Question:

Our credit union just received an email from NACHA (National Automated Clearing House Association) that says:

1. Requests for proof of ACH compliance audits will now be automated and distributed to Financial Institutions through NACHA’s Risk Management Portal, and
2. Financial institutions will need to use the Risk Management Portal to respond.

I have never heard of NACHA’s Risk Management Portal, and the credit union has never been asked to provide a proof of our ACH audits to NACHA. Is this something the Credit Union needs to worry about?

Answer:

Let’s discuss both proof of audit requests and use of NACHA’s Risk Management Portal.

NACHA Proof of Audit Requests

Subsection 1.2.2.2 of NACHA’s Operating Rules, require a participating Depository Financial Institution (DFI) to retain proof that it has completed an audit of compliance in accordance with NACHA Operating Rules.

Upon NACHA’s request, a Participating DFI must provide to NACHA, within 10 banking days, proof that the Participating DFI has completed audits of compliance.

The credit union must provide proof of an audit only if NACHA requests it. The email you received indicates that future proof of audit requests will come through the Risk Management Portal.

NACHA has also indicated it intends to greatly increase proof of audit requests in the future. If the credit union has not received a proof of audit request from NACHA in the past, it might in the future. Both the request from NACHA and the response from the credit union will be done via the Risk Management Portal. So definitely get registered. 

ACH Contact Registry

But let’s discuss another reason, the credit must have access to NACHA’s Risk Management Portal.

Nacha Operating Rules require all ACH Participating DFIs to register contact information for their ACH operations and fraud and/or risk management areas in the ACH Contact Registry. Registration is also done via Nacha’s Risk Management Portal. Non-compliance with the ACH Contact Registry requirements can result in the imposition of fines in the rules enforcement process.

Use of the contact information is limited to ACH-related internal purposes only. The Rule requires financial institutions to update their registry information within 45 days of any change and to verify it on an annual basis.