The ACH rules compliance audit is the annual audit of an institution's compliance with the Nacha Operating Rules, and Nacha's position is short: "Annual ACH Rules Compliance audits are required for all financial institutions, Third-Party Senders, and Third-Party Service Providers in the ACH Network and must be completed by December 31" (Nacha, Risk Management Portal). Nacha asks randomly selected institutions to attest each quarter that the audit was done, and bank examiners review the audit's results, its independence and whether its exceptions were fixed. The audit covers every rule that applies to the roles an institution plays, so the work is mostly evidence: showing which rules were in force, what was done under them and who did it. Botminds' Nacha & Payment Rules Search keeps that record as the work happens, every rule question with its answer, source and edition, every return with its preparer and releaser, and builds an export pack for the audit from it.
Requirements below are quoted from Nacha's public audit and risk portal pages and the FFIEC examination handbook. Product figures are sample data from the solution's fictional credit union.
The ACH rules compliance audit evidence file, area by area
Which rules you were under
EvidenceAn edition register: each rulebook, circular and procedure with its edition, effective date and approver
What it provesThat answers and procedures used the edition in force on each date
Returns
EvidenceFor a sample of returns: settlement date, the reason code, the signed statement and when its review was finished, when the return was sent, who prepared and who released it
What it provesTimeliness against both extended-return clocks, and separation of duties
Funds availability
EvidenceFor a sample of credits: settlement date, receipt time and posting time, before and after September 18, 2026
What it provesThe 9:00 a.m. requirement, under the rule in force on each date
Rule questions
EvidenceEvery rule question staff asked, the answer given, the source and edition it cited, and who answered or approved it
What it provesThat staff applied the rules as written, and where they were unsure
Procedure changes
EvidenceOld and new text, the rule change behind it, the drafter, the approver and the date
What it provesThat procedures followed the rules within a known time
Exceptions
EvidenceRefused or routed questions, overrides with reasons, aging of open items
What it provesThat exceptions reached management and were closed
What is the ACH rules compliance audit?
It is an annual audit, required by the Nacha Operating Rules themselves, of whether a participant follows the rules that apply to it. Since January 1, 2019 the requirement sits in Article One, Subsection 1.2.2, "Audits of Rules Compliance", after Nacha moved the core requirements out of Appendix Eight; Nacha stressed that the change "does not change the requirement to conduct a Rules compliance audit annually" (Nacha, ACH Rules Compliance Audit Requirements).
The 2019 change also ended the checklist era. Nacha warned that parties relying "exclusively on Appendix Eight as a checklist for conducting their audits should be aware of its limitations" and "should be prepared to audit on all relevant rules, even those not currently expressly listed within current Appendix Eight language". The audit's scope is the rulebook as it applies to you, which is why its effort grows with every amendment, and why it is one part of a Nacha compliance program rather than the whole of it.
Who must complete an ACH audit?
Every financial institution, third-party sender and third-party service provider on the ACH Network. The audit page describes the obligation as "the general obligation of participating DFIs and third-party service providers/senders to conduct an audit". An ODFI carries a second duty: on request it "must attest to completion of their own audit or a specified Third-Party Sender's audit" (Nacha, Risk Management Portal), so its evidence file includes the audits of the senders it serves.
One corner of the network sits outside. For federal government ACH entries, Treasury's 31 CFR Part 210 adopts the Nacha rules but excludes, among other provisions, "Subsections 1.2.2, 1.2.3, 1.2.4, 1.2.5 and 1.2.6" and the related appendices "governing the enforcement of the ACH Rules and claims for compensation" (31 CFR 210.2(d)). That governs the government's rights on those entries; it does not lift an institution's own Nacha audit duty.
When is the ACH audit due?
By December 31 each year. Nacha's risk portal states the date, and its 2019 rule page described the same cycle, the new language applying "to audits required to be conducted by December 31, 2019" (Nacha). The audit is not filed with Nacha. Instead, "Each quarter, Nacha sends attestation requests through the Risk Management Portal to registered administrators at randomly selected financial institutions. An administrator must complete the attestation."
The audit calendar in four facts
Dec 31
the date by which each year's ACH rules compliance audit must be completed
4a year
rounds of proof-of-audit requests Nacha sends to randomly selected institutions
6
administrators an institution may register in Nacha's Risk Management Portal to answer them
2019
the year the requirement moved to Subsection 1.2.2 and the Appendix Eight checklist was removed
The random attestation is why the evidence file should exist before the request, not after. An administrator who receives an attestation request in the second quarter is most likely attesting to the audit completed the previous December, and the person who did it may have moved on. Keep the administrator list current; Nacha's page adds that reminder itself.
What does an ACH audit cover in 2026?
Every rule relevant to the roles the institution plays, in the edition in force for the period audited. For 2026 that means the 2026 edition plus each amendment from its own effective date, and the changes are where audit exceptions are most likely to sit, because procedures written for the old rule are still in use.
Rule changes a 2026 ACH audit should test from their own effective dates
| Change | In force from | What to test |
|---|---|---|
| Banking Day follows the ACH Operator, not the institution | January 1, 2026 | Return and NOC deadlines counted through any day the institution closed but the ACH Operator was open |
| Fraud monitoring by ODFIs and by large originators and third parties; credit monitoring by large RDFIs | March 20, 2026 | Written risk-based processes exist, are followed and are reviewed |
| Fraud monitoring by all other RDFIs, originators and third parties | June 22, 2026 (dated June 19) | The same, for every remaining participant |
| Funds available at 9:00 a.m. on settlement date for all non-Same Day credits | September 18, 2026 | A sample of credits received after 5:00 p.m. local time, before and after the change |
| Extended unauthorized returns by the sixth banking day after the statement review | October 1, 2024 | Each sampled R10 and R11 return against both clocks |
| Status of an ODFI request for return within ten banking days | April 1, 2025 | Responses to requests for return, with dates |
Two of these turn on dates the auditor has to reconstruct: when the institution finished reviewing a member's signed statement, which starts the sixth-banking-day clock (Nacha), and when a credit was received relative to 5:00 p.m. local time before September 18 (Nacha, New Rules). If those timestamps were never recorded, the auditor tests what can be tested and writes up the rest. The Nacha rule change calendar to 2028 shows what the 2027 audit will add.
