What are you doing for ACH monitoring? The new Examination Manual has an expanded section on ACH which leads me to believe that it is an issue to be dealt with. We allow our customers to originate and we have a process to evaluate them before we sign them up, but nothing per se to monitor their activity.

You may wish to take a look at OCC Bulletin 2006-39 (go to their web site), but I want to warn you in advance, it'll probably raise your blood pressure. Its written by Mark O'Dell, Deputy Comptroller for Operations Risk. If you are the ODFI, you will definitely have to upgrade your procedures.

Thanks BSA Pain. This is a quote from that Bulletin...
'Equally important is an effective risk-based suspicious activity monitoring and reporting system.' This is exactly what I am trying to find out. Does anyone have an effective monitoring and reporting system for ACH. We do a credit assessment and EDD before we set our customers up to originate and we set them a daily limit, but we do not have any other monitoring system.

We recently had a BSA Exam (FDIC) and the examiner addressed this issue a little bit. Basically, they said we need to be looking at our originator's accounts. She didn't really talk about the original and current due diligence that we do, like the credit assessment and others. More they said we just need really know our originators and should be looking through there accounts. Basically the necessity, frequency, and depth of our review into their accounts will be subject to what we find. As long as the pattern of activity is what would be expected, it should be ok. They weren't too worried about the payroll originators, just other type of originators. Hope this helps a little bit.

How about banks that do not originate?
How are RDFIs monitoring ACH activity?

We are reviewing all ach transactions on a weekly basis, sorting the transactions by account number, dollar amount, frequency, and originator of the ACH transaction.

We pay special attention to our customers activity and build a file with ach transactions (originators, frequency, dollar amount) then, we look at CDD/EDD to identify any unsual transaction.

In the manual they state third party service providers when referring to ACH. I am not sure what they mean by that. Can anyone help.

We have a 3rd party relationship with a company that does all of our core processing. Nothing is done in-house. Therefore, at days end when all is processed, our 3rd party company actually submits our ACH file to Fed on our behalf.