ACH payments are electronic payments made through the Automated Clearing House (ACH) network, a US-based financial transaction system. This system handles a large volume of transactions including direct deposits from employers, payments to contractors and vendors, consumer transactions such as utility bills and insurance premiums, and person-to-person payments.

ACH payments are processed in batches and typically take one to three working days to complete. They are a cost-effective way for businesses to transfer funds without using wire transfers, credit card networks, or cheques. To make an ACH payment, the originator initiates the payment, then their financial institution batches and processes it through the ACH network to the recipient's bank account.

ACH payments are widely used, but they do come with risks. In a 2026 survey, ACH debits accounted for 34% of attempted or experienced fraud cases and ACH credits were used in 31% of business email compromise cases. Below, we'll explain how to identify common ACH risks, mitigate those risks, and approach ACH risk mitigation with Stripe.

What's in this article?

• What is an ACH risk assessment?
  
• Why business should conduct ACH risk assessments
  
• Common risks to evaluate during an ACH risk assessment
  
• How to perform an ACH risk assessment
  
• Regulatory compliance for ACH risk
  
• How to approach ACH risk assessment mitigation with Stripe
  
• How Stripe Radar can help
  

What is an ACH risk assessment?

An ACH risk assessment is a structured evaluation of an organisation's electronic payment systems, procedures, and internal controls. Designed to ensure compliance with Nacha Operating Rules and federal banking guidelines, it identifies and measures exposure to fraud, credit loss, operational disruptions, and unauthorised transactions across the payment lifecycle.

While financial institutions and third-party payment processors are legally mandated to execute regular assessments, originating businesses also conduct them to validate data encryption standards, customer authorisation procedures, and account validation rules for web-initiated debits.

Organisations should conduct an ACH risk assessment annually and prior to introducing new payment workflows, such as adopting new Standard Entry Class (SEC) codes or raising transaction limits. Assessments are also critical following significant technical changes or immediately after a security incident or spike in unauthorised returns approaching Nacha's 0.5% threshold.

Why business should conduct ACH risk assessments

Conducting regular risk assessments allows businesses to safely scale their payment operations, maintain good standing with financial partners, and safeguard working capital without disrupting cash flow.

Below are some reasons why businesses should conduct ACH risk assessments:

• Manage scaling payment volume and liquidity: As ACH volumes expand, total settlements and uncollected funds increase. A formal risk assessment ensures that exposure limits, prefunding requirements, and daily origination caps scale appropriately with business growth to prevent cash flow strain.

• Prevent operational disruptions and processing freezes: Nacha enforces strict thresholds for nonfraud return metrics, including a 3% cap on administrative returns and a 15% cap on overall returns. Exceeding these limits can result in audit investigations, operational fines, or sponsor banks temporarily suspending origination privileges.

• Mitigate nonfraud financial loss: Beyond unauthorised transactions, businesses face credit and settlement losses from nonsufficient funds (NSF) returns and uncollectible debits. Regular reviews help finance teams optimise account validation tools, balance check workflows, and automated re-presentment logic to curb unrecoverable balances.

• Strengthen banking relationships and processing capacity: Originating Depository Financial Institutions (ODFIs) continuously evaluate originator risk profiles. Demonstrating rigorous operational controls and systematic compliance reviews reassures sponsor banks, helping businesses secure higher transaction limits, faster settlement windows, and reduced collateral reserve mandates.

• Protect customer and partner trust: Streamlined payment execution prevents costly administrative errors, such as duplicate debits, misrouted contractor payouts, and delayed vendor disbursements. Maintaining tight internal controls ensures consistent transaction delivery and preserves brand credibility.

Common risks to evaluate during an ACH risk assessment

Monitor for the following signs of potential fraud so you can stop fraud before it occurs:

Vendor management risks

• Unexpected changes in vendor information: Be cautious if a vendor suddenly changes their bank account details or contact information. Always verify these changes through a separate, trusted communication channel before initiating any payments.

• Invoice verification: Look out for inconsistencies in invoices such as mismatched amounts, different logos, or unusual payment terms. Double-check these details against previous invoices or contracts. Be wary of emails from unfamiliar vendors or those with unusual email addresses.

