Session 8: ACH. New York Bankers Association-Community Bank Auditors Group Internal Audit Training-June 6-8, 2016

Transcription

1 Session 8: ACH New York Bankers Association-Community Bank Auditors Group 2016 Internal Audit Training-June 6-8, 2016 MEMBER OF ALLINIAL GLOBAL, AN ASSOCIATION OF LEGALLY INDEPENDENT FIRMS 2016 Wolf & Company, P.C.

2 Today s Agenda Who is NACHA/NYACH? 2015 Notable Rule Change 2016 Rule Changes (Four Dates) What s Next? Frequently Asked Questions Common Issues & Best Practices 2

3 What is NACHA? National Automated Clearing House Association Establishes the standards, rules, and procedures that enable depository financial institutions to exchange ACH payments on a national basis. More than 25,000 depository institutions are members. 3

4 New York ACH Association NYACH is the largest private sector ACH operator Participants include almost all depository institutions in New York and northern New Jersey Process all ACH items exchanged between its participants, sending the remaining items to the Federal Reserve 4

5 Regional Payments Associations 5

6 How s it work? 6

7 2015 Change Looking Back One Notable Change: September 18,

8 Changes: September 18, 2015 New/Updated ODFI Return Rate Thresholds Reduce the existing Return Rate threshold for unauthorized debits from 1.0% to 0.5% R05, R07, R10, R29 & R51 Establishes a preliminary inquiry process to evaluate and research cases in which an Originator s administrative returns exceed 3% return rate level R02, R03, R04 Establishes a preliminary inquiry process to evaluate and research cases in which an Originator s overall returns exceed 15% return rate level All return reason codes 8

9 2016 Changes Overview 2016 Rule Changes January 1, 2016 March 18, 2016 September 23, 2016 October 3,

10 Changes: January 1, 2016 RDFI Obligation Revises Article Three, Section 3.11 (RDFI Obligation to Rec) RDFI s obligation to recredit a consumer Receiver includes the circumstance of an improperly Reinitiated Debit Entry defined in Article Three, Subsection (Improperly Reinitiated Debit Entries) 10

11 Changes: January 1, 2016 Reasonable Encryption Standard Require ACH participants to have a commercially reasonable standard of encryption technology Removal of existing reference to 128-bit encryption technology 11

12 Changes: January 1, 2016 Re-crediting Receiver Removed 15 calendar day notification for re-crediting a receiver For unauthorized debit entries Consumer accounts 12

13 Changes: January 1, 2016 Zero-Dollar Entry Adds back in the definition of a Zero-Dollar Entry within Article Eight Section Bears remittance data that must be provided to the Receiver in an identical manner as live entries that transfer funds Non-monetary entry transmitted by an Originator to the account of a Receiver to convey payment related remittance data to the Receiver Must Include: Transaction Code for Zero-Dollar Entry Transmitted as a CCD or CTX Entry to a Non-Consumer Account IAT Entry to the account of any Receiver 13

14 Changes: January 1, 2016 Notification of Change RDFI s warranty for information contained in a Notification of Change or Corrected Notification of Change is applicable only to the corrected information supplied by the RDFI Removes from the RDFI s warranty on NOCs the specific statement that the Receiver has authorized the change identified in the NOC 14

15 Changes: January 1, 2016 Expansion of Permissible Criteria for ODFI Returns Permits an ODFI to request an RDFI return any Entry the ODFI claims was originated without the Originator s authorization Also expands the description of Return Reason Code R06 (Returned per ODFI s Request) to include Entries returned by the RDFI for this reason Reflects actual current industry practice with regard to the recovery of funds related to unauthorized credit origination 15

16 Changes: January 1, 2016 ACH Network Administration Fees No change from the 2015 to 2016 fees Per Entry Fee: $ Average Annual Fee: $

