AAP cheat sheet

ACH is a batch, store-and-forward, net settlement system; the two ACH Operators are the Federal Reserve (FedACH) and The Clearing House (EPN).

Core roles: the Originator creates the entry; the ODFI warrants and transmits it; the ACH Operator sorts and settles; the RDFI posts it; the Receiver's account is debited or credited.

An ACH credit pushes funds to a Receiver; an ACH debit pulls funds from a Receiver's account under an authorization.

SEC codes identify the entry type and required data; examples include PPD, CCD, CTX, WEB, TEL, ARC, BOC, POP, RCK, IAT, COR, and ENR.

Settlement is net: each participant's credits and debits are offset and settled through its Federal Reserve or correspondent account.

ACH entries carry a trace number, company ID, individual ID, transaction code, effective entry date, and amount.

Same Day ACH and next-day ACH differ by processing window and settlement timing, not by the underlying network.

Returns reverse a settled entry; Notifications of Change correct future-entry data but do not reverse funds.

The Nacha Operating Rules are the primary ACH rulebook; the annual Rules update sets effective dates and new requirements.

Regulation E governs consumer electronic fund transfers, including error resolution and provisional credit timelines for consumer ACH debits.

UCC Article 4A supplies default commercial funds-transfer rules where the Nacha Rules and the parties' agreement do not address an issue.

ODFI warranties include that each entry is authorized and complies with the Rules; RDFI warranties include settlement and posting to the identified account.

OFAC screening is required; prohibited persons or entities must be blocked and reported, not merely returned.

Consumer debit authorizations must be in writing or electronically authenticated and retained for two years after termination or revocation.

ACH records must be retained for six years under the Nacha Rules.

An ODFI must conduct an annual ACH compliance audit and retain the audit report.

Regulation CC governs funds availability and exception holds; it does not set ACH return reason codes.

PPD is used for consumer credits and debits, such as payroll, pensions, and recurring bill payments, with one addenda record.

CCD is used for business-to-business credits and debits with one addenda record; CTX is a corporate trade exchange entry that can carry up to 9,999 addenda records.

WEB is an internet-initiated consumer debit; the authorization is electronic, and the Originator must retain it and validate account data.

TEL is a telephone-initiated consumer debit; oral authorization is permitted if recorded or confirmed in a written notice.

ARC, BOC, and POP convert checks to ACH debits; RCK re-presents a returned check; XCK represents a destroyed check.

IAT is the SEC for cross-border entries and requires foreign bank information, multiple addenda records, and OFAC screening.

COR is a Notification of Change; ENR is an Automated Enrollment Entry used for federal government enrollments.

ACK acknowledges a CCD entry; ATX acknowledges a CTX entry.

Same Day ACH supports most SEC codes, but IAT entries are not eligible for Same Day ACH.

Before origination, the Originator and ODFI enter an agreement covering authorization, exposure limits, and return handling.

The ODFI must establish and monitor exposure limits and ensure entries are within the Originator's authorization.

The effective entry date is the date the Originator requests settlement; the ACH Operator adjusts it if it falls on a non-banking day.

Prenotification is a zero-dollar entry used to validate account data; it does not transfer funds.

The RDFI posts debits on settlement date and makes credits available under its agreement and applicable law.

A Receiver may revoke an authorization; the Originator must stop originating after revocation.

The ODFI must transmit entries by the ACH Operator's deadline; late files may settle on the next available day or be rejected.

The Originator must retain authorization records and provide them to the ODFI or RDFI on request.

The RDFI may return entries for account errors; a Notification of Change is used to correct future-entry data.

Return reason codes begin with R; common examples are R01 insufficient funds, R02 account closed, R03 no account, R04 invalid account number, R08 stop payment, and R10 customer advises unauthorized.

The general return deadline is by opening of business on the second banking day after settlement; certain consumer unauthorized returns have longer Regulation E timing.

A return reverses the original settlement; a dishonored return challenges a return; a contested dishonored return challenges that dishonor.

A Notification of Change is a COR entry sent by the RDFI within two banking days of the erroneous entry; it does not move funds.

Change codes identify the field corrected, such as account number, routing number, transaction code, or individual ID.

The ODFI must ensure the Originator makes NOC corrections within six banking days of receipt.

A stop payment is requested by the Receiver through the RDFI; future debits are returned with R08.

Duplicate entries are returned as R24; invalid transaction codes can be returned as R41.

Exception handling includes research, re-presentment rules, and monitoring of return rates by type.

Key ACH risks are credit, liquidity, operational, compliance, and fraud.

The ODFI bears primary credit risk because it warrants entries and must fund returns.

Fraud controls include account validation, ACH filters or positive pay, velocity limits, device and IP monitoring, and callbacks for changed bank data.

Business email compromise and payroll diversion often involve changed account numbers; callback verification to a known contact is a control.

Account takeover fraud uses stolen online banking credentials; multi-factor authentication and anomaly detection reduce risk.

ACH kiting exploits settlement timing and available balances; repeated large debits and credits are a monitoring indicator.

Same Day ACH shortens the window to detect and stop fraudulent entries.

OFAC and sanctions screening is a compliance control, not only a fraud control.

Return-rate thresholds and unauthorized-return monitoring are risk indicators for Originators and ODFIs.

A Third-Party Sender acts as an intermediary between an Originator and an ODFI and has origination responsibilities under the Rules.

A Third-Party Service Provider supplies processing, software, or data services to a participant or TPS but does not itself originate entries.

The ODFI remains liable to other participants for entries transmitted by its Third-Party Sender.

The ODFI must perform due diligence, have a written agreement, and monitor TPS and TPSP compliance.

A TPS must ensure Originator authorizations, retain records, and comply with return and NOC handling.

Nested TPS relationships increase risk because the ODFI may not directly see the underlying Originator.

The ODFI's annual ACH audit and risk assessment cover TPS and TPSP relationships when used.

Written agreements allocate liability, audit rights, and data security obligations between the ODFI and TPS or TPSP.

Same Day ACH allows qualifying entries to settle on the same banking day, with funds available by the end of that settlement day.

Same Day ACH uses designated submission windows; entries missing a window are processed in the next available window or next day.

The Same Day ACH per-entry dollar limit is $1,000,000.

Same Day ACH supports credits and debits, but IAT entries are not eligible for Same Day ACH.

IAT is the SEC for cross-border entries and carries foreign bank and OFAC screening data.

IAT entries are processed by an ACH Operator acting as a gateway between domestic and foreign financial institutions.

Emerging payments include RTP, FedNow, digital wallets, and API-based payments; they settle in real time rather than in batches.

Real-time payments are irrevocable once accepted; ACH returns are a separate post-settlement process.