Page |1
AAP – ACCREDITED ACH PROFESSIONAL
CERTIFICATION EXAMINATION: STUDY
GUIDE | LATEST UPDATE 2026/2027 |
PRACTICE QUESTIONS AND ANSWERS |
EXAM REVIEW
TABLE OF CONTENTS
I. ACH Network Fundamentals & Participant Roles
II. Nacha Operating Rules — Warranties, Liabilities & Compliance
III. Standard Entry Class (SEC) Codes & Authorization Requirements
IV. ACH File Formatting & Technical Specifications
V. ACH Operations — Origination, Receipt & Settlement
VI. Exception Handling — Returns, NOCs & Reversals
VII. Risk Management & Fraud Prevention
VIII. Federal Government Payments & Reclamations
IX. Other Payment Systems & Emerging Technologies
, Page |2
question 1: An Originating Depository Financial Institution (ODFI) discovers that a
commercial customer has been originating CCD debit entries without obtaining the required
written authorization from its trading partners. Under the Nacha Operating Rules, what is the
ODFI's warranty obligation regarding these entries?
Correct Answer: The ODFI warrants that each entry is properly authorized by the
Receiver.
The ODFI's warranty under the Nacha Operating Rules includes a guarantee that each entry
is authorized by the Receiver in accordance with the rules. When a commercial customer
originates unauthorized CCD debits, the ODFI remains liable for the breach of this warranty
regardless of the customer's failure to obtain proper authorization. The ODFI must indemnify
the RDFI for any loss resulting from the unauthorized entry.
question 2: A payroll processor submits a PPD credit entry for an employee whose account
was closed. The RDFI returns the entry with return code R02. What is the RDFI's obligation
regarding the return timeframe for this code?
Correct Answer: The RDFI must return the entry by the end of the second banking day
following the settlement date.
Return code R02 (Account Closed) is classified as an administrative return requiring the
RDFI to act within two banking days of the settlement date. The RDFI must identify the
condition and initiate the return within this regulatory timeframe to comply with Nacha
Operating Rules. Failure to return within the prescribed period may result in the RDFI
assuming liability for the entry.
question 3: An Originator is preparing to initiate a WEB debit entry for a consumer's online
purchase. What specific authorization requirement must be met under the Nacha Operating
Rules for WEB entries?
Correct Answer: The Receiver must be authenticated using a commercially reasonable
method, and the authorization must be readily identifiable as an ACH debit.
WEB entries require the Originator to implement a commercially reasonable authentication
method to verify the Receiver's identity before initiating the debit. The authorization must
clearly and conspicuously state that it is for an ACH debit and include the receiver's consent
, Page |3
to the terms. The Originator must also retain a record of the authorization for two years from
the termination date.
question 4: A financial institution is reviewing an ACH file and notices that the blocking
factor in the File Header Record is set to "10." What is the significance of this value in the
NACHA file format?
Correct Answer: The blocking factor specifies that records are grouped in blocks of 10,
and the file must be padded with 9-fill records to achieve a multiple of 10.
The blocking factor of 10 is a mandatory constant in the NACHA file format that determines
how records are organized within the file. The total number of records in the file, including
padding records consisting entirely of the number 9, must be divisible by 10. This padding
ensures compatibility with mainframe processing systems that read data in fixed-size blocks.
question 5: An RDFI receives an ACH credit entry for a Receiver whose account has been
frozen due to a legal garnishment. Which return reason code should the RDFI use, and what
is the applicable return timeframe?
Correct Answer: R16 – Account Frozen, returned within two banking days of
settlement.
Return code R16 (Account Frozen) is used when the RDFI determines that the Receiver's
account is frozen and cannot accept the credit entry. This is an administrative return
requiring action within two banking days. The RDFI must return the entry to the ODFI to
prevent the credit from posting to a restricted account.
question 6: Under the 2026 Nacha fraud monitoring rules, which entities are required to
implement risk-based processes to identify ACH entries initiated due to fraud?
Correct Answer: ODFIs, non-consumer Originators, Third-Party Senders, and Third-
Party Service Providers.