17 Changes: March 18, 2016 ACH Cards Issued by a retailer and linked to a customer s checking account Requires Originators or Third-Party Service Providers that issue ACH cards to make disclosures to a consumer prior to activation. Disclosure must include: POS Entries made with the ACH Card that exceed the balance in the customer s financial institution account may result in overdrafts and associated fees Regardless of whether the consumer has opted to allow overdrafts with respect to debit cards issued by the Financial Institution Benefits and protections for transactions made using the ACH Card may vary from those available through debit cards issued by the consumer s Financial Institution 17

18 Changes: September 23, 2016 Same Day ACH The new ACH Network Functionality will be implemented in three different phases: 18

19 Changes: September 23, 2016 Same Day ACH Why? Keep up with the faster payment options Offers enhanced payment options for consumers, businesses and governments Adds two new same day settlement windows to each day Does not alter existing capabilities of the ACH Network 19

20 Changes: September 23, 2016 Same Day ACH Origination of Same Day ACH entries is optional Receipt of Same Day Entries is not optional All RDFIs Same Day Entries are required and must pickup incoming ACH files from ACH Operator or receiving point and post Entries Next-day processing schedules remain unchanged and continue to be available 20

21 Changes: September 23, 2016 Same Day ACH Eligible Transactions Individual Entries of $25,000 and under All Standard Entry Class (SEC) codes exception for International ACH transactions (IATs) Zero-dollar Entries, such as prenotifications (prenotes), with the exception of Automated Enrollment Entries (ENRs) 21

22 Changes: September 23, 2016 Same Day ACH Phase 1 Summary ACH Credits become eligible for same-day settlement Settlement occurs at 1:00PM and 5:00PM ET RDFIs are required to make funds available (not available for withdrawal) from Same Day ACH credits by the end of their processing day 22

23 Changes: September 23, 2016 Same Day ACH Entry Fee Designed to mitigate operating and investment costs for RDFIs who are required to participate in Same Day ACH Approved fee is set at 5.2 cents per Same Day transaction to be paid by the ODFI to the RDFI of the Entry There will be periodic reviews of the Same Day Entry Fee by NACHA 23

24 Changes: September 23, 2016 Same Day ACH Return Processing The return timeframe as it exists today in the NACHA Operating Rules will not change However, Same Day enables the RDFI to process returns right away on Settlement Date at its discretion, regardless of whether the forward Entry was a Same Day transaction or not Transaction limit and IAT restrictions do not apply to returns 24

25 Changes: September 23, 2016 ACH Date Fields 25

26 Changes: September 23, 2016 Effective Entry Dates (EED) Case Study 26

27 Changes: September 23, 2016 Same Day ACH Balanced Files Phase 1 Credits Only If send both credit and debit files that off-set each other, the debit file and/or transaction cannot be processed during Phase I, regardless if the debit entry is sent in the same file. The debit file will be pushed back for settlement in the next eligible window Credits will settle before the funding debit file and could fail to settle after the credit file has been released 27

28 Changes: September 23, 2016 Same Day ACH Rule Changes The following sections of the NACHA Operating Rules will change with Phase 1 (September 23, 2016) Article One, Section 1.12 Same Day Entry Fee (new section) Article Two, Subsection General Rule For IAT Entries Article Three, Subsection RDFI May Rely On Settlement Date (new subsection) Article Three, Subsection General Rule For Availability Of Credits Article Eight, Section 8.84 Same Day Entry (new section) 28

29 Changes: September 23, 2016 Same Day ACH Rule Changes The following sections of the NACHA Operating Rules will change with Phase 1 (September 23, 2016) Appendix Three, Subpart Glossary of Data Elements Company Descriptive Date: 6 Positions Company/Batch Header Record Optional Effective Entry Date: 6 Positions Company/Batch Header Record Required (all batches) Settlement Date: 3 Positions Company/Batch Header Record Inserted by Receiving ACH Operator (all batches) 29

