I need help. I need to do an ACH Risk Assessment and I really don't know where to start. I am looking for a sample risk assessment to at least get me starting. I am also looking for procedures for setting exposure limits. If you can help me out I would greatly appreciate it.

I haven't seen an ACH risk assessment. I might start by enumerating ways we could expose ourselves to risk and how well we have mitigated those risks, e.g. only customers can be originators, Originator contracts contain all points identified by NACHA, no cross-border transactions, etc.
We work with the originator at the time the contract is in place to set a maximum amount per day. The loan officer has to approve this since this could turn into an unanticipated loan if the transfer is not funded. If a day's total transactions exceed the limit, the loan officer must approve the exception before it is processed. In the event that it isn't approved, the originator is contacted.
Don't know if this is what you needed but may be it will get you started.

Thanks for your reply. I get the impression that this is a more formal type document. But this is more that what I currently have, I will try and build from it.

The OCC Bulletin 2006-39 is about ACH Risk Management guidance. This might be a good place to start

Thanks, I will check it out.

This is something I will be doing for the first time as well. I know BOL has a webinar coming up at the end of the month.

Blue - What information do you request from the originators to provide to your loan officers to determine the exposure limits?

Most of our originators already have relationships with the bank so there are loan officers who already know their credit worthiness. The loan officers are determining if they can pay, will pay, for items they originate. We have had only one, that I know of, that we decided we would revoke the origination agreement based on questionable credit worthiness on the loan side.
The originators who do not have loans with us (the minority of originators) generally have deposit relationships with us of some size. If the loan officers don't know them, executive management does and can attest to their credit worthiness.
Hope this is the information you were seeking. If not, let me know and I'll try again.

It is my understanding that there is a guide to risk assessment in the NACHA operating book. You may want to start with this.

I happen to have one I made last year. It needs to be updated a little bit but it's a good start.

You could check out the following:
Appendix 8 - NACHA Rules
Chapter IV, Section IV - NACHA Operating Guidelines
Green Book 2004
Audit Workbook - put out by NACHA and available from the Regional Clearinghouse Associations

Those are some of the leads I was given at a recent ACH Compliance seminar.

I have an Audit ICU that I developed that I'd be glad to share if you'd like to PM me....

we require similar documentation to what a lending officer may request - documents identifying the business (unless such items were required due to an account relationsihp), two years of tax returns or financials (business and owner), three months of recent bank statements, sample authorization, marketing materials and an application that states exactly what SEC codes, item and file amounts, etc.

I have a form (Word Doc) that was passed on to me by an OCC examiner. I have adjusted it somewhat to fit our bank.

I created an Excel spreadsheet that we use to monitor our exposure on large customers on a daily basis. If the customer goes over their authorized risk limit, then their assigned loan officer must approve the origination before it is sent.

We do these annually and require current financials. The loan officer does a memo section on the form and it is sent to the BOD for approval.

PM me and I will forward it on to you.

I would appreciate a copy (or draft of your ACH document).

Thanks.

BBB