The 2026 fraud monitoring amendments expand requirements beyond traditional participants
to include non-consumer Originators, TPSs, and TPSPs alongside ODFIs and RDFIs. These
entities must establish risk-based processes reasonably intended to identify entries initiated
due to fraud, including credits and debits. The rule emphasizes a proportional approach
scaled to the entity's size and complexity.
, Page |4
question 7: An Originator submits a same-day ACH credit entry in the amount of $1,500,000.
What will be the disposition of this entry under the Same Day ACH rules?
Correct Answer: The entry will be rejected because it exceeds the $1,000,000 Same Day
ACH transaction limit.
Same Day ACH processing is subject to a maximum transaction amount of $1,000,000 per
entry. Entries exceeding this threshold are ineligible for same-day settlement and must be
processed through the standard next-day ACH window. The Originator must either split the
transaction or use standard ACH processing for the entire amount.
question 8: A Third-Party Sender (TPS) is preparing its annual compliance audit. According
to Nacha Operating Rules, what audit obligation applies to TPS entities?
Correct Answer: The TPS must complete an annual ACH Rules Compliance Audit, and
the ODFI must register the TPS with Nacha.
Third-Party Senders are required to undergo an annual ACH Rules Compliance Audit
covering their ACH functions. The ODFI sponsoring the TPS must register the relationship
with Nacha through the Risk Management Portal. Each entity in a nested TPS arrangement
must perform its own audit independently without reliance on other parties.
question 9: An RDFI receives an IAT entry that lacks the required payment-related data
elements in the addenda records. What action should the RDFI take?
Correct Answer: The RDFI should return the entry using R80 – IAT Entry Coding
Error.
Return code R80 is specifically designated for IAT entries containing coding errors, including
missing or incorrect mandatory data elements. The RDFI must identify the deficiency and
return the entry to the gateway operator or ODFI within the prescribed timeframe. The entry
cannot be processed until the coding error is corrected.
question 10: A company originates a PPD debit entry for a consumer payment that was
authorized orally over the telephone. Is this authorization method permissible under the
Nacha Operating Rules?
Correct Answer: Yes, oral authorization is permissible for consumer debit entries if the
Originator provides certain disclosures and retains a record of the authorization.
AAP – ACCREDITED ACH PROFESSIONAL
CERTIFICATION EXAMINATION: STUDY
GUIDE | LATEST UPDATE 2026/2027 |
PRACTICE QUESTIONS AND ANSWERS |
EXAM REVIEW
TABLE OF CONTENTS
I. ACH Network Fundamentals & Participant Roles
II. Nacha Operating Rules — Warranties, Liabilities & Compliance
III. Standard Entry Class (SEC) Codes & Authorization Requirements
IV. ACH File Formatting & Technical Specifications
V. ACH Operations — Origination, Receipt & Settlement
VI. Exception Handling — Returns, NOCs & Reversals
VII. Risk Management & Fraud Prevention
VIII. Federal Government Payments & Reclamations
IX. Other Payment Systems & Emerging Technologies
, Page |2
question 1: An Originating Depository Financial Institution (ODFI) discovers that a
commercial customer has been originating CCD debit entries without obtaining the required
written authorization from its trading partners. Under the Nacha Operating Rules, what is the
ODFI's warranty obligation regarding these entries?
Correct Answer: The ODFI warrants that each entry is properly authorized by the
Receiver.
The ODFI's warranty under the Nacha Operating Rules includes a guarantee that each entry
is authorized by the Receiver in accordance with the rules. When a commercial customer
originates unauthorized CCD debits, the ODFI remains liable for the breach of this warranty
regardless of the customer's failure to obtain proper authorization. The ODFI must indemnify
the RDFI for any loss resulting from the unauthorized entry.
question 2: A payroll processor submits a PPD credit entry for an employee whose account
was closed. The RDFI returns the entry with return code R02. What is the RDFI's obligation
regarding the return timeframe for this code?
Correct Answer: The RDFI must return the entry by the end of the second banking day
following the settlement date.
Return code R02 (Account Closed) is classified as an administrative return requiring the
RDFI to act within two banking days of the settlement date. The RDFI must identify the
condition and initiate the return within this regulatory timeframe to comply with Nacha
Operating Rules. Failure to return within the prescribed period may result in the RDFI
assuming liability for the entry.
question 3: An Originator is preparing to initiate a WEB debit entry for a consumer's online
purchase. What specific authorization requirement must be met under the Nacha Operating
Rules for WEB entries?
