2026 EDITION | INSTANT DIGITAL DOWNLOAD
FedNow® Compliance Audit Suite
Four complete internal audit programs, one for each way a financial institution participates in the FedNow Service. Every requirement tested, cited, and risk-rated against Operating Circular 8 (effective April 1, 2026) and the FedNow Service Operating Procedures v3.6.
Workpapers • Sample audit report • Item-by-item user guide
Choose Your EditionAn audit is not a risk assessment
They answer different questions, and examiners increasingly expect both. Your risk assessment identifies and scores exposure. Your audit independently verifies whether the controls you take credit for are actually operating.
Risk Assessment
Question: What could go wrong, and how exposed are we?
Orientation: Prospective. Looks forward at exposure.
Method: Likelihood multiplied by Impact produces an inherent score; control effectiveness produces a residual score.
Output: Risk register, domain heat map, residual risk profile, risk appetite statement.
Who performs it: Risk or compliance, often with operations input.
Compliance Audit
Question: Did we actually do what is required?
Orientation: Retrospective. Looks back at a defined audit period.
Method: Each requirement is tested against evidence and receives a result.
Output: Workpapers, findings with severity ratings, an audit report, a remediation plan.
Who performs it: Internal audit or an independent outsourced auditor.
Choose the edition that matches your participation
The obligations that attach to your institution depend entirely on how you participate. Each edition tests only what applies to you, so nothing is padded with requirements you will scope out anyway.
EDITION 01 | $799
Receive-Only
94 audit items across 12 sections. 38 rated High risk.
For institutions authorized to receive instant payments but not to originate them. The most common entry point for community banks and credit unions.
Covers the Authorized Connection Profile, 24x7x365 availability, Request for Confirmation response timing, immediate funds availability, Accept Without Posting, message signing, reconcilement, and BSA/AML for irrevocable inbound payments.
EDITION 02 | $899
Send & Receive
110 audit items across 14 sections. 50 rated High risk.
For institutions that both originate and receive instant payments and do not use Request for Payment.
Everything in the Receive-Only edition, plus two origination sections covering payment order format, duplicate payment controls, exposure limits, and customer authorization under Regulation E and Article 4A. Includes an item that verifies Request for Payment is genuinely disabled rather than merely unused.
EDITION 03 | $999
Send & Receive with Request for Payment
123 audit items across 15 sections. 58 rated High risk.
For institutions that originate, receive, and use the Request for Payment capability.
Adds a dedicated thirteen-item Request for Payment section built on the expanded obligations in Operating Procedures v3.6 section 12: the legitimate purpose tests applied separately to business and individual customers, the UDAAP reference, mandatory customer-level volume monitoring, investigation procedures requiring customer inquiry, and the warranty breach return process with its 95 calendar day deadline.
EDITION 04 | $1,199
Correspondent
70 audit items across 11 sections. 38 rated High risk.
For institutions that maintain a Master Account and settle FedNow transactions on behalf of Respondent participants.
A fundamentally different program. Operating Circular 8 section 7.6 says the Correspondent is not a party to the transfers it settles; section 7.9 makes it responsible for the funds anyway. Covers settlement account governance, Net Send Limit administration, Respondent oversight and due diligence, and continuous intraday liquidity management.
Not sure which edition applies? Your Participant Profile answers it. If the profile permits origination you need a Send edition; if it permits Request for Payment you need Edition 03. If you settle for other institutions, you need the Correspondent edition regardless of your own activity.
A Correspondent that also sends or receives its own payments needs both the Correspondent edition and the matching participant edition, since each covers a different role.
Every edition includes three files
Audit Workpapers (Excel)
The audit program itself. Every requirement carries its citation, a suggested test type, a pre-assigned Requirement Risk Level, and a written audit procedure telling you what evidence to obtain.
Input cells are shaded so you always know what is yours to complete. The workbook is unprotected, so you can adapt the program to your institution.
Sample Audit Report (Word)
A working report template built on the condition, criteria, effect and recommendation structure examiners expect.
Includes illustrative findings drawn from real failure modes, a remediation summary with owner and target date fields, and signature blocks for attestation and board presentation.
User Guide (Word)
A full companion guide with an item-by-item reference covering every audit item in that edition.
Each item carries a Payments Professor commentary explaining the regulatory context, which evidence actually settles the question, and where institutions commonly fail an item they believe they pass.
Verified line by line against current authority
Every requirement in every edition carries a citation you can hand to an examiner.
Operating Circular 8
Effective April 1, 2026. Supersedes the January 5, 2026 version. The binding legal framework for FedNow participation.
Operating Procedures v3.6
April 2026. Supersedes v3.5. Includes the expanded Request for Payment obligations at section 12 and the Authorized Connection Profile detail at section 8.2.
Supporting authority
Operating Circular 5, Regulation J, UCC Article 4A, Regulation E, and the Federal Reserve Policy on Payment System Risk, each cited where it applies.
Questions
Do I need the audit if I already own the risk assessment?
Which edition do I need?
Who is this written for?
What if I cannot audit every item in one engagement?
What happens when the rules change?
Pair it with the matching Risk Assessment
The audit verifies that your controls operated. The risk assessment identifies and scores what you are exposed to in the first place. Used together, findings from the audit feed the next assessment cycle, so a control that failed testing stops being scored as effective.
Receive-Only
52 scored risk items across 7 domains, with an auto-scoring workbook and heat-mapped dashboard.
Send & Receive
81 scored risk items covering both origination and receipt, with the same scoring methodology.
Send & Receive with RfP
97 scored risk items across 8 domains, including a dedicated 16-item Request for Payment domain.
Correspondent
65 scored risk items for institutions settling FedNow activity on behalf of Respondents.
Each risk assessment includes an auto-scoring Excel workbook with a Likelihood and Impact scoring model, control effectiveness ratings, a domain heat map, and a board-ready executive report, plus a companion user guide.
Walk into the exam with the work already done
Four editions. One for each way an institution participates in the FedNow Service. Every requirement tested, cited and risk-rated, with an item-by-item guide that tells you what evidence actually settles the question.
Choose Your Edition