What examiners look for in a positive pay program

No single regulation is titled "positive pay". Examiners and auditors reach it through the areas it touches: payment systems risk, ACH Rules compliance, information security, third-party risk and, increasingly, fraud risk management. Below is what tends to come up, and the evidence that answers each question quickly.

1. Product governance

• Agreements. Signed treasury management agreements that describe the service, the cutoff, the default decision and who bears which losses.
• Declined service. For customers offered positive pay who declined it, a record of the offer and the decline, if your agreements rely on it.
• Defaults on file. Each customer's default decision, recorded, and matching what the system actually applies.
• Procedures. Written procedures for onboarding, daily processing, late decisions, overrides and outages.

2. Daily operations

• Timeliness. Evidence that decisions were made and returns sent within the deadlines: the check midnight deadline, and the Nacha return timeframes for ACH.
• Exception aging. No items left open past their cutoff without a recorded outcome.
• File reconciliation. Presented-item files reconciled to their control totals; issue files received and loaded completely.
• Missing issue files. Monitoring for customers who have stopped sending them, and follow-up when they do.
• Overrides. Every decision bank staff made for a customer, with who asked and how it was authenticated.

3. Access, entitlements and dual control

• Least privilege. Roles that give bank and customer users only what they need. Customer users see only their own company's data.
• Segregation of duties. The same person shouldn't both submit items and decide them, or both manage users and define what roles can do.
• Dual control. Maker-checker on decisions where the bank or customer requires it, and on changes to sensitive settings such as matching rules.
• Strong authentication. Multi-factor authentication, at least for administrators and decision-makers.
• Access recertification. Periodic review of who has access, with last sign-in dates, and removal of people who've left or changed jobs.

4. Audit trail

For any single item, an examiner may ask who decided it, when, what they saw, and whether anyone changed it afterwards. The answer should come from a log that can't be quietly edited. The same goes for changes to configuration: who changed a matching threshold or a customer's default, and who approved it.

5. Nacha Operating Rules

• Annual Rules compliance audit. ACH positive pay and unauthorized-return handling fall within its scope for an RDFI.
• Returns. Correct return reason codes, made within the timeframes, and Written Statements of Unauthorized Debit where the Rules require them.
• Data security. Protection of account numbers and other protected information, including the requirement for certain participants to make account numbers unreadable when stored electronically.
• Fraud monitoring. Since June 22, 2026, every RDFI must have risk-based processes to identify incoming ACH credits initiated by fraud, such as diverted payroll, and review those processes at least once a year. The largest RDFIs started in March. The rule is about credits arriving, so ACH positive pay, which watches debits leaving a business account, doesn't satisfy it on its own. Expect examiners to ask how the two programs fit together. Check the current Rules for scope and dates.

6. Third-party risk

Most institutions buy positive pay from a vendor or a core provider, which brings it under the 2023 interagency guidance on third-party relationships. Expect questions on due diligence before selection, the contract, ongoing monitoring (SOC reports, performance, incidents), the complementary user entity controls the bank is responsible for, and an exit plan. That means getting your data out in a usable form, and having the provider delete it, with proof, when you leave.

7. Model risk

If the system scores exceptions with a model, or applies defaults based on a score, model risk management expectations (SR 11-7 and OCC Bulletin 2011-12) apply. Examiners will look for documentation of what the model does and what data it learns from, validation before use, ongoing monitoring, and an explanation of individual results. A model nobody at the bank can explain is hard to defend.

8. Information security and change management

The FFIEC IT Examination Handbook themes apply as they would to any critical application: encryption in transit and at rest, logging and monitoring (ideally into the bank's SIEM), vulnerability management, change control for releases and configuration, and business continuity. What happens to the day's exceptions if the system is down at 10 a.m.? Under the interagency computer-security incident notification rule, a bank service provider must tell the bank as soon as possible about an incident that disrupts its services for four hours or more, so know who at the bank receives those notices.

9. Fraud reporting

Positive pay often surfaces fraud the bank must report. Make sure returned items found to be fraudulent reach whoever decides on Suspicious Activity Reports. FinCEN's 2023 alert on mail theft-related check fraud describes the patterns and red flags examiners will expect the bank to recognize, and asks banks to use the key term FIN-2023-MAILTHEFT in related SARs. The positive pay record (the issued item, the presented check's image, and who decided what and when) is the supporting documentation those SARs need.

An evidence pack that answers most questions

1. Customer list with default decisions and cutoffs, and agreements on file.
2. Exceptions for the period with reason, decision, decided by, approved by and time, plus any defaults applied.
3. Returns sent, with timestamps against deadlines.
4. User access export with roles and last sign-in, and the latest access review.
5. Configuration changes with approvals.
6. Proof the audit log is intact.
7. For any model: documentation, validation results and monitoring.
8. Vendor due diligence file and the list of complementary user entity controls.

How OpenClear supports an exam

OpenClear was built with this checklist in mind. It runs more than 50 automated control checks, hourly and nightly, with PASS, WARN or FAIL results kept for seven years. It exports a signed evidence bundle for any period, covering every decision with who recommended and who made it, the matching code and models in force with a SHA-256 of each, segregation-of-duties breaches, changes and their approvals, and whether the action log verifies. It flags any check decision sent after the check's midnight deadline, and when a bank or customer leaves, it deletes their data with a signed certificate. Its documentation maps each control to the FFIEC IT Handbook, the Nacha Operating Rules, check law (UCC and Regulation CC), GLBA, NYDFS Part 500, incident notification, SARs and OFAC, SR 11-7, the third-party risk guidance and NIST SP 800-53. Each regulatory page says when it was last checked against its sources, and a control check warns when one is over a year old. It also says plainly which controls remain the bank's job. Start at the compliance overview.