• Vendor onboarding controls: Establish structured vetting and verification procedures for every new supplier before adding them to your payment directory. Confirm business licences, tax identification numbers, and banking authorisations directly with authorised corporate representatives to prevent fraudulent or fictitious payees from entering disbursement workflows.

Internal control risks

• Payment approvals: Enforce strict segregation of duties and multiperson authorisation workflows for all outbound disbursements. Requiring independent secondary sign-offs ensures that no single individual has the sole authority to both create and execute ACH transactions.

• Transaction monitoring: Regularly review ACH transaction logs for any payments that seem out of place, such as large amounts sent to unfamiliar accounts or transactions occurring outside of normal business hours.

• Employee access: Pay attention to any sudden financial difficulties, secretive behaviour, or changes in an employee's lifestyle, especially for those with access to financial systems. Restrict administrative banking permissions using role-based access controls, and revoke system access immediately upon employee departure or transfer.

Cybersecurity risks

• Email security: Be cautious of emails that create a sense of urgency, pressure you to take immediate action, or contain grammatical errors and typos. Always verify the sender's identity before clicking any links or downloading attachments.

• Credential protection: If you receive an unexpected request for sensitive information such as bank account details or login credentials, don't respond directly. Contact the supposed sender through a different channel to confirm the request's legitimacy. Enforce multifactor authentication (MFA) across all treasury and accounting platforms.

• Incident response: Maintain a clear, documented response protocol that outlines immediate actions following a suspected compromise or unauthorised transfer. Clear playbooks ensure your team can instantly contact your bank's treasury desk, initiate an ACH trace or recall, freeze affected credentials, and preserve audit logs.

How to perform an ACH risk assessment

Implementing the following security measures can help you mitigate ACH risks and prevent fraud before it occurs.

1. Review transaction controls and exposure limits
   Confirm that appropriate parameters are configured for each Standard Entry Class (SEC) code. Verify that operational controls are active, including dual-approval (maker-checker) workflows for outbound disbursements and ACH debit blocks or filter lists on corporate accounts.

2. Assess user access and authentication protocols
   Review permissions for all personnel and automated systems capable of initiating, approving, or modifying ACH payment files. Confirm that access adheres to the principle of least privilege, sessions require multifactor authentication, and administrative credentials are automatically revoked upon employee role changes or termination.

3. Evaluate fraud detection and account validation systems
   Determine whether transaction activity is monitored in real time for anomalies, velocity spikes, and high-risk patterns. For web-initiated debits, verify compliance with Nacha requirements for commercially reasonable account validation methods and monitor return metrics against Nacha thresholds.

4. Audit data security and encryption standards
   Verify that sensitive banking details are rendered unreadable via end-to-end encryption or tokenisation both in transit and at rest, in accordance with Nacha's Data Security Requirements. Review database access logs, key rotation schedules, and annual vulnerability scans.

5. Assess third-party vendor and service provider risks
   Conduct due diligence on all third-party senders, software platforms, and payroll processors that interact with your payment flows. Confirm that vendor contracts mandate strict data security standards, establish clear liability terms, and require out-of-band verification for any changes to vendor remittance details.

6. Review internal policies, employee training, and regulatory compliance
   Confirm that operating procedures are thoroughly documented, including customer authorisation capture and retention. Ensure finance and operations teams receive regular training on social engineering and business email compromise (BEC) detection, and verify alignment with the annual Nacha Rules Compliance Audit.

7. Evaluate incident response and dispute recovery readiness
   Review documented escalation paths for handling suspected fraud, unauthorised debits, or security incidents. Ensure the response plan defines clear protocols for freezing affected credentials, placing emergency holds with your bank, filing timely return requests (such as return codes R10 or R29), and notifying appropriate regulatory authorities.

Regulatory compliance for ACH risk

Certain regulations and standards govern ACH payments. Maintaining compliance with these requirements helps you manage ACH risk and maintain the integrity of electronic payment systems. Here are the key directives that govern ACH payments.

• Nacha operating rules: Nacha governs the ACH network and its operations, and Nacha's operating rules provide the framework for exchanging and settling ACH payments. Compliance with these rules is mandatory for all participating financial institutions and businesses.

