A third party sender ACH audit workbook is the checklist an auditor works through to test a sender’s compliance with the Nacha rules for its annual Rules Compliance Audit, which every sender owes by December 31 and cannot borrow from its bank or from another sender. The finished workbook proves the sender’s audit was done. It is not what an examiner reviewing the bank asks for. The examiner wants the bank’s own file on each sender: the registration, the agreement chain, the exposure limit set against the sender’s creditworthiness and the originators beneath it, each originator’s returns and due diligence, the sender’s audit with its scope, and every decision with its reason. The sender’s workbook is one document in that file. Botminds’ Third-Party Sender Due Diligence assembles the rest as the review is done, and exports it as one evidence pack.
The sample file on this page is fictional: Tessaly Community Bank and its sender Larkfield Payroll Services, with 1,240 originators, as they run through the solution. The rules and guidance are quoted from Nacha’s public pages and the agencies’ own texts.
The bank’s file on one third-party sender, as an examiner reads it
- Registration, current, with the nested flag
Every Company Identification actually sending under the sender matches the registration; updates within 45 days of any change.
- The origination agreement and any amendments
Warranties, the nesting clause, the bank’s access to originators’ files, approved and disallowed originator and transaction types, the right to audit.
- The exposure limit and how it was set
The sender’s creditworthiness relative to its underlying originators and the activity it warrants; peak use and any breaches.
- Every originator, known and screened
Name, business, location and how it sells; screening results and who confirmed them; formation and ownership evidence.
- Return rates per originator
Unauthorized, administrative and overall, from the bank’s own files, with the codes behind each, and what was done about any over a line.
- The sender’s own audit and risk assessment
Dates, period, entry types and originators in scope, findings, and the follow-up on each.
- The review and its decisions
Who prepared, who checked, who decided, when, with reason codes and signatures.
- Remediation, closed on evidence
Each item with its owner, its date and the record that closed it.
What a third party sender ACH audit workbook covers, and what it leaves out
A workbook covers the rules relevant to the sender’s own functions, item by item, for the audit period. Nacha’s Third Parties page says the rules describe a sender’s obligations “including the requirements to conduct annual Rules Compliance Audits and risk assessments” (Nacha, Third Parties in the ACH Network), Nacha has also removed the detailed audit requirements from Appendix Eight of its rules, for the same reason it gave for not prescribing a risk assessment format (Nacha), so there is no single official checklist to tick; a workbook is the auditor’s structure, not Nacha’s.
What a workbook leaves out is everything that is the bank’s job rather than the sender’s. It does not test whether the bank registered the sender correctly, whether the bank’s exposure limit was sound, whether the bank measured each originator’s returns or whether the bank knew about a nested sender. Those are examination questions about the bank, and the bank answers them from its own records. The general structure of an annual audit evidence file, for the bank’s own audit, is set out in ACH rules compliance audit evidence; this page is about the sender’s audit and the file around it.
Third party sender audit requirements: due December 31, its own, and independent
Every sender completes an annual Rules Compliance Audit by December 31 of each year, the same deadline the network’s banks and service providers work to (Nacha Risk Management Portal). Since September 30, 2022 the audit must be the sender’s own: a sender in a nested chain cannot rely on the audit of the sender above it, or on the bank’s (Nacha, Third-Party Sender Roles and Responsibilities).
Nacha’s risk advisory group adds two qualities that a workbook alone will not show. Independence: “Auditors should be independent of the employees that created the policies and procedures or complete the audited tasks as part of their duties.” And risk focus: “The ACH Rules Compliance Audit should be risk-based and focus on the Rules relevant to the TPS organization” (Nacha RMAG, November 2021). Its 2021 sound practices for banks go a step further, recommending that the bank “Ensure that the TPS has an annual ACH Rules compliance audit done by an outside party” (Nacha RMAG, June 2021).
The scope gap: a dated, complete audit that missed the risky half
The commonest weakness in a sender’s audit is not that it is late but that it looked at the wrong entries. An audit can be complete for everything it tested and still leave untested the entry types where the sender’s risk sits. Checking the date proves the first; only reading the scope against what the sender actually sends finds the second.
