ACH underwriting: what one originator review really costs

ACH underwriting is the credit review a bank performs before it lets a business originate ACH entries, and repeats on a schedule afterwards: who the business is, whether it can cover what it sends, which entry classes it may use, and what exposure limit and prefunding apply. Regulators expect it to be done like any other unsecured credit decision, by people with authority, from a credit file. The cost is in the repetition. One review takes an analyst a few hours, but a bank with thousands of originators runs thousands of them a year, and most of each review is spent gathering files, statements and questionnaire answers rather than deciding. Botminds' ACH Originator Risk Assessment takes the gathering and the arithmetic; this guide prices the work so a bank can see what that is worth on its own book.

The figures for the book come from a fictional sample bank, Corvane, with 9,800 originators; the hours are the product's estimates, and the wage is the Bureau of Labor Statistics median for the nearest occupation. All cost figures are our arithmetic and are marked as estimates.

What is ACH underwriting?

It is the bank's decision to extend unsecured settlement exposure to an originator, made the way any credit is made. The OCC puts it directly: "As with other types of credit exposures, each bank's loan policies should include formal underwriting standards and an approval policy for ACH originators" (OCC Bulletin 2006-39). The FFIEC's handbook says a bank's policies "should treat all ACH customers as unsecured borrowers that are subject to the institution's standard credit review and approval process" (FFIEC IT Handbook, ACH risk management controls).

The underwriting standards the OCC describes run from onboarding to exit: define which originators are desirable, restricted or prohibited; check the business and, where needed, its owners; evaluate creditworthiness with a full financial analysis; say what financial information is required and when; review sales history; list the permitted entry classes; set exposure limits with any prefunding or collateral; monitor and approve anything over the limit; set out termination procedures; and keep the right to audit the originator's ACH controls. The full list, element by element with where each answer comes from, is in the ACH originator risk assessment template.

Is ACH underwriting the same as a credit decision?

In method, yes; in the exposure it prices, no. The method is a credit method: statements, a rating, a limit, an approval within authority. The OCC notes in a footnote that "Some banks may choose to use the same risk management policies and procedures they use for short-term unsecured extensions of credit to manage the risk associated with merchants and commercial customers originating ACH transactions." What differs is the exposure. There is no loan to repay; the risk is the gap between the bank paying out on a file and the client covering it, and on debit files the returns that arrive after the client has been paid.

That is why the review cannot be a one-off. A loan is underwritten mostly at origination and monitored through covenants; an ACH exposure changes every time the client changes what it sends. The sample originator, a fitness chain called Pinecrest, had a $2,000,000 limit set in January on its FY2025 statements. A free trial launched in May changed both its volume and its returns, and by October its peak day needed 98% of the limit. No covenant would have caught that; only a review that reads the files would.

ACH underwriting guidelines: how deep each review should go

The guidance is clear that depth should follow risk. "Banks engaged in complex or high-risk ACH transactions should implement more stringent underwriting standards than banks that only conduct traditional, lower-risk ACH transactions," the OCC writes, and the initial review of an originator should match the risk it poses. In practice that means tiers: the same elements for every originator, with more evidence, a tighter limit basis and more frequent review as the tier rises.

The sample bank writes four tiers. Low-risk originators, 6,120 of its 9,800, are reviewed annually with a limit of twice their average settlement day. Standard-risk originators, 2,840, are reviewed annually at 1.25 times their peak day. Elevated-risk originators, 710, are reviewed twice a year with the limit held at their peak day and capped at 65% of tangible net worth, and prefunding above it. High-risk originators, 130, are reviewed quarterly with a 40% cap and prefunding on every file. Cadence is where most of the cost sits, so it is worth setting deliberately.

How long does an ACH originator review take?

Two answers, and both matter: a few hours of an analyst's effort, spread over about two weeks of elapsed time. The product's persona estimate is about three hours of analyst time a review. Its estimate for elapsed time, for one off-cycle review at a regional bank done by hand, is about eleven days from trigger to loaded limit, because most steps wait on someone else: a statement requested from the client, a questionnaire returned weeks later, an approval in someone's inbox.

The split is the argument of this page. By hand, more than two-thirds of the elapsed time goes on finding facts: building the file history, rebuilding rates, chasing statements and reading questionnaire answers. With the agents, the decision becomes the biggest share of a much shorter process. That is the right shape for a credit process: the scarce resource, a credit officer's attention, is spent on the judgment, not on waiting.

How much does an ACH originator review cost?

On wages alone, about $150 of analyst time for a routine review, before the credit officer's and checker's time and before any off-cycle work. That figure is deliberately conservative: it uses the BLS median for financial analysts, $49.79 an hour in 2025 (BLS, Financial Analysts), the nearest standard occupation to an ACH risk analyst, and the product's estimate of three hours a review. A bank's loaded rate, with benefits and overhead, will be higher, and its own hours may be too.