30 Changes: September 23, 2016 Same Day ACH Rule Changes The following sections of the NACHA Operating Rules will change with Phase 1 (September 23, 2016) Appendix Ten, Subpart Responsibilities of Enforcement Panel Appendix Eleven Determination and Review of Same Day Entry Fee (new section) PART 11.1 Determination of Same Day Entry Fee (new) PART 11.2 Revision of Same Day Entry Fee (new) Part 11.3 Same Day ACH Initial Period (new) Part 11.4 Same Day ACH Phase Three Effective Date (new) Part 11.5 Same Day ACH Renewal Period (new) 30

31 Changes: October 3, 2016 Improving Network ACH Quality Defines and Establishes a Methodology Methodology for Setting Fees Collection of Fees Effective Date 31

32 What s Next? Same Day ACH Phases 2 &3 With Phase 2 implementation, the addition of debits expands eligibility further Same Day ACH debits will support bill payment, account-toaccount transfers, check conversion, business-to-business, and e-commerce payments Prenotifications for future debit Entries and Reversals of credits will be eligible for same-day processing Effective date: September 15, 2017 With Phase 3, RDFIs must make funds available for withdrawal by 5:00 PM RDFI local time Effective Date: March 16,

33 What s Next? Proposed RFC-Third Party Sender Registration The registry would be a risk mitigation tool that (1) standardize across all ODFIs the basic data collected for all Third-Party Senders; and (2) provide high-level information on Third-Party Senders that would enable better monitoring by NACHA of trends and any risks associated with Third-Party Senders in the ACH Network. 33

34 What s Next? RFC-Third Party Sender Registration Proposed effective date: June 16, 2017 The required registration information would be: ODFI s name and contact information Third-Party Sender name and principal business Third-Party Sender routing number and Company Identification Information for each currently existing Third-Party Sender relationship by the effective date of the Rule, and, after the Rule becomes effective, within 30 days of originating entries for any new Third-Party Sender relationship. 34

35 2016 Frequently Asked Questions 1. What does funds availability for same-day settlement mean? 35

36 2016 Frequently Asked Questions Currently, the general rule of funds availability for same day entries is: The RDFI must make the amount of the credit entry available in the Receiver s account no later than the completion of the RDFI s processing. An RDFI is not required to make such funds available for withdrawal on the settlement date. Note: When Phase III becomes effective, for a credit same-day entry, an RDFI must make the amount of the credit entry available to the receiver for withdrawal no later than 5 PM local time. 36

37 2016 Frequently Asked Questions 2. If an originator has a preauthorized agreement and re-sends the transaction the same as before, does the new RETRY PYMT rule still apply? 37

38 2016 Frequently Asked Questions Yes, preauthorized debits are not precluded from reinitiation in the Rules. If the item gets returned, originators cannot send the same or similar transaction without RETRY PYMT present. Suggestion: 1) Ensure the appropriate personnel are aware of these rules and 2) educate the originators on how to handle these type of situations. 38

39 2016 Frequently Asked Questions 3. What is a Commercially reasonable standard for encryption? 39

40 2016 Frequently Asked Questions NACHA updated this information to keep pace with the ever-so evolving technology environment. Industry best practice indicates that a 256 bit AES encryption should be used. However, if your institution is utilizing a 128 bit encryption, that will suffice as a Commercially reasonable standard. 40

41 2016 Frequently Asked Questions 4. Are the changes effective September 23, 2016 mandatory? 41

42 2016 Frequently Asked Questions Part I RDFIs Receipt of Same Day Entries is not optional for RDFIs. RDFIs should consider the following potential impacts: 1.New file submission and delivery schedules with ACH Operator 2.Review procedures and resources for processing files in the new delivery windows 3.Process entries based on the Settlement Date provided by the ACH Operator 4.Determine whether to use the new same-day processing windows to send returns and NOCs 5.Provide end of day funds availability for all same day credit entries received 6.Review downstream applications and systems that may be impacted by Same Day Entries 7.Will receive information from their ACH Operator regarding receipt of the Same Day Entry fees **Returns will be allowed but not required to be processed on the same day. For a Same Day ACH entry, since settlement is one day sooner, the return deadline is also one day sooner 42

