Can anyone tell me if we need to have a written ACH Policy? We have an ACH Audit Policy, but not the policy itself. Thanks!

We were directed to have one about 2 years ago. Management complied. However, not BOD approved. Just management approved.

We, too, were told by regulators that we must have a written ACH Policy. We created an ACH Policy and an ACH Procedure, and we got both Board-approved (and take back to the Board annually for signoff).

We also have an Board approved ACH policy. Its fairly new.

We added a board approved ACH Policy last fall.

So does NACHA require us to have that policy or did the regulators just say it was best practice...we are getting conflicting information on that...thanks

There is a rule that goes into effect on June 18, 2010 (The Risk Management and Assessment Rule) that requires banks to do an ACH Risk Assessment. I don't think Nacha requires you to have an ACH policy.

Regulators appear to prefer a Board approved ACH Policy that identifies associated risks and specifies the controls in place to mitigate the risks. Example is credit risk. Do you use the same credit approval process as stipulated in your credit policy? Do you include ACH credit risk in the aggregate lending total for a client? Do you review the exposure on an annual basis? Who has the authority to approve the limit? Who has the approval to approve an overlimit? Do you utilize holds? How do you handle KYC for new clients? All of these risks and more should be identified within your policy then include the compensating controls. Also the policy should state you will abide by NACHA rules and how you will ensure your client abides by the rules (contract provision).

NACHA does require an annual NACHA audit.

Just my opinion..........