Larkfield’s audit scope against what its originators actually send
Staffing and payroll
Originators612
Entry types sentPPDCCD
Audited?In scope
Medical and dental practices
Originators287
Entry types sentCCDPPD
Audited?In scope
Property management
Originators164
Entry types sentPPDCCDWEB
Audited?Partly or not at all
Fitness and membership
Originators93
Entry types sentWEB
Audited?Partly or not at all
Online subscriptions and media
Originators47
Entry types sentWEBTEL
Audited?Partly or not at all
Billing and receivables
Originators37
Entry types sentWEBTEL
Audited?Partly or not at all
Nacha’s advisory group frames the question the bank should be able to answer: “Are you comfortable that the TPS audit is complete and the scope is sufficient?” (Nacha RMAG). In the sample, the answer was no, and the reason was visible in the bank’s own files: web and telephone debits made up the activity of four of the six industry groups, and the three originators over the 0.5% unauthorized threshold all sent them. The remediation item that followed was an audit engagement letter extending the scope to web and telephone entries, due December 31.
Should the bank collect the third party sender’s audit?
The Nacha rules leave the method to the bank, and Nacha’s advisory group lists the approaches banks actually take: some ask for the complete audit each year and follow up on its findings; some ask for a summary or the sender’s attestation; some do not ask for the audit and test their senders’ compliance themselves. A risk-based mix, full audits for some senders and attestations for others, is acceptable. One option is not: “The only option that isn’t acceptable is willful ignorance” (Nacha RMAG).
Four ways to know a sender’s audit is done, and what each leaves open
What it gives the bank: The findings, the scope and the period, to read and follow up.
What the bank still has to answer: Is the bank reading it and following up each finding? How long does it keep it, and does the agreement let it hold it?
What it gives the bank: Confirmation of completion and the headline findings.
What the bank still has to answer: Is the scope sufficient? Will the sender fix findings the bank has not seen?
What it gives the bank: The sender’s statement that it complied.
What the bank still has to answer: Is the bank comfortable the sender complies, and what is its exposure if an unseen finding goes unfixed?
What it gives the bank: The bank’s own evidence on the rules that matter most to it.
What the bank still has to answer: Does the testing cover the entry types and originators the sender actually has?
The full audit carries an obligation the others avoid: once the bank has read a finding, it knows. Nacha’s advisory group puts that question to banks directly, asking what the legal and compliance risk is for inaction if the bank “is made aware of non-compliance with the Nacha Operating Rules in the TPS audit.” Collecting the audit is only worth it with a process to read it and track each finding to closure.
Who audits a third party sender?
The sender engages its own auditor, who should be independent of the people who run the processes; a sender may use a payments association or an outside firm, and Nacha notes that payments associations provide independent audit tools and services. The bank may also audit its senders under its agreement, and the OCC expects it to: “Bank management should also ensure that there is a process to monitor third-party senders, and should establish a system to audit periodically such senders to ensure that they are operating in a sound manner” (OCC Bulletin 2006-39).
The bank’s own audit then checks the bank. The OCC adds that “Bank management should ensure that the bank’s audit program checks for adherence to bank policy in third-party sender arrangements,” and the FDIC asks for “a formalized process for periodically auditing their third-party payment processing relationships; including reviewing merchant client lists” (FDIC FIL-3-2012). So three audits meet around one sender: the sender’s Nacha audit, the bank’s audit of the sender under its agreement, and the bank’s internal audit of its own program.
Three audits around one sender, and whose file each sits in
| Audit | Who does it | What it tests | Where the evidence lives |
|---|---|---|---|
| The sender’s Rules Compliance Audit | The sender, through an independent auditor | The sender’s compliance with the rules relevant to its functions, by December 31 | The sender’s workbook and report; the bank’s copy, summary or attestation |
| The bank’s audit of the sender | The bank, under its right to audit | The sender’s adherence to the bank’s policy and agreement, and its originators’ files | The bank’s review file on the sender |
| The bank’s internal audit of its program | Internal audit | Whether the bank’s third-party sender program follows its policy and the guidance | The bank’s audit work papers, reading the review files |
What does an examiner ask for on third party senders?
