The Accredited Payments Risk Professional exam is taken by people who work in payments, such as ACH, wire, card and compliance staff. This page sets out the exam facts from Nacha, maps each official content area to a practice set, walks through sample questions, and gives a study plan you can follow before test day.
Numbers in brackets link to the official sources listed under Sources & last verified. Dates that have passed are removed automatically.
| Item | Detail | Source · Verified |
|---|---|---|
| Passing score | Pass/no pass; cut score set by Nacha[1] | Nacha · Oct 25, 2026 |
| Exam fee | $650 member / $750 nonmember[2] | Nacha · Oct 25, 2026 |
| Retake fee | New registration fee required[1] | Nacha · Oct 25, 2026 |
| Retake policy | Retake in the following year's window[1] | Nacha · Oct 25, 2026 |
| Validity | 5 years[1] | Nacha · Oct 25, 2026 |
| Delivery | Computer-based at Pearson VUE test centers[1] | Nacha · Oct 25, 2026 |
| Eligibility | Open to anyone in payments; 2 years' experience recommended[3] | Nacha · Oct 25, 2026 |
| Score release | Pass/no pass immediately after the exam[1] | Nacha · Oct 25, 2026 |
| Late registration deadline | June 19 – July 30, 2027 ($700 member / $800 nonmember)[2] | Nacha · Oct 25, 2026 |
| Registration deadline | June 18, 2027 (standard)[2] | Nacha · Oct 25, 2026 |
| Registration opens | Opens January 11, 2027[2] | Nacha · Oct 25, 2026 |
| Testing window | Aug 2 – Aug 28, 2027[2] | Nacha · Oct 25, 2026 |
According to Nacha, “Cut-scores will be established by Nacha in conjunction with the APRP Oversight Panel.”[1]
The Accredited Payments Risk Professional credential is offered by Nacha for people who work with payments risk. The exam is computer-based and delivered at Pearson VUE test centers.
Anyone in payments may register, although Nacha recommends spending 2 years working in the payments industry before taking the exam. The fee is $650 for members and $750 for nonmembers.
Registration opens January 11, 2027 and the standard deadline is June 18, 2027. Late registration runs June 19 to July 30, 2027 at $700 for members and $800 for nonmembers. The test window runs August 2 to August 28, 2027.
The exam is graded pass or no pass, and Nacha sets the cut score. You are told your result immediately after you finish. A candidate who does not pass may retake the exam in the following year's window and must pay a new registration fee. Accreditation is valid for 5 years from the date it is awarded.
Fees and dates can change, so confirm them on the Nacha pages for exam fees and dates and for program policies before you register. We have not verified the number of questions or the time limit, so check Nacha for both.
The content areas below are copied from the official APRP content outline published by Nacha. The right-hand column shows which of our practice sets covers it.
| Official content area | Practice on this site |
|---|---|
| FUNDAMENTALS OF PAYMENTS RISK MANAGEMENT[4] | APRP Risk Assessment & Mitigation Practise identifying the types of payments risk, assessing how likely and how costly each one is, and choosing a sensible mitigation. |
| PAYMENTS RISK MANAGEMENT SYSTEMS AND CONTROLS[4] | APRP Operational Risk Management Practise matching a control, such as dual approval, limits or monitoring, to the specific risk it is meant to reduce. |
| PAYMENTS RISK POLICY AND GOVERNANCE[4] | APRP Payments Risk Policy & Governance Practise telling apart policy, procedure and oversight roles, and who is accountable for approving and reviewing risk decisions. |
| PAYMENT SYSTEMS[4] | APRP Payment Systems Practise how each payment type moves, who bears the risk at each step, and where fraud or error can enter. |
| PHYSICAL AND INFORMATION SECURITY[4] | APRP Physical and Information Security Practise access control, credential protection, data handling and the attack methods aimed at payment accounts. |
| REGULATORY ENVIRONMENT[4] | APRP Regulatory Environment Practise which rule or authority applies to a given payment scenario, including sanctions and anti-money-laundering obligations. |
Prepare for the APRP - Accredited Payments Risk Professional exam with our free practice test modules. Each quiz covers key topics to help you pass on your first try.
These are practice questions written for this site, not questions from the real exam. Each explanation shows why the right answer is right and why the others are wrong.
Question: In the context of quantum computing threats to payments, which cryptographic standard used in current payment security is most immediately vulnerable?
