An ACH originator risk assessment template is the form a sponsoring bank completes for every business it originates ACH entries for: who the originator is, whether it can fund what it sends, which entries it may send and how much of them, how its returns run, how good its own fraud controls are, and who approved the result. A good template is short on free text and long on sources, because every answer has to survive an examiner asking where it came from. The elements below follow the underwriting standards in OCC Bulletin 2006-39, the FFIEC's examination procedures and Nacha's public rule pages. Botminds' ACH Originator Risk Assessment fills the same ten elements from the bank's own systems, cites each value, and leaves the approval to named people.
The filled-in example on this page is a fictional sample originator, Pinecrest Membership Clubs, assessed at a fictional bank, Corvane. Its figures are sample data from the solution.
The ACH originator risk assessment template: ten elements, each with its source
1The originator and its owners
What it recordsLegal name, Company IDs, principal business, location, principal owners, background check, and whether the business is desirable, restricted or prohibited under policy
Filled fromOnboarding file, KYC record, public registries
WhoAnalyst
2Financial capacity
What it recordsSpread of the latest statements, the internal rating, which statements are due and when, and any that are late
Filled fromCommercial credit system, statement pages
WhoAnalyst; rating by credit
3Sales and origination history
What it recordsNinety days of files by settlement day, entry class, credit or debit, with the average and the peak
Filled fromPayments hub, origination platform
WhoAnalyst
4Entry classes
What it recordsThe codes the agreement permits beside the codes actually sent, and any mismatch
Filled fromOrigination agreement, file history
WhoAnalyst
5Exposure limit and mitigants
What it recordsProposed limit, its basis and cap, the prefunding rule and any return reserve, each with its arithmetic
Filled fromFile history, statements, policy
WhoAnalyst proposes; credit officer approves
6Return rates
What it recordsUnauthorized, administrative and overall rates over sixty days or two months, the denominator used, and the cause
Filled fromReturn files by code
WhoAnalyst
7The originator's own controls
What it recordsAuthorization capture, account validation, revocations, change controls and its written fraud monitoring, with last year's answers
Filled fromControls questionnaire, officer attestation
WhoAnalyst; originator attests
8Risk tier and cadence
What it recordsTier, next review date and the events that would bring the review forward
Filled fromPolicy settings
WhoAnalyst proposes
9Remediation
What it recordsAny gaps, each with an owner, a date and the evidence that will close it
Filled fromElements 4 to 7
WhoAnalyst drafts; a person closes each action
10Decision and sign-off
What it recordsRecommendation, reason code, approver within authority, a second person's check, and the date the payments hub took the limit
Filled fromApproval and release steps
WhoCredit officer; risk manager checks
What goes into an ACH originator risk assessment?
Ten things, grouped around four questions: should the bank serve this business at all, can it fund what it sends, what and how much may it send, and are its own controls good enough. The first question is a know-your-customer question; the second is a credit question; the third is answered with an exposure limit and a list of permitted entry classes; the fourth has become a rule-driven question since Nacha's fraud monitoring rules took effect in 2026. The decision at the end ties them together, which is why a template that collects them on separate forms, owned by separate teams, rarely produces an assessment that agrees with itself.
The depth should vary. A payroll client sending prearranged credits to its own staff does not need the same file as an internet subscription business debiting consumers, and regulators say so.
The depth of a bank's initial review should match the level of risk posed by the originator.
OCC Bulletin 2006-39, Establishing Originator Underwriting Standards
In practice that means one template with optional depth: every element present for every originator, but the evidence required for elements 2, 5 and 7 rising with the risk tier. The sample bank asks a low-tier payroll client for its annual statements and a short controls attestation; it asks an elevated-tier consumer debit originator for interim statements, the full controls questionnaire and a reserve calculation.
Who is the originator, and should the bank serve it at all?
The first element answers whether the business is legitimate and inside the bank's appetite before any arithmetic starts. The OCC's underwriting standards tell banks to define desirable, prohibited and restricted originators and to require a background check that validates the legitimacy of the business, supplemented where needed by checks on its principal owners. The FFIEC's procedures ask whether acquisition policies "identify and seek to limit exposure to higher risk customers" (FFIEC, Appendix A), and its handbook names gambling and adult entertainment among them (FFIEC, ACH risk management controls).
