OCC ACH risk management: how examiners test your originators

The OCC's ACH risk management guidance is OCC Bulletin 2006-39, "Automated Clearing House Activities: Risk Management Guidance". It is still in force for national banks and federal savings associations, with its references to reputation risk removed as of March 20, 2025, and it asks an originating bank to treat every ACH originator as an unsecured credit: underwritten, given an exposure limit, monitored and reviewed. Examiners test that against the FFIEC's Retail Payment Systems examination procedures, which spell out, item by item, what they look for in an originating bank's file. The practical question for an ACH risk manager is whether each test can be answered with a document rather than a conversation. Botminds' ACH Originator Risk Assessment builds that document for each originator as the review happens.

The examples come from a fictional sample bank, Corvane, and its fictional originator Pinecrest Membership Clubs; their figures are sample data from the solution.

Banks should approach ACH credit analysis the same way they evaluate other credit arrangements by considering the proposed activity (such as purpose of the loan), and determining through financial and other analysis how much unsecured credit to extend.

OCC Bulletin 2006-39, Analyzing Originator Creditworthiness and Establishing Exposure Limits

Is OCC Bulletin 2006-39 still in effect?

Yes. The bulletin remains on the OCC's site as current guidance, with one change since it was issued: "References to reputation risk have been removed from this bulletin as of March 20, 2025," the page says, pointing to OCC Bulletin 2025-4, with the removed words shown struck through (OCC Bulletin 2006-39). Everything else stands: the program components, the underwriting standards, the credit-risk controls, the guidance on high-risk originators and third-party senders, and the expectations for audit and board reporting. Since October 30, 2013 it has applied to federal savings associations as well as national banks.

The bulletin was written to supplement the FFIEC's Retail Payment Systems booklet and the Nacha Operating Rules, not to replace them. In practice the three work together: Nacha's rules set what an originating bank must do (limits, return rate lines, fraud monitoring since 2026), the OCC's bulletin describes how a sound program does it, and the FFIEC's examination procedures describe how an examiner checks.

What does OCC 2006-39 ask of an originating bank?

It asks for a program, not a form: written policies and procedures, strong internal controls and a risk-based audit, sized to what the bank actually does. For originators specifically, it asks for underwriting standards approved under the board's direction, an ongoing analysis of each originator's creditworthiness, credit and debit exposure limits with approvals before origination begins, monitoring across settlement dates, prefunding where the credit warrants it, and an annual check between lending and ACH operations that the originator's condition has not changed.

It also tells banks to adapt rather than copy: "Banks should use the underwriting standards listed above as guidance, to be adapted as necessary to reflect each bank's specific circumstances and individual risk profile." The adaptation is what an examiner reads. A bank that writes its own tiers, bases, triggers and approval ladder, and can show they were applied, is in a stronger position than one that reprints the bulletin's list.

Two sentences in the bulletin set the tone for what follows in an exam. The first is about ongoing work: "Banks should perform ongoing credit analysis on ACH originators." The second is about onboarding: "During an initial review of originator information, banks typically reject originators that have a history of excessive unauthorized returns, or that do not operate a legitimate business." An originator file that shows the onboarding check and nothing since meets the second sentence and fails the first.

What do examiners look for in ACH? The originator tests, item by item

Examiners look for evidence that each originator is rated, limited, monitored and reviewed, by people independent of operations. The FFIEC's procedures for ODFI responsibilities ask examiners to determine, among other things, whether "The ODFI assigns credit ratings to originators", whether limits are reasonable across all the client's services, and whether "The ODFI adjusts limits for changes in an originator's credit rating and activity levels" (FFIEC IT Handbook, Retail Payment Systems, Appendix A). Each of those can be turned into a file test: a document that answers it without anyone having to explain.

Two rows deserve attention because they are where files usually fail. The first is the review row: a limit that was reviewed on schedule but never changed, with no reason recorded, reads to an examiner as a review that did not happen. The solution asks for a reason code on every decision, including a decision to leave a limit where it is. The second is the returns row. The FFIEC asks whether rising debit returns lead back to the limit; at the sample bank the link is a setting, a warning level of 0.35% on the unauthorized rate that opens an off-cycle review, and Pinecrest crossed it on September 2, seven weeks before it crossed Nacha's 0.50% line.

Credit analysis, the same way as any other unsecured credit

The OCC's standard is that ACH credit analysis should look like any other credit analysis, which means a credit file, a rating and a decision by someone with authority. The bulletin's underwriting standards ask for an evaluation of creditworthiness "including a comprehensive financial analysis", a background check, documentation, permitted entry classes, limits and over-limit approval. The FFIEC's handbook makes the same point from the examiner's side: ACH customers should be treated as unsecured borrowers subject to the bank's standard credit review (FFIEC, ACH risk management controls).

What the standard exposes is staleness. Pinecrest's limit of $2,000,000 was set in January on its FY2025 reviewed statements. By October its daily debit origination at the peak needed 98% of that limit, its unauthorized return rate was 0.62%, and the interim statements its credit memo called for were fifty-one days late. Each of those facts was in a different system. An examiner who pulls the file needs to see that the bank noticed, which is why the solution's Financials agent flags the missing statement against the due date and puts the request into the plan rather than carrying the old numbers forward.

