The movement of funds is powerful. It lets a business move money across the banking system. But that power also means the financial institution is effectively lending its credibility to every transaction the business sends.
Financial institutions may offer business customers a variety of payment channels depending on their policies and risk appetite. Common options include ACH transfers, online transfers, bill pay, check payments, wire transfers, and instant payments.
Among these, ACH remains one of the most widely used tools for business payments. ACH transactions may include payroll processing, vendor payments, tax payments, Account-to-account transfers, and other business payment activity.
An Originating Depository Financial Institution (an ODFI) submits ACH entries to the network on behalf of its business customers. The ODFI warranties all Entries submitted into the ACH network, ensuring the Entries are in compliance with the Nacha Operating Rules, applicable Regulations, and laws of the United States.
With regards to account-to-account transfers, financial institutions often overlook how important compliance and risk management is for business external transfers and ensuring that every business originating ACH Entries has a properly executed ACH Origination Agreement on file. For example, a business customer may initiate a transfer from its account at one financial institution to another account the business owns elsewhere. Even if the institution does not consider this “traditional ACH origination,” the business is still acting as the Originator of the ACH entry.
Because the transaction is a non-consumer ACH entry, it falls under Subsection 2.2.2.1 of the Nacha Rules, which requires the ODFI to enter into an ACH Origination Agreement with the Originator. This is where many institutions unintentionally become non-compliant.
Under the Nacha Operating Rules, financial institutions that act as the ODFI are responsible for ensuring their business customers understand and comply with the ACH Rules. This may include authorization requirements, proper use of Standard Entry Class Codes, and monitoring of ACH activity and returns.
An ACH origination agreement is the document that formally establishes this relationship. It defines the responsibilities of both the financial institution as the ODFI and the business customer as the Originator. It also addresses other considerations, for example: permitted transaction types, exposure limits, security requirements, compliance obligations, retention responsibilities, and formatting standards.
Financial institutions are responsible for ensuring their business customers understand and comply with ACH Rules. Agreements are a foundational part of that oversight.
Under what situations an ACH Origination agreement is not required: To make a loan payment at the ODFI through funds at another financial institution, a business does not need an ACH Origination Agreement. That means the business customer is utilizing ACH origination to debit their business account at another institution to pay a loan directly at your institution, this does not warrant the need for an ACH Origination Agreement. An ACH authorization that meets applicable legal requirements and contains the non-consumer Receiver’s agreement to be bound by the Rules, meets the requirements per the Nacha Rules for these types of Entries.
Financial institutions should regularly evaluate their ACH origination programs and ask the following questions internally and evaluate its program. These questions include:
- Which business customers are originating ACH entries?
- Do business customers have access to ACH functionality through online banking or treasury management platforms?
- What types of ACH entries can they originate?
- Is there a signed ACH Origination Agreement for each Originator?
- Do agreements meet the minimum requirements outlined in Nacha Rules?
- Do agreements address additional considerations from Appendix C of the Nacha Operating Guidelines?
- Are exposure limits established and monitored?
- Are periodic Originator reviews being conducted?
ACH origination activity may exist in areas institutions do not initially expect. Business customers may originate ACH entries through treasury management systems, online banking modules, or third-party processors connected to the institution as the ODFI.
If the institution serves as the ODFI, its agreements and due diligence processes should reflect that activity.
Ongoing monitoring is an integral part of ODFI Risk Management : ACH origination risk management does not end once agreements are signed. As the business customers grow, their transaction volumes may increase significantly. That means exposure limits, monitoring, and agreements may need updating. From a risk management perspective, ACH origination is both an opportunity and a responsibility. It can generate fee income, strengthen business relationships, and positions the financial institution as a key payments partner. However, it also requires strong governance, clear documentation, strong oversight, and ongoing monitoring. If your institution hasn’t asked the questions recently, now is a good time. Being proactive today can help prevent significant compliance and risk management challenges tomorrow.
How we can help: ePayAdvisors offers ACH compliance audits, ACH risk assessments, and customized consulting services, including Originator Compliance Reviews designed to help financial institutions identify and address compliance gaps before they create operational or financial exposure. Additional compliance support is also available through education resources including ePayResources’ online learning platform, ePayU; the Originator Education Community; and customized education.
Don't miss the related episode of The Payments Space podcast!