Record the Company IDs as well as the legal name. An originator may send files under more than one Company ID, and Nacha's preparation checklist for ODFIs told banks to review return rates at the Company ID level as well as the originator level, because a problem that hides in one ID disappears in a blended total.
Can it fund what it sends? Financial statements, their type and timing
Element 2 is a credit analysis, and the OCC asks for one "similar to that performed on other potential unsecured borrowers". Its standards also tell banks to "Outline the type and timing of financial information to be provided by the originator", which turns a vague promise to send statements into a clock the template can check. A template should therefore record not only the spread but the due dates, and flag a statement that is late against them.
That flag is where many assessments quietly fail. Pinecrest's limit was approved on its FY2025 reviewed statements; its FY2026 interim statements were due on August 31 and, on October 20, were fifty-one days late, during the very months its debit volume and its returns rose. The solution's Financials agent spreads what it has, cites every value to its statement page, and asks for what is missing rather than carrying last year's numbers forward.
The spread, every value cited, and the missing statement said out loud
What may it send? Permitted entry classes against the codes it actually uses
Element 4 compares what the origination agreement allows with what the files show. The OCC's standards ask banks to "List permissible Standard Entry Class (SEC) types", and Nacha's Advisory Group tells originators plainly that "FIs may limit SEC codes to match the expected business needs of the Originator" (Nacha RMAG, Originator Essentials). How payroll and corporate entries split between those classes is set out in PPD vs CCD. The two lists drift apart in ordinary business: a corporate client starts collecting from consumers, or a subscription business adds telephone sign-ups.
The comparison matters because entry class decides how long debits can come back. Corporate entries carry a short return window; consumer entries returned as unauthorized can come back far later, and internet-authorized consumer debits carry their own validation rule. Pinecrest is approved for WEB and PPD debits, and its four largest settlement days were all WEB files. A template that records only the permitted list, not the observed mix, misses the shift that should have reopened the limit.
How much may it send? The exposure limit, its basis and its mitigants
Element 5 should hold the arithmetic, not just the number: the window read, the average and peak settlement day, the returns in flight, the basis the tier applies, the cap and the result. The OCC's standards ask for guidelines on setting limits, including prefunding or collateral, plus over-limit monitoring and approval. The full method, worked on Pinecrest's ninety days, is in how to calculate an ACH exposure limit; the template only needs to show the inputs and the result clearly enough that a second analyst would reach the same figure.
Record the mitigants beside the limit, because they change what the limit means. Pinecrest's approved limit of $1,200,000 comes with prefunding for any file above it and a $210,000 return reserve, five settlement days of returns at its current overall rate. Without those two lines, the limit reads as a cut; with them, it reads as a structure.
How do its returns run? Three rates and their cause
Element 6 records the originator's unauthorized, administrative and overall return rates against Nacha's lines of 0.50%, 3.00% and 15.00%, each over the preceding sixty days or two calendar months, with the denominator stated. Nacha's current calculation sheet counts R05, R07, R10, R11, R29 and R51 as unauthorized and allows either debits originated or debits in the original files as the denominator (Nacha, Calculate Unauthorized Return Rate); the template should name which one the bank uses, every time. The arithmetic itself is covered in the ACH return rate calculation guide.
A rate without a cause is half an answer. Nacha's preparation checklist for ODFIs listed what the bank should be ready to show if Nacha asked about an originator: its time in business and as a customer, its total volume, the numbers, rates and reasons for its returns, any rules violations or complaints, and evidence that it follows the reinitiation rules (Nacha, DFI Checklists). A template that captures those once a year is already most of the way to an inquiry response.
How good are its own controls? The questionnaire after the 2026 rules
Element 7 tests the originator's own controls, and since 2026 the rules give it a firmer spine. Nacha's fraud monitoring rules require non-consumer originators, as well as ODFIs and third parties, to keep risk-based processes reasonably intended to identify entries that are unauthorized or authorized under false pretenses, and to review them at least once a year. Phase 1 applied from March 20, 2026 to every ODFI and to originators and third parties with 2023 origination volume of 6 million entries or more (Nacha, Fraud Monitoring Phase 1). Phase 2, for every other non-consumer originator, carries a rule date of June 19, 2026; because that day was a federal holiday, Nacha set the practical effective date as Monday, June 22, 2026 (Nacha, Fraud Monitoring Phase 2, read October 26, 2026).
