Nacha rules compliance audit
The annual audit, requirement by requirement.
The Nacha Operating Rules require participating DFIs, Third-Party Senders, and Third-Party Service Providers to conduct an annual audit of compliance. Here is how Eviqly performs it, what it covers, and what you receive at the end.
Scope
The audit is scoped to your participant type and the SEC codes you originate or receive. Requirements that do not apply to you are excluded and noted as such, so the report shows exactly what was tested and why.
Areas tested
- ACH risk management and Originator/TPS due diligence
- Exposure limits and periodic review
- Authorization: form, retention, proof, and revocation
- Account validation for WEB debits and first-use accounts
- Return-rate monitoring and thresholds
- Data security and protection of banking information
- Processing timing, reversals, prenotes, and NOCs
- Record retention and record-keeping
- Agreements and registrations where applicable
Method
For each requirement Eviqly:
- Identifies the evidence that should exist and where it lives.
- Draws the evidence from connected systems or uploaded documents and drafts a response with sources attached.
- Marks the response as supported, or as a gap with a stated reason.
- Routes gaps to the named internal owner and records each confirmation.
- Submits the confirmed set to an AAP-accredited reviewer who examines the evidence and signs.
Deliverable
A signed report you can defend.
Audit report
Findings for every requirement in scope, with supported and gap status.
Completion statement
Signed by a U.S.-based AAP; names the participant type, SEC codes, and period reviewed.
Evidence index
Every source report, policy excerpt, and pull date cross-referenced to its requirement.
Gap & confirmation log
Who confirmed, who closed, and when — retained for six years.
Cadence
Annual, with a confirmed baseline.
Because evidence, confirmations, and closures are retained, the following year’s audit begins from last year’s confirmed state. Only what changed needs fresh evidence, which is why the second cycle is materially faster than the first.
Schedule this year’s audit.
Give us your due date and participant type; we’ll confirm scope within one business day.