ACH Audits,Demystified
Understand the network. Know the rules. Be ready for your audit. A practical guide to ACH compliance, from the fundamentals to the annual review.
Know what is required.
Know where to start.
Annual
Review compliance with the Rules that apply to your ACH activities.
Dec 31
Complete the audit by the end of each calendar year.
6 years
Retain proof of the completed audit and make it available when requested.
Good compliance starts with understanding. The network, the rules, and your role in both.
Understand
the fundamentals.
The ACH
Network
The Automated Clearing House connects U.S. bank accounts. It is how salaries arrive, bills get paid, and businesses move money without a check.
A payment travels from the originator, through their bank and an ACH operator, to the receiving bank and account.
The operators: The Federal Reserve and The Clearing House.
Understand the networkOriginator
Starts the payment
Originating bank
The ODFI submits the entry
ACH operator
Clears and routes the entry
Receiving bank
The RDFI receives the entry
Receiver
The account is credited or debited
Nacha &
the Rules
Nacha sets the rules for the ACH Network. It is a nonprofit organization, not a government regulator, and it does not move the money itself.
The Operating Rules explain how payments must be authorized, processed, secured, and returned. Participants agree to follow them through their network and banking agreements.
The distinction: ACH is the network. Nacha writes the rules.
Get to know NachaOne network.
One set
of rules.
The annual
ACH audit
An ACH audit checks whether your organization follows the Rules that apply to its activities. It looks at what happens in practice, not just what your policies say.
The review covers relevant agreements, authorizations, payment processing, returns, data security, and record retention. Findings should lead to documented corrective action.
The deadline: Complete the annual review by December 31.
Understand the auditThe annual
review.
- Agreements & authorizations
- Processing & returns
- Security & risk management
- Evidence & record retention
Make the review part of the work. Keep evidence as you go. Address gaps early. Arrive prepared.
Resources
Ten plain-language guides to the network, the rules, and the annual audit. Start with the basics, or go straight to the topic you need.
Browse all resources- What is the ACH Network?
- What is NACHA?
- What is an ACH audit?
- How do the Nacha Operating Rules work?
- Who are the parties in an ACH transaction?
- What are Standard Entry Class (SEC) codes?
- What counts as valid ACH authorization?
- What are ACH return rates and thresholds?
- What does an ACH risk management program look like?
- How do you prepare for an ACH audit?
These materials are educational and do not constitute legal or compliance advice. Always confirm requirements against the current Nacha Operating Rules and your own counsel.
Audit with confidence
Straight answers to the questions teams ask most.
The terms commonly refer to the same annual review: an assessment of compliance with the Nacha Operating Rules for the ACH activities your organization performs. It is different from a financial-statement audit and from an ACH risk assessment.
The annual ACH rules-compliance audit is a contractual requirement under the Nacha Operating Rules, not a standalone federal audit statute. It applies to participating financial institutions, Third-Party Service Providers, and Third-Party Senders. An ordinary business Originator should check its role and its bank agreement rather than assume that every ACH user needs the same audit.
Each participating Depository Financial Institution, each Third-Party Service Provider, and each Third-Party Sender must conduct an annual review of its compliance with the applicable provisions of the Rules.
The annual rules-compliance audit must be completed by December 31 each year. Most teams schedule it in the fall to leave time to remediate any findings before the deadline.
Yes. Nacha does not require an external auditor. The review can be done by internal staff, internal audit, or an outside firm — provided the reviewer is independent of the function being audited and the work is documented.
The ACH Network is the payment system that actually moves the money. Nacha is the nonprofit that governs that network by writing and enforcing the Operating Rules. Nacha does not process payments itself.
Non-compliance can lead to a Nacha inquiry, required corrective action, and fines under the National System of Fines. Your ODFI is also likely to intervene, since it carries the network liability for your activity.