The rule does not prescribe the processes, and Nacha's FAQ suggests where an originator's effort belongs: "Originators may be best placed to implement procedures to protect against account takeover or other vectors for initiating unauthorized transactions." For internet-authorized debits there is also an older, specific requirement: since March 19, 2021 an originator's fraud detection for WEB debits must validate the account before its first use, and Nacha "does not consider a fraudulent transaction detection system that does not include an account validation component as sufficient" (Nacha, WEB Debit Account Validation).
Questions a 2026 originator controls questionnaire should ask, and how to read the answer
- How is each authorization captured, and can you produce it on request?
Ask for the stored text, the date and the identifying data, not a yes. Pinecrest stores the authorization text, IP address and timestamp for two years.
- When a free trial or a price changes, is a new authorization taken?
The gap behind most of Pinecrest's unauthorized returns: its trial converted to a paid debit with no second authorization.
- Is every new account validated before the first WEB debit?
Required since March 19, 2021. Compare with last year's answer: Pinecrest went from all accounts to 14% debited before validation completed.
- How fast is a revocation honoured?
Ask for the median, not the policy. Pinecrest's median rose from three business days to nine.
- Who can change payee or payroll instructions, and how is a change confirmed?
Change controls are where Nacha says originators are best placed to stop account takeover.
- Where is your written fraud monitoring process, and when did you review it?
The 2026 rules require review at least annually. Pinecrest's was dated February 2024 and never reviewed.
Ask for the answer as written, keep it, and compare it with last year's. The value of the questionnaire is in the change. A client that said every account was validated last year and now says 14% are debited first has told you something its return rates will show a month later; the solution's Monitoring agent quotes the sentence each answer was judged on and puts last year's beside it.
The originator's own controls, each answer quoted and compared with last year
ACH risk assessment requirements: what is required and what is good practice
Some elements are required by Nacha's rules, some are what examiners expect from guidance, and some are simply how a defensible file is built. Separating them matters when a template is trimmed for low-risk clients: the first two columns cannot be dropped, the third can be scaled.
Which parts of the template a rule requires, which examiners expect, and which are practice
| Element | Nacha requires | Examiners expect (OCC, FFIEC) | Good practice |
|---|---|---|---|
| Exposure limit | Set, enforce and periodically review one for every originator | Based on credit rating and activity; reasonable across all services; separate for WEB where warranted | Derive from the client's own files and show the arithmetic |
| Return rates | Unauthorized rate under 0.50%; administrative and overall levels open an inquiry | Rates reviewed at the originator level; unauthorized returns over board thresholds reported | Measure nightly and name the cause |
| Originator fraud controls | Risk-based monitoring, reviewed at least annually (2026); account validation for WEB debits (2021) | Risk assessments of originators that reflect a reasonable exercise of business judgment | Quote the answer and compare it with last year |
| Creditworthiness | Creditworthiness monitoring of each originator, as the FFIEC describes the rules | Underwriting standards, a credit file, periodic financial information | Cite each value to its statement page |
| Identity and legitimacy | Not set out in Nacha's public summaries | Background check; desirable, restricted and prohibited originators defined | Keep Company IDs, not just the legal name |
| Approval and evidence | Not set out in Nacha's public summaries | Internal approvals before origination; documentation and approval standards | Reason code, signature and a second person's check |
An ACH risk assessment example, filled in for one originator
Here is the template completed for the sample originator on the morning of October 20, 2026, after its unauthorized return rate crossed Nacha's 0.50% line. Each value is the one the solution put in front of the analyst, with its source.