What examiners do with the audit
Bank examiners read the audit; they do not stop at the fact that one was done. The FFIEC's ACH examination procedures tell them to "Review results from the financial institution's NACHA rule compliance audit" and to determine four things (FFIEC, Retail Payment Systems booklet, Appendix A).
What the FFIEC tells examiners to check in an ACH rules compliance audit
- The independence and competence of the party performing the audit
An internal auditor can perform it; the question is whether they are independent of the ACH function and know the rules.
- Whether the board or its committee reviewed and approved the audit
The minutes are part of the evidence file.
- Whether responsibilities for high-risk entries, such as WEB, were included in the scope
Scope follows the institution's roles and its riskiest entry types.
- Whether corrective actions on audit exceptions are satisfactory
Last year's findings, with what was done and when, belong in this year's file.
The same procedures reach past the audit into daily operations: examiners judge how well the investigation unit answers customer inquiries and controls returns, unposted items and differences, and whether management actually works the exception reports and the aging of open items (the ACH return process, seat by seat, names who owns each). An evidence file that holds the audit and the exception record together answers both.
Can the ACH audit be done internally?
Yes, provided the person doing it is independent of the ACH function and competent in the rules, which is what examiners check. Nothing on Nacha's public audit pages requires an outside firm; they point participants to the rules themselves, the Nacha Operating Guidelines and audit guides produced by payments associations as resources. An institution can use its internal audit function, a payments association or an outside firm; the examiner's two words, independence and competence, decide whether the choice was sound.
The rule questions log: the evidence most desks do not keep
Most evidence files hold the transactions and the procedures. Few hold the questions: what staff were unsure of, what they were told, and on what authority. Yet that is where a misapplied rule starts, and it is what an auditor asks about when a sampled return was late: who decided the deadline, and from what source?
In Nacha & Payment Rules Search every question, answer, cited passage, edition and confidence score goes on the audit trail with who asked, who answered or approved, and when, alongside every edition load, procedure change, override and released return. In the solution's sample, the pack for June 1 to October 22 holds 4,274 questions with their answers and sources, and the 175 questions routed to the Payments Compliance Officer with who answered them and their clocks.
One pack for the annual audit, built from the trail
Build the file through the year, not in December
An audit year in 2026 had five rule dates in it before the December 31 deadline, and every one of them changed what the evidence file has to show. Waiting until the fourth quarter means reconstructing, from logs that were never designed for it, which rule applied to which item on which day. Building the file as the year runs means each change arrives with its own evidence already attached.
One audit year: where the evidence for 2026 is created
- Q1: edition, Mar 20load and approve
- Q2: Jun 22procedures updated
- Q3: Jul 24, Sep 18samples before and after
- Q4: fieldwork, boardby Dec 31
The practical rule is to close each change with three entries: the date the edition or amendment was approved for use, the procedures it changed and when they were approved, and a sample of items processed just before and just after the effective date. A file built that way lets the auditor test the year in the order it happened, and the board sees a December report rather than a December scramble.
What records should be kept for the ACH audit?
Keep what lets an auditor re-perform your work: the edition register, the transaction samples with their timestamps, procedure versions with approvals, the questions log and the exception record. How long to keep them is less clear from public sources. Nacha's public audit pages set the deadline but not a retention period for audit evidence; the period comes from the licensed rule text or your own record-retention policy.
Where a question touches the Bank Secrecy Act, a separate federal rule applies: records the BSA regulations require must be kept for five years (31 CFR 1010.430(d); see BSA recordkeeping requirements, and what they cost by bank size). The solution's sample credit union keeps questions, answers and sources for six years by its own setting and BSA-related items for five, and keeps questions about reports to FinCEN restricted to its BSA Officer.
Exceptions with their reasons and clocks: the record that sits beside the audit
Questions people ask
What is a Nacha proof of audit request?
It is Nacha's quarterly check that audits are being done. Nacha sends attestation requests through its Risk Management Portal to registered administrators at randomly selected financial institutions, and an administrator must attest to completion of the institution's own audit, or of a specified third-party sender's audit.
Does the ACH audit have to cover third-party senders?
Third-party senders and third-party service providers owe their own annual audits. An ODFI must be able to attest, on request, to completion of a specified third-party sender's audit, so it should hold evidence of those audits in its own file.
What happened to Appendix Eight?
Nacha removed its language with effect from January 1, 2019 and moved the core audit requirements into Article One, Subsection 1.2.2. Nacha warned that a checklist built on Appendix Eight has limitations, and that participants should audit on all relevant rules.
Is the ACH audit the same as a Regulation E review?
No. The ACH rules compliance audit tests compliance with the Nacha Operating Rules, a private rulebook the institution has agreed to. Regulation E is federal law on consumer electronic transfers, examined by the institution's regulator; the two meet on unauthorized consumer debits, where both apply on different clocks.
Who should sign off the ACH audit?
The FFIEC's procedures ask examiners to determine "whether the board or its committee reviewed and approved the audit", so the audit's results and corrective actions should reach the board or a committee of it, with the approval minuted.