ACH Origination Best Practices

Businesses that originate ACH transactions play a critical role in maintaining secure and accurate payment processing. The following best practices are designed to help reduce fraud exposure, strengthen internal controls, and ensure the accuracy of payment processing.

1. Dual Control & Segregation of Duties
   Require more than one individual to initiate and approve ACH transactions. Separate responsibilities for setup, initiation, approval, and release. Avoid allowing a single user to control the entire process. Example: One employee uploads a file, a second reviews and approves it.

2. Validate Account Information
   Verify all new accounts and changes to existing payment instructions. Use prenotes or validation tools and independently confirm account ownership when possible. Tip: Always re-validate banking changes—even for existing vendors.

3. Use Multi-Factor Authentication (MFA)
   Multi-Factor Authentication (MFA) is required at log in using either a physical security token or a token generated through an app on your phone.

4. Verify Payment Changes (Out-of-Band Authentication)
   Independently verify payment requests or changes using a trusted method. Do not rely on email alone and confirm using a known phone number. Example: Call a verified contact to confirm updated ACH details.

5. Monitor Activity Daily
   Review ACH activity daily to identify unusual transactions. Reconcile accounts and review reports for new payees, account changes, or unusual activity.

6. Set ACH Limits and Controls
   Establish daily and per-transaction limits appropriate to your business activity and review them periodically.

7. Manage User Access Carefully
   Regularly review user permissions, grant only necessary access, remove access promptly for terminated employees, and avoid shared credentials.

8. Secure Your Systems
   Maintain updated antivirus software, firewalls, and system patches. Avoid accessing online banking from public or shared devices.

9. Control Templates and Stored Data
   Limit access to ACH templates and payee data. Review regularly and remove outdated entries.

10. Train Employees
    Provide regular fraud awareness training, including phishing recognition and secure payment handling procedures.

Customer Responsibility Reminder

Customers are responsible for reviewing ACH activity promptly and notifying the bank immediately of any unauthorized or suspicious transactions.

Additional Resources

https://www.nacha.org/RMAG