization produced the R10s, slower revocations produced the R07s, and accounts debited before validation are exposed to the account-data returns that an administrative rate counts. Without the comparison, the reviewer sees a questionnaire that is mostly ticked; with it, a client whose controls weakened in the same months its returns rose.

Number five: the limit, from approval to the payments hub

The last number is the one the review exists to set, and the one most often broken after the decision. A limit approved in a memo and then typed into the payments hub by someone else can be mistyped, loaded days later, or not loaded. The OCC's credit file includes the approved limits for daily and multi-day settlements; an examiner comparing the file with the payments hub expects them to match.

In Pinecrest's review the credit officer approved $1,200,000, prefunding above it and a $210,000 reserve at 10:21 a.m.; the ACH risk manager, who had not prepared the assessment, checked and released it at 10:34; the payments hub confirmed at 10:36, effective with the file of October 21. The same release carried the remediation plan, with a deadline the sample bank's policy sets thirty days from the day the rate crossed Nacha's line.

The plan after the limit: the bank's own thirty-day clock and its checkpoints

That distinction is worth keeping straight in any review file. Nacha's own summary of its process describes Nacha identifying an originator above the unauthorized line from operator data, writing to the bank, and, if the bank acknowledges the breach, expecting a plan to bring the rate under 0.5% within thirty days, followed by monitoring for 180 more (Nacha, Risk and Quality Rules fact sheet). A bank that starts its own clock on the day of the crossing is ahead of that process, not following it; the file should say which clock is which.

Where review numbers break, and the checks that catch them

Across the five numbers the failures are the same three: an input that is stale, a method that varies between people, and an output that is retyped. A second person who checks the assessment is the control for all three, if the check is specific. At the sample bank the ACH risk manager checks five things before release.

Is the annual originator review the same as the Nacha audit?

No. The annual Nacha rules compliance audit tests whether the bank, as a participant, follows the Nacha Operating Rules, and it is due by December 31 each year; the originator review tests one client's credit, limit and controls and can fall in any month. The two meet in the evidence: an audit that samples exposure limits or return-rate monitoring will reach for the same review files. What the Nacha audit itself should hold is set out in the guide to ACH rules compliance audit evidence, and how examiners use the review files in how examiners test your originators.

To see the five numbers traced on your own originators' files, start from ACH Originator Risk Assessment.

Questions people ask

Does an ACH originator have to send financial statements every year?

If its agreement says so, and regulators expect agreements to. The OCC asks banks to set out the type and timing of financial information each originator must provide, and the FFIEC checks that agreements require periodic financial information. Higher-risk originators commonly owe interim statements as well; Pinecrest's were due on August 31.

What triggers an off-cycle originator review?

Anything that changes the inputs the limit was built on. At the sample bank that means an unauthorized return rate over its 0.35% warning level, a breach of a Nacha line, a limit increase request, a change of control or a new higher-risk entry class; a downgrade or late statements are worth adding. Pinecrest's review was triggered by the warning level on September 2, seven weeks before its rate crossed Nacha's line.

Who should sign the annual review?

The person with credit authority for the limit, and a second person who did not prepare it. At the sample bank the analyst prepares, the treasury credit officer approves limits up to $5,000,000 with a reason code and typed signature, and the ACH risk manager checks and releases.

How long should an annual review file be kept?

As long as the bank's retention policy says, which should cover examination cycles and any dispute about the limit. The sample bank keeps assessments five years after the relationship ends and originators' authorizations two years after the last entry, with customer account numbers shown only as the last four digits.

What if the review finds the limit was right all along?

Record that as a decision, with a reason. A limit reviewed and left unchanged without a stated reason reads to an examiner like a review that did not happen. At the sample bank 1,518 limits were left unchanged this quarter, and in the solution every decision, including no change, carries a reason code and a signature.