Answer: A. RSA and elliptic curve cryptography (ECC) used in TLS and EMV chip authentication
Explanation:
RSA and elliptic curve cryptography are correct because their security rests on math problems that Shor's algorithm, run on a large enough quantum computer, can solve efficiently. TLS key exchange and EMV chip authentication both depend on them, so they are the first candidates for post-quantum replacement.
AES-256 is wrong because it is symmetric; quantum attacks weaken it only modestly, and a longer key restores the margin. SHA-3 is wrong because hash functions are not broken by Shor's algorithm. HMAC is wrong for the same reason: it is built on hashing and a shared key.
Rule to remember: quantum risk falls hardest on public-key (asymmetric) cryptography, not on symmetric encryption or hashing.
Question: In payments risk management, 'corporate account takeover' (CATO) is BEST described as:
Answer: B. Criminals stealing business online banking credentials to initiate unauthorized ACH debits or wire transfers
Explanation:
Corporate account takeover is correct because the attacker steals a business's online banking credentials, often through malware or phishing, and then initiates payments such as ACH debits or wires as if they were the real user.
A hostile acquisition is wrong because that is a corporate finance event and has nothing to do with fraud. A regulator seizing control of a non-compliant institution is wrong because that is a supervisory action against a bank, not a crime against a customer. An employee diverting incoming wires is wrong because that is internal fraud, whereas this scheme comes from outside and uses stolen access.
Rule to remember: takeover of an account means impersonating the legitimate account holder through compromised credentials.
Question: An international remittance provider uses cryptocurrency rails to avoid correspondent banking fees. What is the primary OFAC compliance challenge?
Answer: A. Screening wallet addresses against OFAC's SDN list when blockchain addresses are pseudonymous and change frequently
Explanation:
Screening wallet addresses is correct because OFAC compliance depends on identifying sanctioned parties, and blockchain addresses are pseudonymous and easy to change, so a name-based screening process does not map neatly onto them.
Price fluctuation is wrong because it affects valuation and reporting, not the core question of whether a sanctioned party is involved. The FinCEN reporting option is wrong because it is a different regime and the question asks about OFAC. Needing a specific OFAC license for cryptocurrency use is wrong because sanctions law applies to the parties and activity involved, not to the technology, and no separate license is needed just to use it.
Rule to remember: sanctions obligations follow the parties and the activity, whatever the payment rail.
Start with the official content areas listed above and read the Nacha exam information so you know what is in scope. Then take a short diagnostic in each area using the matching practice set, and note which areas feel weakest.
Spend most of your time on those weak areas. Work through a set, and for every miss read the explanation and write one line in your own words stating the rule. If a miss comes from not knowing a term or rule, go back to the official material for that topic rather than only repeating questions.
Mix topics as test day approaches. The full practice test helps you practise switching between areas, which the real exam will also ask of you. Pay extra attention to the links between areas, such as how a fraud scenario involves both a payment system and a regulatory duty.
Before your test window, check your registration, your test center booking and the identification Pearson VUE requires. Review your own rule notes in the last days instead of starting new material, and keep in mind that these questions are written by us and are not real exam questions.
The exam is open to anyone in payments. Nacha recommends spending 2 years working in the payments industry before taking it, but that is a recommendation rather than a stated requirement. Check the Nacha page on becoming an APRP for the current wording before you register.
The standard fee is $650 for Nacha members and $750 for nonmembers. Late registration, from June 19 to July 30, 2027, costs $700 for members and $800 for nonmembers. Confirm the amounts on Nacha's exam fees and dates page, since fees can change.
The test window runs from August 2 to August 28, 2027. Registration opens January 11, 2027 and the standard deadline is June 18, 2027. The exam is computer-based at Pearson VUE test centers, so you also need to book your appointment.
The exam is graded pass or no pass. Nacha sets the cut score together with the APRP Oversight Panel, and we do not know a published number. You are told your result immediately after completing the exam.
You may retake the exam in the following year's window. A new registration fee is required for the retake. Use the time in between to review the content areas where you were weakest, using the practice sets on this page and Nacha's official material.
Accreditation is valid for 5 years from the date it is awarded. Nacha's program policies explain what is needed afterwards, so read them on the Nacha website to plan for renewal rather than relying on this page.
How we verify: editorial & fact-checking policy. Report an error: contact us.