ACH risk manager: the job, the team, and what agents change

An ACH risk manager owns an originating bank's ACH risk program: the policy that tiers originators and sets their limits, the monitoring of every originator's return rates against Nacha's lines, the schedule of reviews and the clocks behind them, the independent check on every limit decision, and the evidence that examiners, auditors and Nacha may ask for. The role sits between credit, which approves exposure, and operations, which moves the files, and it answers to a board that sets the bank's appetite. The work is hard because it is high-volume and evidence-heavy: thousands of originators, each with files, returns, statements and a controls questionnaire in different systems. Botminds' ACH Originator Risk Assessment gives the team seven agents for the gathering and arithmetic, and leaves every approval, check and client conversation with a named person.

The team described here is a fictional sample bank's, Corvane, with fictional people and a book of 9,800 originators; its figures are sample data from the solution. Hours are the product's estimates.

What does an ACH risk manager do?

The ACH risk manager runs the machinery that keeps every originator inside a reviewed limit and under Nacha's return rate lines, and proves it. In practice that is six jobs. Keeping the policy current: tiers, limit bases, warning levels, cadences and approval authority. Watching the book: every originator's unauthorized, administrative and overall return rates against Nacha's 0.50%, 3.00% and 15.00% lines and the bank's own earlier warnings. Running the review calendar and the off-cycle triggers. Checking limit decisions she did not prepare. Answering Nacha when it asks about an originator. And keeping the evidence for examiners and auditors.

Since 2026 there is a seventh. Nacha's fraud monitoring rules require every originating bank, and every non-consumer originator, to keep risk-based processes reasonably intended to identify unauthorized entries and entries authorized under false pretenses, reviewed at least annually (Nacha, Fraud Monitoring Phase 1). Fraud monitoring of entries usually sits with a fraud team; the ACH risk manager's part is making sure each originator's own processes are tested at review, and that the tests are on file.

Who owns ACH risk at a bank?

The board owns the appetite, management owns the program, and credit owns the exposure decisions. The OCC is explicit: "Both the board of directors and management are responsible for ensuring that the ACH program does not expose the bank to excessive risk," with the board setting the bank's ACH strategy and risk limits and overseeing management's implementation, and management building the controls and reporting results to the board regularly (OCC Bulletin 2006-39).

Within management, examiners look for a line between credit and operations. The FFIEC's procedures ask whether originators' creditworthiness is monitored on an ongoing basis and whether "Competent credit personnel perform monitoring, independent of ACH operations" (FFIEC IT Handbook, Retail Payment Systems, Appendix A). That is why the analyst who prepares an assessment, the credit officer who approves it and the operations team that loads and enforces the limit are different people, and why the ACH risk manager, who checks and releases, cannot be the person who prepared it.

How is an ACH risk team organized?

Around one decision, the limit, with each seat owning a different part of it. At a large bank each seat is a team; at a community bank one person may hold two, but never both preparer and checker on the same assessment.

Who approves ACH exposure limits?

Whoever the bank's credit policy names for that amount of unsecured exposure, and never the person who prepared the assessment. The OCC asks banks to set limits and obtain internal approvals before origination begins, and to keep over-limit approvals consistent with their policy for unsecured credit. A ladder makes that concrete. At the sample bank the ACH risk manager may approve up to $1,000,000, the treasury credit officer up to $5,000,000, the treasury credit committee up to $25,000,000 and the chief credit officer above that.

Two rules make the ladder work. A second person who did not prepare the assessment checks it before it reaches the payments hub; where the same person would be both, the assessment goes one level up, and there is no override. And the check applies to a limit that falls exactly as it does to one that rises. A cut is when the client calls, which is why it is the check most often skipped by hand.

Prepared, approved and checked: three people, one authority ladder

What does an ACH risk analyst do? The job behind the job description

The analyst prepares the assessments the rest of the team decides on, and most of the job by hand is assembling facts. The Bureau of Labor Statistics has no occupation for ACH risk analysts; the nearest is financial analysts, within which it notes that "Financial risk specialists, also called financial risk analysts, assess and measure exposure to credit and market risk" (BLS, Financial Analysts). Financial analysts held 443,100 jobs in 2025 at a median of $103,570 a year.

By hand, those hours go on exporting daily reports to build a ninety-day picture, rebuilding three return rates, chasing statements, sending a questionnaire and reading the answers weeks later, and writing a memo. With the agents, the analyst opens an assessment prepared overnight: three gauges, ninety days of files with the current and proposed limits across them, a spread with each value opening its statement page, and the controls answers quoted against the rules and last year's. The job becomes reading, challenging and recommending. Where the agents are less sure than a 0.90 confidence floor, the value comes to the analyst as a question rather than an answer.

