NACHA Operating Rules: What Do They Mean to You? 2015 NACHA The Electronic Payments Association. All rights reserved. No part of this material may be used without the prior written permission of NACHA. This material is not intended to provide any warranties or legal advice and is intended for educational purposes only.
Agenda Who is NACHA and What is ACH? Originator Obligations for Authorization and Authentication Authorization Requirements by SEC Code Resources 2
NACHA as Industry Association As a not-for-profit association, NACHA represents more than 10,000 financial institutions some are Members directly, and some are represented via 16 Regional Payments Associations Direct Financial Institution Members Regional Payments Associations Through its industry councils and forums, NACHA brings together payments system stakeholders to foster dialogue and innovation to strengthen the ACH Network Affiliate Program Payments Innovation Alliance Risk Management Advisory Group Government Relations Advisory Group Communications & Marketing Advisory Group
NACHA as Network Administrator ACH Logical Network ACH rules set, and associated payment types and formats owned by NACHA Allows counterparties to logically and confidently pass transactions to each other, knowing how they will be recognized and dealt with NACHA holds the role of the Network Administrator Rules Creator Rules Enforcer Educator Supporter Protector ACH Physical Network The physical environment required to move transactions The technology and communications environment, and associated product set, needed to initiate, clear and settle ACH transactions between counterparties ACH Operators take the role of Processing and routing transactions Maintaining access to all sending and receiving endpoints Inter-operator exchanges Services to help financial institutions manage ACH volume and risk management Interbank settlement Network reporting to NACHA
What is ACH? AUTOMATED CLEARING HOUSE Batch-oriented, store-and-forward processing system Safe, secure, electronic network for consumer, business, and government payments Used by more than 11,000 participating FIs and millions of businesses and consumers
What is ACH?
ACH Credit Payment: Entry and Funds Flow Authorization
ACH Debit Payment: Entry and Funds Flow Authorization
Authorizations An Originator must obtain authorization from the Receiver to originate one or more Entries to the Receiver s account. 2015 NACHA Operating Rules, Article Two, Subsection 2.3.1 9
Authorizations Authorization occurs when Originator and the Receiver enter into an agreement to allow the Originator to initiate a debit entry to the Receiver s account An authorization to debit an account is only valid if the person who authorized the debit is an owner on the account Requirements specified in the Rules are MINIMUM requirements 10
Electronic Authorizations Similarly authenticated standard allows signed, written authorizations to be provided electronically Writing and signature requirements in the NACHA Operating Rules can be satisfied by compliance with the E-sign Act (Electronic Signatures and Global National Commerce Act) To satisfy Reg E and NACHA Rules, must evidence both the customer s identity and assent to authorization - should provide the same assurance as a signature in the physical world 11 Electronic authorizations must be visually displayed in a way that allows the consumer to read it
Corporate Authorizations Corporate Authorizations Business Receiver must authorize all credits and debits Originator / Receiver must enter into agreement with each business receiver of ACH Entries (other than ARC, BOC and POP Entries to non-consumer accounts) Agreement must bind the Receiver to the NACHA Rules 12
Consumer Debit Authorizations Authorization must: Be readily identifiable Have clear and readily understandable terms Provide for revocation (for recurring payments or payments scheduled in advance) Authorization should contain: Express authorization language Amount of transaction The date(s) and/or frequency of the transaction(s) The consumer s account number and financial institution s routing number Account Type Authorization of a debit entry must be in writing and signed or similarly authenticated, except where expressly provided in the Rules for specific types of Entries 13
Consumer Debit Authorizations Originators must: Provide the Receiver with electronic or hard copy of Receiver s authorization Retain the original or a copy for two years from termination or revocation of authorization At the request of the ODFI, provide original or copy to ODFI in such time and manner as to allow the ODFI to deliver it to the RDFI within 10 banking days of the RDFI s request for a copy of the authorization 14
Consumer Debit Authorizations Notice of Change of Amount Written notification of amount and date No notice required for change within agreed upon range Notice of Change to Scheduled Date Written notification of new date 10 CALENDAR DAYS prior to debit date 7 CALENDAR DAYS prior to debit date 15
Authorization Requirements by SEC Code PPD Prearranged Payment or Deposit Entry Written Authorization Credit or Debit Writing that is signed OR Receiver may similarly authenticate the written authorization previously delivered by Originator Example of similarly authenticated: Originator delivers written terms of authorization. Receiver authenticates agreement to terms of authorization by key entering into a VRU or speaking to a recorded line a PIN provided with the authorization that identifies the consumer debit credit Proof of authorization would be a copy of the written authorization and the consumer s use of the authorization code provided by the Originator. 16 PPD PPD