High-risk originators: what the OCC means and what monitoring follows

The OCC defines high-risk originators by conduct as well as by industry. "High-risk originators include companies engaged in potentially illegal activities or that have an unusually high volume of unauthorized returns," the bulletin says, and it lists examples: online payment processors, certain credit-repair services, certain mail-order and telephone-order companies, illegal online gambling, businesses located offshore and adult entertainment. It adds that such originators "often initiate transactions through third-party senders because they have difficulty establishing a relationship directly with a bank."

For banks that take them on, the bulletin expects stronger systems: monitoring the level of unauthorized returns, spotting variances from expected origination volume, periodically checking that entry class codes are used properly, and watching telephone and internet entries against the bank's risk tolerance. The definition by conduct matters for ordinary clients too. A fitness chain is not a high-risk industry, but by October Pinecrest's internet-authorized debits were producing an unauthorized return rate over Nacha's line. Measured by conduct, its risk had moved, and its tier moved from 2 to 3 with the cut.

Board reporting on the originator book

The bulletin expects the board, or a committee, to receive periodic reports that show whether ACH activity stays inside board-set parameters. Several of its listed items are about the originator book itself: "Metrics and trend analyses related to the composition of the bank's portfolio of originators", "Capital adequacy relative to the volume of ACH activity and the level of risk associated with originators", and "The percentage of the deposit base that is linked to ACH origination activity". A summary of return rates by originator sits beside them, and a footnote says that at a minimum rates should be reviewed at the originator level for all originators.

Those numbers are only as good as the assessments under them. When the board report and the review desk are counted from the same assessments, there is no second set of books to reconcile; when the report is assembled from a spreadsheet each quarter, the composition of the book is whatever the spreadsheet last held.

The whole originator book, by tier and entry class, measured overnight

The Nacha rules compliance audit is one part of the ACH audit

The OCC treats the annual Nacha rules compliance audit as necessary but not sufficient. The bulletin tells auditors to check that it was completed and then to cover what it does not: growth in volume, new products and systems, underwriting and customer due diligence, and customers' online access. It also names the deficiencies the OCC has seen: "Common deficiencies include inadequate audit coverage, inexperienced audit staff, and a lack of appropriate auditor training."

For originator risk, that means internal audit should be able to sample assessments and see the method, the approvals and the evidence without asking the analyst. The Nacha audit itself is due by December 31 each year, and Nacha samples institutions for attestations each quarter through its Risk Management Portal (Nacha, Risk Management Portal); what that audit should hold is covered in the guide to ACH rules compliance audit evidence.

Internal audit reads everything and changes nothing

ACH risk for banks: credit, liquidity and operational, in one exam

The FFIEC frames ACH risk more broadly than credit: "ACH operations pose a variety of risks including credit, liquidity, and operational" (FFIEC, ACH risk management controls). An originator assessment touches all three. The limit addresses credit; the prefunding rule and the volume of uncollected debits address liquidity; the controls questionnaire and the check before a limit is released address operational risk, including the simplest operational failure of all, an approved number typed wrongly into the payments hub.

The same section asks banks to research returns, especially unauthorized returns, frequently, and to report breaches of limits to the right level of management. Those are the two places where an exam most often asks for dates: when did the bank first see the rate rising, and who knew when the limit was breached. A record that shows the nightly measurement, the warning, the off-cycle review and the decision with their times answers both. How three approaches to keeping that record compare is set out in ACH risk management software vs spreadsheets vs agents.

Before the exam letter arrives: what to have ready

The exam request usually asks for policies, a list of originators with their limits and ratings, reports to the board, audit results and a sample of originator files. Building those from mailboxes takes weeks. Having them ready is mostly a matter of keeping the review in one place as it happens.

In the solution, an examiner pack for one originator, or for a sample of twenty-five chosen by the examiner or at random, is built in a step from the assessments themselves, with a manifest and with customer account numbers masked to the last four digits. To see the pack built on your own originators, start from ACH Originator Risk Assessment; the assessment it is built from is laid out in the ACH originator risk assessment template.

Questions people ask

Does OCC Bulletin 2006-39 apply to state banks and credit unions?

It is addressed to national banks, federal branches and agencies, and since October 30, 2013 federal savings associations. Examiners at the other agencies work from the FFIEC's Retail Payment Systems booklet, an interagency handbook whose ACH procedures cover the same ground: creditworthiness monitoring, exposure limits, periodic review and monitoring across settlement dates.

Does the OCC require prefunding for ACH originators?

Not across the board. The bulletin expects underwriting standards to say when prefunding or collateral is required, and says that at a minimum banks should require prefunding of troubled borrowers, defined as those rated special mention or worse by the OCC or adversely rated by the bank's own system.

What is a high-risk ACH originator?

In the OCC's words, a company engaged in potentially illegal activities or with an unusually high volume of unauthorized returns. Its examples include online payment processors, certain credit-repair services, certain mail-order and telephone-order companies, illegal online gambling, offshore businesses and adult entertainment.

How many originator files will an examiner pull?

The procedures leave sample size to the examiner. What they test on each file is fixed: the rating, the limit and its basis, the review history, the response to rising returns and the over-limit approvals. A bank that can produce any file in that form can produce twenty-five.

Did the 2025 change remove any expectation about originators?

No. The change struck references to reputation risk. The underwriting standards, creditworthiness analysis, exposure limits, monitoring, high-risk and third-party sender expectations and the audit and reporting sections are unchanged.