Resources to help you navigate the changing regulatory landscape

"Great Question" logo image.

Great Question: NACHA Proof of Audit & ACH Registry

Question

Our credit union just received an email from NACHA (National Automated Clearing House Association) that says:

  • Requests for proof of ACH compliance audits will now be automated and distributed to Financial Institutions through NACHA’s Risk Management Portal; and
  • Financial institutions will need to use the Risk Management Portal to respond.

I have never heard of NACHA’s Risk Management Portal, and the credit union has never been asked to provide proof of our ACH audits to NACHA. Is this something the Credit Union needs to worry about?

Answer

Let’s discuss both proof of audit requests and use of NACHA’s Risk Management Portal.

NACHA Proof of Audit Requests

Subsection 1.2.2.2 of NACHA’s Operating Rules, require a participating Depository Financial Institution (DFI) to retain proof that it has completed an audit of compliance in accordance with NACHA Operating Rules.

Upon NACHA’s request, a Participating DFI must provide to NACHA, within 10 banking days, proof that the Participating DFI has completed audits of compliance.

The credit union must provide proof of an audit only if NACHA requests it. The email you received indicates that future proof of audit requests will come through the Risk Management Portal.

NACHA has also indicated it intends to greatly increase proof of audit requests in the future. If the credit union has not received a proof of audit request from NACHA in the past, it might in the future. Both the request from NACHA and the response from the credit union will be done via the Risk Management Portal. So definitely get registered.

ACH Contact Registry

But let’s discuss another reason, the credit must have access to NACHA’s Risk Management Portal.

Nacha Operating Rules require all ACH Participating DFIs to register contact information for their ACH operations and fraud and/or risk management areas in the ACH Contact Registry. Registration is also done via Nacha’s Risk Management Portal. Non-compliance with the ACH Contact Registry requirements can result in the imposition of fines in the rules enforcement process.

Use of the contact information is limited to ACH-related internal purposes only. The Rule requires financial institutions to update their registry information within 45 days of any change and to verify it on an annual basis.

For more information, email Heather Line.

Access the ‘Compliance Hotline’

Your League-member benefits include the Compliance Hotline — providing exclusive access to dedicated compliance experts:

Using the above phone number and email address, you can gain access to a knowledgeable team that’s ready to address all your credit union’s compliance inquiries — promptly and efficiently. With the Compliance Hotline, you can proactively respond to impromptu questions and issues by getting clarity and insight on technical topics that normally slow you down. We want to help you unlock the full potential of your League membership by leveraging the resources and support you need to navigate the complex world of compliance effortlessly. We’re ALWAYS just a phone call or email away!

Additionally, other League-member compliance resources include:

  • ViClarity
  • CU PolicyPro
  • ComplySight
  • InfoSight
  • CU Store
  • Record Retention Guide
  • GRC Technology Solutions

For more information, email Lisa Quaranta.

Powered by ViClarity, a California and Nevada Credit Union Leagues company.