The examiner asks for evidence that the bank manages the sender and what sits behind it, and the FFIEC’s procedures say where to look. They ask whether the bank requires its senders to identify each originator and warrant the originators’ compliance, and whether it has set limits and monitoring of the sender’s creditworthiness against its underlying originators and the activity it warrants (FFIEC IT Handbook, Appendix A). They ask whether limits are reviewed periodically and adjusted when an originator’s activity or returns change. And they test the bank’s policies for acquiring originating customers against its risk profile.
Every one of those questions is answered from the file in the checklist at the top of this page, and none of them from the sender’s workbook. The OCC is explicit that the Nacha audit is a single component of an ACH audit program, not a replacement for a comprehensive, risk-based one (OCC Bulletin 2006-39). In practice the examiner reads a sample of sender files, and for each one asks to see a value and the record it came from.
An examiner picks a value; the record opens
When is the third party sender audit due, and what does the bank attest?
The audit is due by December 31 each year. The bank’s exposure comes through Nacha’s proof-of-audit process: each quarter, Nacha sends attestation requests through the Risk Management Portal to randomly selected financial institutions, and a bank can be asked to attest to its own audit or to a named sender’s (Nacha Risk Management Portal). A bank that cannot show what it relied on for that attestation is signing on faith.
Retention follows the bank’s own rules. Records the Bank Secrecy Act requires are kept five years (31 CFR 1010.430), and a bank may keep its sender review files for the same period; retention is a setting in the sample solution. The point for the sender’s audit is narrower: whatever the bank collects should be kept with the review that relied on it, so the attestation, the audit and the decision can be read together.
What is missing from an ACH audit workbook, and what to buy instead of a bigger one
Three things are missing from any sender’s workbook, however thorough: the originator layer as the bank sees it in its own files, the nested senders the sender has not declared, and the bank’s decisions. A longer workbook does not fix that, because the workbook belongs to the sender’s audit. What fixes it is a bank-side review that produces the examiner’s file as a by-product.
When evaluating software for that job, ask to see an evidence pack for one real sender, and check that it contains the review, each finding with the record it came from, each decision with its reason code and signature, and every automated step. Ask what is excluded and who can add it back: in the sample solution, entries that belong to the financial-crime case file are excluded, and only the BSA officer can add one, so nothing in the pack discloses a report-filing matter. Ask how an audit’s scope is recorded, and whether a scope gap can be signed off by the software. The answer should be no.
The chain of decisions an examiner wants, with its times
Where the solution fits is the bank’s file, kept as the review is done: it reads the sender’s audit and risk assessment for date, period, entry types and originators in scope, compares that scope with what the sender actually sends, and drafts the request for what is missing. It does not perform the sender’s audit, which Nacha requires the sender to own, and it does not attest for the bank; a registered administrator does. The audit is also one of the six problems worth planting in a test of any review, as the sample third party sender risk assessment explains. To see the evidence pack on a sample sender, start from Third-Party Sender Due Diligence.
Questions people ask
Who is required to have an ACH Rules Compliance Audit?
Every participating financial institution, third-party sender and third-party service provider in the ACH network, each completing its own by December 31. A service provider’s audit covers the ACH functions it performs; a sender’s covers its broader obligations.
Can a third-party sender’s audit be done by its own staff?
Nacha’s risk advisory group says auditors should be independent of the people who wrote the procedures or perform the audited tasks, and recommends that banks ensure their senders use an outside party. Nacha notes that payments associations offer independent audit tools and services.
Does the bank have to review its sender’s audit?
The Nacha rules leave the method to the bank: full audit, summary, attestation or the bank’s own testing, applied by risk. Nacha’s advisory group says the one unacceptable choice is willful ignorance, and the bank must be able to attest to a named sender’s audit if asked.
What happens if a sender’s audit is late?
The sender is out of compliance with the rules, and the bank’s review should not treat the sender as current. In the sample program, one sender’s annual review was nine days past due because it was waiting on that sender’s audit, and the queue showed it past its service level.
Is the Nacha audit enough for the bank’s own ACH audit program?
No. The OCC treats the Nacha rules audit as one component of an effective ACH audit program, not a substitute for a comprehensive, risk-based audit, and it expects the bank’s audit program to check adherence to bank policy in sender arrangements.