The team after agents: what moves and what stays, seat by seat

What moves is the reading and the arithmetic. Seven agents divide it: an orchestrator schedules each review and gathers from the payments hub, the origination platform, the core, the commercial credit system and case management; a Returns agent re-measures every originator's three rates nightly and names the cause; an Exposure agent proposes the limit, prefunding rule and reserve from ninety days of files; a Financials agent spreads statements with every value cited; a Monitoring agent tests the originator's controls against the rules and last year's answers; a Remediation agent drafts the plan and client letter and tracks the deadline; an Evidence agent builds the indexed pack.

What stays is every decision and every conversation. The analyst's recommendation, the credit officer's approval and rating, the risk manager's check and release, the treasury officer's letter and the closing of each remediation action with evidence are all people's. On the sample bank's morning of October 20 the assessment of Pinecrest Membership Clubs, the originator over Nacha's 0.50% line, was assembled by the agents in four minutes and twelve seconds; it then took the analyst, the credit officer and the risk manager from 9:40 to 10:34 to read, decide, sign and check, which is where the time should go.

The risk manager's own work: settings, clocks and the book

With the rebuilding gone, the risk manager's job shifts toward the program itself. The policy becomes settings she can change, versioned and previewed: at the sample bank, setting the bank's unauthorized warning level at 0.35% brings 286 originators onto the desk for an off-cycle review this quarter, and the screen says so before anything is saved. Nacha's three lines, the sixty-day window and the denominator are locked, because they are the Operating Rules.

The clocks become visible rather than remembered. The sample bank's settings require an assessment to be prepared within two business days, approved within three, checked within one and loaded the same day, with each miss escalating one level up. A remediation plan carries its own deadline and weekly checkpoints. Nacha's Advisory Group reminds banks that monitoring origination and return activity across settlement dates, and enforcing limits, are rule requirements (Nacha RMAG, March 2025); a dashboard that shows every limit, every rate and every clock in one place is how a risk manager shows they are met.

The book, by tier and entry class, and how the quarter is going

What does an ACH risk manager report to the board?

The numbers that show whether ACH activity stays inside the board's parameters. The OCC's list includes trends in volume, returns, losses and transaction types; the composition of the originator portfolio; capital adequacy relative to ACH volume and originator risk; the share of deposits linked to ACH origination; return rates by originator; unauthorized returns over board thresholds; Nacha notices and fines; and performance against approved risk parameters. How examiners read those reports, and the originator files behind them, is set out in how examiners test your originators.

For the sample bank's quarter the originator part of that report is short: 9,800 originators, 7 over a Nacha line, 14 of 19 brought back under a line, 118 limits reduced and 206 increased, 61 moved to a higher tier, 94% of reviews on time and 38 past due. The value is less in the numbers than in being able to open any one of them and reach the assessments behind it. What that program costs to run in analyst hours is priced in what one originator review really costs; to see the team's day on your own originators, start from ACH Originator Risk Assessment.

Questions people ask

Is there an ACH risk manager certification?

The credential examiners mention is the Accredited ACH Professional (AAP), awarded by Nacha. The FFIEC's procedures list, among the things examiners consider about retail payment staff, "Adequacy and quality of staff resources, including certifications such as an Accredited ACH Professional (AAP)." It is not required by any rule.

Is ACH risk part of credit or of operations?

Both, by design. Exposure decisions belong to credit, with monitoring by credit people independent of ACH operations, as the FFIEC's procedures expect; files, holds and limit enforcement belong to operations. The ACH risk manager usually sits between them, owning the program and the independent check.

How many originators can one ACH risk analyst cover?

No rule sets a number; it follows from hours. At the product's estimate of three hours a review, an analyst with, say, 1,800 productive hours a year could complete some 600 reviews, so a book that needs 10,900 a year needs a team. Reducing the gathering is what changes that ratio.

Does the ACH risk manager own fraud monitoring?

Usually not the monitoring of individual entries, which sits with a fraud team. The ACH risk manager's part is that each originator's own fraud processes, required since 2026, are tested at review and that the bank's program is reviewed at least annually, as Nacha's rules require.

What is the difference between an ACH risk manager and an ACH operations manager?

The operations manager runs files, returns, exceptions and settlement; the risk manager decides with credit how much each originator may send and proves the decision was sound. The two meet at the payments hub, where the limit the risk side approves is the limit operations enforces.