APRP Practice Test

The Accredited Payments Risk Professional exam is taken by people who work in payments, such as ACH, wire, card and compliance staff. This page sets out the exam facts from Nacha, maps each official content area to a practice set, walks through sample questions, and gives a study plan you can follow before test day.

APRP Exam at a Glance

What changed for APRP in 2026

• Oct 25, 2026: Score release changed to Pass/no pass immediately after the exam (previously Immediately after the exam; final letter in 6–8 weeks).^[1]
• Oct 25, 2026: Retake fee changed to New registration fee required (previously Full new registration fee).^[1]
• Oct 25, 2026: Eligibility changed to Open to anyone in payments; 2 years' experience recommended (previously Open to anyone; 2 years' payments experience recommended).^[3]

What the APRP is and how it works

According to Nacha, “Cut-scores will be established by Nacha in conjunction with the APRP Oversight Panel.”^[1]

The Accredited Payments Risk Professional credential is offered by Nacha for people who work with payments risk. The exam is computer-based and delivered at Pearson VUE test centers.

Anyone in payments may register, although Nacha recommends spending 2 years working in the payments industry before taking the exam. The fee is $650 for members and $750 for nonmembers.

Registration opens January 11, 2027 and the standard deadline is June 18, 2027. Late registration runs June 19 to July 30, 2027 at $700 for members and $800 for nonmembers. The test window runs August 2 to August 28, 2027.

The exam is graded pass or no pass, and Nacha sets the cut score. You are told your result immediately after you finish. A candidate who does not pass may retake the exam in the following year's window and must pay a new registration fee. Accreditation is valid for 5 years from the date it is awarded.

Fees and dates can change, so confirm them on the Nacha pages for exam fees and dates and for program policies before you register. We have not verified the number of questions or the time limit, so check Nacha for both.

APRP content outline and where to practise each area

The content areas below are copied from the official APRP content outline published by Nacha. The right-hand column shows which of our practice sets covers it.

Worked examples: how to reason through APRP questions

These are practice questions written for this site, not questions from the real exam. Each explanation shows why the right answer is right and why the others are wrong.

Example 1

Question: In the context of quantum computing threats to payments, which cryptographic standard used in current payment security is most immediately vulnerable?

1. RSA and elliptic curve cryptography (ECC) used in TLS and EMV chip authentication
2. AES-256 symmetric encryption used for at-rest card data encryption
3. SHA-3 hashing used in payment transaction integrity checks
4. HMAC-based message authentication codes used in API security

Answer: A. RSA and elliptic curve cryptography (ECC) used in TLS and EMV chip authentication

Explanation:

RSA and elliptic curve cryptography are correct because their security rests on math problems that Shor's algorithm, run on a large enough quantum computer, can solve efficiently. TLS key exchange and EMV chip authentication both depend on them, so they are the first candidates for post-quantum replacement.

AES-256 is wrong because it is symmetric; quantum attacks weaken it only modestly, and a longer key restores the margin. SHA-3 is wrong because hash functions are not broken by Shor's algorithm. HMAC is wrong for the same reason: it is built on hashing and a shared key.

Rule to remember: quantum risk falls hardest on public-key (asymmetric) cryptography, not on symmetric encryption or hashing.

Example 2

Question: In payments risk management, 'corporate account takeover' (CATO) is BEST described as:

1. A hostile acquisition of a payment processing company by a competitor
2. Criminals stealing business online banking credentials to initiate unauthorized ACH debits or wire transfers
3. A regulatory action in which authorities seize control of a non-compliant financial institution
4. An internal fraud scheme in which an employee diverts incoming wires to a personal account

Answer: B. Criminals stealing business online banking credentials to initiate unauthorized ACH debits or wire transfers

Explanation:

Corporate account takeover is correct because the attacker steals a business's online banking credentials, often through malware or phishing, and then initiates payments such as ACH debits or wires as if they were the real user.

A hostile acquisition is wrong because that is a corporate finance event and has nothing to do with fraud. A regulator seizing control of a non-compliant institution is wrong because that is a supervisory action against a bank, not a crime against a customer. An employee diverting incoming wires is wrong because that is internal fraud, whereas this scheme comes from outside and uses stolen access.

Rule to remember: takeover of an account means impersonating the legitimate account holder through compromised credentials.

Example 3

Question: An international remittance provider uses cryptocurrency rails to avoid correspondent banking fees. What is the primary OFAC compliance challenge?

1. Screening wallet addresses against OFAC's SDN list when blockchain addresses are pseudonymous and change frequently
2. Calculating transaction values in USD when cryptocurrency prices fluctuate between initiation and settlement
3. Reporting cryptocurrency transactions to FinCEN when no CTR threshold exists for digital assets
4. Obtaining a specific license for cryptocurrency use from the Office of Foreign Assets Control

Answer: A. Screening wallet addresses against OFAC's SDN list when blockchain addresses are pseudonymous and change frequently

Explanation:

Screening wallet addresses is correct because OFAC compliance depends on identifying sanctioned parties, and blockchain addresses are pseudonymous and easy to change, so a name-based screening process does not map neatly onto them.

Price fluctuation is wrong because it affects valuation and reporting, not the core question of whether a sanctioned party is involved. The FinCEN reporting option is wrong because it is a different regime and the question asks about OFAC. Needing a specific OFAC license for cryptocurrency use is wrong because sanctions law applies to the parties and activity involved, not to the technology, and no separate license is needed just to use it.

Rule to remember: sanctions obligations follow the parties and the activity, whatever the payment rail.

How to use these practice tests

Start with the official content areas listed above and read the Nacha exam information so you know what is in scope. Then take a short diagnostic in each area using the matching practice set, and note which areas feel weakest.

Spend most of your time on those weak areas. Work through a set, and for every miss read the explanation and write one line in your own words stating the rule. If a miss comes from not knowing a term or rule, go back to the official material for that topic rather than only repeating questions.

Mix topics as test day approaches. The full practice test helps you practise switching between areas, which the real exam will also ask of you. Pay extra attention to the links between areas, such as how a fraud scenario involves both a payment system and a regulatory duty.

Before your test window, check your registration, your test center booking and the identification Pearson VUE requires. Review your own rule notes in the last days instead of starting new material, and keep in mind that these questions are written by us and are not real exam questions.

Sources & last verified

1. Nacha — passing score, retake fee, retake policy, validity (official source). “Cut-scores will be established by Nacha in conjunction with the APRP Oversight Panel.” Verified Oct 25, 2026.
2. Nacha — exam fee, registration deadline, registration opens, late registration deadline (official source). “Member: $650 Nonmember: $750” Verified Oct 25, 2026.
3. Nacha — eligibility (official source). “At a minimum, Nacha recommends spending two years working in the payments industry before taking the APRP exam.” Verified Oct 25, 2026.
4. Nacha — other (official source). “fundamentals of payments risk management” Verified Oct 28, 2026.

How we verify: editorial & fact-checking policy. Report an error: contact us.