Authorization Requirements by SEC Code TEL Telephone Initiated Entry Electronic Authorization (Similarly Authenticated) Debit Only Oral Authorization only Single Entry or recurring consumer debits If no relationship exists, the consumer must initiate the phone call Record authorization and/or provide written notice before settlement TEL 17
Authorization Requirements by SEC Code TEL Telephone Initiated Entry Electronic Authorization (Similarly Authenticated), Debit Only Minimum Authorization Information Date on or after which debit will occur (single) or timing including start date number and/or frequency (recurring) Amount of the transaction(s) or method of determining amount Receiver s Name and account to be debited Telephone number for Receiver inquiries Revocation method Date of oral authorization Statement by Originator that authorization is for single entry ACH debit (single only) REMEMBER: Key entry on a VRU to input data and respond to questions does not qualify as oral authorization. Actual authorization must be oral. 18
Authorization Requirements by SEC Code WEB Internet/Mobile Initiated Entry Electronic Authorization (Similarly Authenticated) Single or Recurring consumer debit and credit entries Use when authorization was given via the internet or entry was initiated via wireless device Use for P2P Credit WEB only for payments exchanged between consumers Example of records of authorization Screen shot of authorization language and date/time stamp of the Receiver log-in and the authorization process that evidenced both the consumer s identity and assent to the authorization WEB 19
Authorization Requirements by SEC Code CIE Consumer Initiated Entry Electronic Authorization (Similarly Authenticated) Credit Only Consumer is Originator Used primarily for bill payment Credits only (except for reversal) Individual payments only CIE
Authorization Requirements by SEC Code RCK Re-Presented Check Entry Notice = Authorization, Debit Only Single entry debit initially presented as a paper check Consumer check must have been returned insufficient or uncollected funds and be less than $2,500 Limited to a combination of three presentments (paper and ACH) Notice must be provided RCK 21
Authorization Requirements by SEC Code CCD Corporate Credit or Debit Written Authorization (recommended), Credit or Debit Single or recurring payments Agreement between trading parties One addenda record Used for the distribution or consolidation of funds intracompany or between two corporate entities CCD
Authorization Requirements by SEC Code CTX Corporate Trade Exchange Entry Written Authorization (recommended) Credit or Debit Debit or credit transfer between trading partners, single or recurring Agreement between trading parties May contain up to 9,999 addenda records CTX
Authorization Requirements by SEC Code ARC Accounts Receivable Entry Authorization = Notice + Receipt of Source Document, Debit Only Regular lockbox check converted into an ACH transaction Must have been received through the mail or at a drop-box or in-person for bill payment When you provide a check as payment, you authorize us either to use information from your check to make a one-time electronic fund transfer from your account or to process the payment as a check transaction Must post/place in prominent and conspicuous location CHECK RECEIVED AT LOCKBOX ARC 24
Authorization Requirements by SEC Code BOC Back Office Conversion Entry Authorization = Notice + Receipt of Source Document, Debit Only Requires written notice to Receiver prior to receipt of each source document When you provide a check as payment, you authorize us either to use information from your check to make a one-time electronic fund transfer from your account or to process the payment as a check transaction. For inquiries, please call (retailer phone number). Must post in prominent and conspicuous location and provide copy of notice at the time of transaction 25 CHECK IS RECEIVED AT POINT OF SALE, BUT CONVERTED AT A LATER TIME BOC
Authorization Requirements by SEC Code BOC Back Office Conversion Entry Authorization = Notice + Receipt of Source Document, Debit Only Verification of Receiver s Identity 26 Must use commercially reasonable procedure to verify the Receiver s identity Examples include: Photo identification Retailer preferred card Check verification services
Authorization Requirements by SEC Code POP Point-of-Purchase Entry Authorization = Notice + Receipt of Source Document AND Written Authorization, Debit Only Merchant must provide notice and consumer signs authorization at point of purchase Check is scanned by merchant to capture account information, voided, and returned to the customer Must post in prominent and conspicuous location and provide copy of notice at the time of transaction POP 27
Resources NACHA Operating Rules Board Policy Statements Formal Rules Interpretations Summary of Revisions from previous year and any Supplements Operating Rules NACHA Operating Guidelines do not supersede the Rules but provide additional information
Resources 1. Online Rules access With full-featured search, bookmarking, save search, and a host of FAQs! www.achrulesonline.org 2. NACHA s Website Upcoming amendments Proposed changes estore News and education www.nacha.org
QUESTIONS? Danita Tyrrell, AAP Director, Network Rules NACHA-The Electronic Payments Association dtyrrell@nacha.org