Correct Answer: The Receiver must be authenticated using a commercially reasonable
method, and the authorization must be readily identifiable as an ACH debit.
WEB entries require the Originator to implement a commercially reasonable authentication
method to verify the Receiver's identity before initiating the debit. The authorization must
clearly and conspicuously state that it is for an ACH debit and include the receiver's consent
, Page |3
to the terms. The Originator must also retain a record of the authorization for two years from
the termination date.
question 4: A financial institution is reviewing an ACH file and notices that the blocking
factor in the File Header Record is set to "10." What is the significance of this value in the
NACHA file format?
Correct Answer: The blocking factor specifies that records are grouped in blocks of 10,
and the file must be padded with 9-fill records to achieve a multiple of 10.
The blocking factor of 10 is a mandatory constant in the NACHA file format that determines
how records are organized within the file. The total number of records in the file, including
padding records consisting entirely of the number 9, must be divisible by 10. This padding
ensures compatibility with mainframe processing systems that read data in fixed-size blocks.
question 5: An RDFI receives an ACH credit entry for a Receiver whose account has been
frozen due to a legal garnishment. Which return reason code should the RDFI use, and what
is the applicable return timeframe?
Correct Answer: R16 – Account Frozen, returned within two banking days of
settlement.
Return code R16 (Account Frozen) is used when the RDFI determines that the Receiver's
account is frozen and cannot accept the credit entry. This is an administrative return
requiring action within two banking days. The RDFI must return the entry to the ODFI to
prevent the credit from posting to a restricted account.
question 6: Under the 2026 Nacha fraud monitoring rules, which entities are required to
implement risk-based processes to identify ACH entries initiated due to fraud?
Correct Answer: ODFIs, non-consumer Originators, Third-Party Senders, and Third-
Party Service Providers.
The 2026 fraud monitoring amendments expand requirements beyond traditional participants
to include non-consumer Originators, TPSs, and TPSPs alongside ODFIs and RDFIs. These
entities must establish risk-based processes reasonably intended to identify entries initiated
due to fraud, including credits and debits. The rule emphasizes a proportional approach
scaled to the entity's size and complexity.
, Page |4
question 7: An Originator submits a same-day ACH credit entry in the amount of $1,500,000.
What will be the disposition of this entry under the Same Day ACH rules?
Correct Answer: The entry will be rejected because it exceeds the $1,000,000 Same Day
ACH transaction limit.
Same Day ACH processing is subject to a maximum transaction amount of $1,000,000 per
entry. Entries exceeding this threshold are ineligible for same-day settlement and must be
processed through the standard next-day ACH window. The Originator must either split the
transaction or use standard ACH processing for the entire amount.
question 8: A Third-Party Sender (TPS) is preparing its annual compliance audit. According
to Nacha Operating Rules, what audit obligation applies to TPS entities?
Correct Answer: The TPS must complete an annual ACH Rules Compliance Audit, and
the ODFI must register the TPS with Nacha.
Third-Party Senders are required to undergo an annual ACH Rules Compliance Audit
covering their ACH functions. The ODFI sponsoring the TPS must register the relationship
with Nacha through the Risk Management Portal. Each entity in a nested TPS arrangement
must perform its own audit independently without reliance on other parties.
question 9: An RDFI receives an IAT entry that lacks the required payment-related data
elements in the addenda records. What action should the RDFI take?
Correct Answer: The RDFI should return the entry using R80 – IAT Entry Coding
Error.
Return code R80 is specifically designated for IAT entries containing coding errors, including
missing or incorrect mandatory data elements. The RDFI must identify the deficiency and
return the entry to the gateway operator or ODFI within the prescribed timeframe. The entry
cannot be processed until the coding error is corrected.
question 10: A company originates a PPD debit entry for a consumer payment that was
authorized orally over the telephone. Is this authorization method permissible under the
Nacha Operating Rules?
Correct Answer: Yes, oral authorization is permissible for consumer debit entries if the
Originator provides certain disclosures and retains a record of the authorization.