One review at $150 is not the problem. Thousands of them are. The sample bank's tiers produce 10,900 scheduled reviews a year: 6,120 and 2,840 annual reviews, 710 originators reviewed twice and 130 reviewed four times. At three hours each that is 32,700 analyst hours, about $1.63 million in median wages, or 15.7 full-time analysts at 2,080 paid hours, before a single off-cycle review. If the 286 off-cycle reviews of this quarter were typical, they would add about 3,400 hours a year.

The table shows where the money goes, and it is not where the risk is. More than four-fifths of the hours are spent on tiers 1 and 2, the tiers the bank itself rates least risky, because there are so many of them. Tiers 3 and 4, which carry the prefunding and the closest attention, take about 18% of the hours. A bank that wants to spend more of its analysts' time where the risk sits has two levers: fewer reviews on low tiers, or cheaper reviews everywhere.

Why reviews get thinned, and what thinning costs

When the hours run out, reviews do not stop; they get thinner. The financial statement is last year's, the questionnaire is not sent, the return rate is read from a report rather than rebuilt, and the memo says the limit is unchanged. Each shortcut saves hours. Each also removes the part of the review that would have noticed a change.

The sample bank's review desk shows the signs a programme is stretched: 38 reviews past due across the book, 2,450 due this quarter. The product's persona for the ACH risk manager describes the check that is skipped most often as the one on a limit cut, exactly when the client is calling. And Pinecrest shows the cost of a calendar that cannot keep up: its next scheduled review was in March 2027, while its unauthorized return rate crossed the bank's warning level in September and Nacha's 0.50% line in October.

A review desk with 2,450 reviews due this quarter and 38 past due

What lowers the cost of a review without lowering the review

Making the gathering cheap, not the judgment. In the product's estimate, an off-cycle review that takes about eleven days by hand takes under one with the agents doing the reading and arithmetic, and the design target is one day from file history to a limit decided, checked and loaded. The analyst's hours shift from rebuilding to reading: three gauges, ninety days of files, the spread with each value opening its statement page, and the controls answers quoted against the rules and last year's.

The credit step does not get cheaper, and should not. The credit officer still reads the recommendation, tests a different limit against the client's own files, chooses a reason code and signs; a second person still checks. What changes is that those steps happen on the day the trigger fires rather than two weeks later, and that the credit officer is deciding with the evidence in front of them.

The credit view: every value in the spread opens its statement page

An ACH underwriting worksheet for pricing your own programme

The useful worksheet is not a form for one originator; it is the calculation above with the bank's own inputs. Six numbers are enough to price the programme and see where the hours go.

Run it twice: once as the programme runs today, and once with the gathering hours removed. The difference is capacity, which a bank can spend on reviewing high-tier originators more often, on off-cycle reviews when a trigger fires, or on the independent check that thin programmes skip. To run the calculation against your own originators' files, start from ACH Originator Risk Assessment; how that compares with spreadsheets and rules-based tools is in ACH risk management software vs spreadsheets vs agents.

Questions people ask

How often should an ACH originator be reviewed?

At least annually, and more often as risk rises; the OCC asks lending and ACH operations to confirm each originator's financial condition at least once a year. The sample bank reviews its two lower tiers annually, elevated-risk originators twice a year and high-risk originators quarterly, and opens an off-cycle review whenever a trigger fires.

Who should do ACH underwriting, credit or treasury operations?

The FFIEC's procedures ask that credit monitoring be done by competent credit personnel independent of ACH operations. A common arrangement is an ACH risk analyst who prepares the assessment, a credit officer who approves within authority, and an ACH risk manager who checks and releases; at the sample bank no one may both prepare and check the same assessment.

Does an originator that prefunds every file still need underwriting?

Yes, though a lighter one. Prefunding removes the risk that a credit file is not funded, but not the risk of returned debits, fraud through a compromised account or a wrong entry class; Nacha's Advisory Group says plainly that prefunding is not an exposure limit. The originator still needs a limit, a check of its legitimacy and a review on a cadence.

What does an ACH risk analyst earn?

There is no BLS occupation for ACH risk analysts. The nearest standard occupation, financial analysts, had a median of $103,570 a year ($49.79 an hour) in 2025, with 443,100 jobs. Within that group BLS describes financial risk specialists, whose work of measuring credit and market risk is closest to the role.

Where can I see a completed ACH risk assessment example?

The template guide fills all ten elements for the sample originator, from its ninety days of files and its FY2025 statements to the controls answers and the approval with reason code LC-02. Each value in it is sample data from the solution.