FedNow® Service Compliance Audits

They do different jobs. The Risk Assessment identifies and scores your exposure looking forward. The audit independently verifies whether the controls you took credit for in that assessment actually operated during a defined period. An institution holding only one has a gap: either it assessed risk without verifying controls, or it tested controls without a framework for prioritising them. Findings from the audit should feed your next Risk Assessment cycle, because a control that failed testing should not keep being scored as effective.

Match it to your FedNow Participant Profile, not to your intentions. If you only receive, take Receive-Only. If you originate as well, take Send & Receive. If the Request for Payment capability is enabled in your profile, take the RfP edition even if you have never sent one, because the warranty and monitoring obligations attach from the moment the capability exists. If you maintain a Master Account and settle for other institutions, take the Correspondent edition. An institution that both settles for Respondents and sends its own payments needs two editions.

An internal auditor, a supervisory committee member, or an outsourced audit firm working on behalf of a client institution. No prior FedNow audit experience is assumed. The guide explains every concept specific to instant payments, and the commentary on each item tells you what evidence actually settles the question and where institutions commonly fail an item they believe they pass.

Yes. The workbook carries no password protection and no locked cells. Input cells are shaded blue as a visual convention rather than an enforced one, so you can edit any cell, insert rows, add columns, or adapt the program to your institution. If you change the reference content, the guide asks you to record what you changed and why so a reviewer or examiner can follow your reasoning.

The Reserve Banks may amend Operating Circular 8 and the Operating Procedures at any time. Every edition names the exact version and effective date it was built against, and the guide instructs you to confirm currency before fieldwork begins. Updated editions are published as the source documents change.

That depends on the edition and on how readily your institution can produce evidence. The guide includes a risk-based scoping chapter for a constrained engagement: test every High-rated item annually, rotate Medium items on a two-year cycle and Low items on three, and document the rotation plan so untested items are visibly deliberate rather than overlooked. Rotation stops after any material change to your core processor, Service Provider, Correspondent or FedNow configuration.