• Bank Secrecy Act (BSA): The BSA has reporting and record-keeping requirements that help identify and prevent money laundering activities. Relevant businesses must implement effective Anti-Money Laundering (AML) procedures that include monitoring, detecting, and reporting suspicious activities.

• USA PATRIOT Act: The USA PATRIOT Act builds on BSA requirements by imposing stricter regulations on financial transactions to deter terrorist financing. It includes requirements for identity verification and stricter due diligence.

• Federal Financial Institutions Examination Council (FFIEC) guidelines: The FFIEC provides guidance on risk management practices within financial institutions, including those related to electronic payments and ACH transactions.

• Consumer Financial Protection Bureau (CFPB) regulations: The CFPB oversees consumer protection under the Electronic Fund Transfer Act (EFTA), which governs the rights, liabilities, and responsibilities of parties involved in electronic funds transfers.

How to approach ACH risk assessment with Stripe

When using Stripe for ACH payments, there are certain tools you can use and best practices you can engage in to mitigate ACH risk.

Use Stripe’s built-in risk management tools

• Stripe Radar: Stripe's fraud detection solution uses AI to assess the fraud risk of each ACH payment. It automatically blocks high-risk transactions and flags suspicious activity for manual review. Customise Stripe Radar's rules to your specific business needs, adjusting thresholds for transaction values, velocity, and other factors.

• ACH debit authorisation: Require customers to authorise ACH debits through microdeposits or instant bank verification, confirming account ownership and reducing the risk of unauthorised transactions.

Improve customer due diligence (CDD)

• Identity verification: Collect and verify customer information such as name, address, and date of birth using Stripe's identity verification tools or third-party providers.

• Business verification: For businesses, obtain and verify relevant documentation, such as business licences, tax identification numbers, and articles of incorporation.

• Risk-based authentication: Implement stronger authentication measures for high-risk customers or transactions such as requiring additional verification steps or limiting transaction amounts.

Monitor and analyse transaction data

• Stripe Dashboard: Regularly review the Stripe Dashboard for insight into transaction patterns, chargeback rates, and fraud indicators.

• Custom reporting: Create custom reports to analyse specific data points such as transaction types, customer segments, or geographic locations and identify potential risk areas.

• Third-party tools: Consider integrating Stripe with third-party fraud detection and prevention platforms for improved monitoring and analysis capabilities.

Optimise dispute management

• Dispute resolution: Establish a process for handling ACH disputes, including responding to customer enquiries, gathering evidence, and representing your case to Stripe or the relevant financial institution.

• Dispute prevention: Proactively address potential issues by communicating with customers through Stripe Invoicing's automatic email reminders.

Stay informed and adapt

• Stripe updates: Stay up-to-date with Stripe's latest product releases, security improvements, and risk management best practices.

• Stripe Sigma: If you have a high volume of ACH transactions or complex risk management needs, explore Stripe Sigma for advanced data analysis and custom reporting capabilities.

• Stripe support: Use Stripe's support resources for guidance on implementing best practices and troubleshooting any issues that might arise.

How Stripe Radar can help

Stripe Radar helps detect fraud and unlock growth, using AI trained on data from Stripe's global network. Radar helps protect your business from fraud throughout the customer lifecycle before it affects your bottom line, while helping you approve more legitimate customers and payments.

Radar can help your business:

• Prevent fraud losses: Radar's AI learns from more than US$1.9 trillion in annual transactions across Stripe's global network, helping it identify and block fraud patterns that individual businesses might not catch on their own.

• Unify protection across evolving fraud attacks: Radar brings protection against transaction fraud, account fraud, and customer abuse all into one solution, so you gain unified protection across major fraud types.

• Adapt as fraud evolves: Radar continuously adapts to changing fraud patterns, from first-party abuse to agentic transactions, helping protect your business against emerging threats.

• Work with your existing tech stack: Use Radar with Stripe payments with no integration required, or access Radar's intelligence through programmable APIs, whether you process payments on Stripe or not.

Learn more about Stripe Radar or get started today.