43 2016 Frequently Asked Questions Part II ODFIs Offering Same Day ACH products and services is optional for ODFIs. ODFIs should consider the following potential impacts: 1.New file submission and delivery schedules with ACH Operator 2.Review and revise internal processing schedules and procedures to accommodate new windows for Same Day Entries 3.Review applications and systems that may be impacted by Same Day Entries Communicate with Originators/Third-Parties on Same Day Entries: Determine customers and business models to offer Same Day Discuss proper use of the Effective Entry Date and impacts of improper Effective Entry Dates. Discuss alternatives if an Originator is not able to properly use Effective Entry Dates. If desired, discuss use of an optional indicator for Same Day entries Discuss eligibility requirements for Same Day Entries 4.Develop procedures for holding entries that are received from an Originator in time for a same day window but that is not the Originator s desire 5.Be aware that Phase 1 is restricted to credit and non-monetary entries only 6.ODFIs will receive information from their ACH Operator regarding collection of the Same Day Entry fees. 43

44 Frequently Asked Questions 5. Who pays the Same Day ACH Fee? 44

45 Frequently Asked Questions The fee is paid from the ODFI to the RDFI. However, the ODFI can pass the fee on to the Originator if this information is included in the Origination agreement. Suggestion: Review Originator contract to ensure fee language is up to date if your institution selects to pass fees on to its originators. 45

46 Frequently Asked Questions 6. How do you recommend we track same day ACH fees? 46

47 Frequently Asked Questions We recommend that your institution utilize a tracking mechanism of all Same Day ACH transactions. Some vendors are offering platforms to track these types of transactions. Using this mechanism will allow your institution to compare what has been paid and what is outstanding (reconciliation). 47

48 Frequently Asked Questions 7. Who should the new ODFI percentages be reported to? 48

49 Frequently Asked Questions NACHA does not specifically note what and who these percentages should be reported to. Suggestion: Limits should be reported to some type of Risk Committee. These risk indicators should be monitored to ensure your institution is in compliance with the established tolerances. 49

50 Common Issues & Best Practices 1. Same Day ACH 5. Return Reason Codes 2. ODFI Return Monitoring 6. Training 3. ODFI s 7. Missing Procedures 4. ACH Risk Assessment 50

51 Common Issues & Best Practices New Same Day ACH New Environment is not implemented Same Day ACH fee not being tracked and reconciled to what is paid to the network Procedures: Have not been updated to reflect current environment ODFI Return Monitoring Are not being tracked Are being tracked but not reported to an oversight committee Are outside of compliance, and Originators are not being educated.

52 Common Issues & Best Practices ODFIs Evaluating and approving exposure limits Due diligence should be performed on all originators Reviewing exposure limits for originating customers Should be annual Monitoring daily/multiple day exposure limits Should implement controls and set limits Prefunding ACH credit batches Should require customers originating ACH transactions to prefund ACH credit batches putting the batch into a pending state until the funds are verified and approved. Contracts & Agreements Should include all required NACHA language

53 Common Issues & Best Practices ACH Risk Assessment Performing annual risk assessment Presenting to the Board for approval Return Reason Codes Stop payment vs. unauthorized/revoked transaction Ensuring proper documentation is obtained Properly handling unusual returns such as commercial credits/debits (CCD) 53

54 Common Issues & Best Practices Training A best practice recommendation Employees & ODFI Customers involved in the ACH process should receive training at least annually, or have information readily available. Common Issues: Training is not provided and rules changes go unaddressed Policies and Procedures Common missing procedures include: Retaining ACH records Monitoring originator activity Handling destroyed check entries ODFIs request for written statement

55 Additional Resources

56 Questions?