ACH risk assessment example: the template for one sample originator
| Element | Pinecrest Membership Clubs | Source |
|---|---|---|
| 1. Originator | 112 fitness and racquet clubs, 204,000 members billed monthly; client since March 2021 | Relationship record |
| 2. Financial capacity | FY2025 EBITDA $21.3M, tangible net worth $14.7M, debt to EBITDA 2.93x; rating 5 Pass/Watch; FY2026 interim 51 days late | Reviewed statements, pp. 3–4; credit system |
| 3. Origination history | 63 settlement days in 90; $54,306,000; average day $862,000; peak $1,842,400 | Payments hub and origination platform |
| 4. Entry classes | Approved WEB and PPD; the four largest days were WEB | Agreement; file history |
| 5. Limit and mitigants | $2,000,000 → $1,200,000; prefunding above the limit; $210,000 reserve | Exposure arithmetic |
| 6. Return rates | Unauthorized 0.62% on 412,900 debits; administrative 1.18%; overall 4.90%; R10 is 84% of unauthorized | Return files, sixty days to October 16 |
| 7. Own controls | One pass, four gaps: no second authorization on trial conversion; 14% debited before validation; revocations nine days; monitoring process never reviewed | Questionnaire of September 24 and attestation |
| 8. Tier and cadence | Tier 2 → 3; next review brought forward to January 20, 2027 | Policy settings |
| 9. Remediation | Actions with owners and dates, weekly checkpoints, escalation before the deadline | Plan |
| 10. Decision | Approved with reason code LC-02 by the treasury credit officer; checked and released by the ACH risk manager | Approval and release, October 20 |
Approval, cadence and the record that outlives the analyst
Element 10 is what turns a completed form into a decision an examiner can follow. The FFIEC's procedures for internet-initiated entries ask whether the bank's risk assessments of its originators include documentation and approval standards and a set frequency, and whether they "reflect a reasonable exercise of business judgment" (FFIEC, Appendix A). Write down who prepared the assessment, who approved it within what authority, who checked it, and when the limit reached the payments hub.
The decision: what changes, the reason code and the signature
What to look for in an ACH risk assessment template or tool
A spreadsheet template is free and a reasonable start; its weakness is that every value in it is typed. Whatever form the template takes, five tests separate one that will hold up from one that will not: every value names its source; the return rate states its window and denominator; the controls answers are quoted and compared with last year's; the limit shows its arithmetic; and the approver, the checker and the preparer are three different people. How spreadsheets, rules modules and agents compare on those tests is the subject of ACH risk management software vs spreadsheets vs agents.
The solution fills this template for originators and for third-party senders reviewed as clients; it does not register third-party senders with Nacha or test their rules compliance audits, and it does not monitor individual entries for fraud, which is the work of an ACH fraud risk assessment. To see the template filled from a sample of your own originators, start from ACH Originator Risk Assessment.
Questions people ask
Is an originator risk assessment the same as the bank's annual ACH risk assessment?
No. The bank-wide assessment looks at the ACH program as a whole: volumes, products, third parties and controls. The originator assessment looks at one client and ends in a limit and a tier. The two meet in board reporting, where the OCC expects metrics on the composition of the originator portfolio and return rates by originator.
How often should an originator risk assessment be redone?
At least annually for every originator, and more often for higher tiers; the sample bank uses annual, annual, semiannual and quarterly across four tiers. An off-cycle assessment should follow any trigger that changes the inputs: a return rate crossing the bank's warning level, a limit increase request, a downgrade, late statements, a change of control or a new higher-risk entry class.
Does a low-risk payroll client need the full template?
It needs every element, but not the same depth. The OCC says the depth of review should match the originator's risk, so a payroll client sending credits to its own employees may need only annual statements, a limit, its return rates and a short controls attestation, while a consumer debit originator needs interim statements and the full questionnaire.
Who should fill in the controls questionnaire?
The originator answers it and an officer of the originator attests to it; the bank's analyst judges the answers. The 2026 fraud monitoring rules put the duty to have the processes on the originator itself, so the bank's file should hold the originator's own words, not the analyst's summary of them.
What return codes count as unauthorized in the assessment?
Nacha's current calculation sheet lists R05, R07, R10, R11, R29 and R51. R11 was added to the unauthorized group after the 2015 rule that set the 0.50% line, so an older template that lists only five codes understates the rate.