What is the ACH Network? The Automated Clearing House (ACH) Network is the a network created for the electronic movement of money and other related data. This is a safe, secure, and reliable network for direct consumer, business, and government payments. As the migration from paper to electronic payment continues, the costeffective ACH Network grows and enables innovation that strengthens the industry with creative payment solutions. What is a Prenotification (Prenote)? Who are the ACH Participants? There are five key participants that contribute to the successful completion of an ACH transaction: The Receiver can be either an individual or a company that has authorized the Originator (your company) to credit or debit their account. Examples might be employees receiving a payroll deposit or customers receiving a withdrawal for payment of goods or services. The Originator is the entity that has been authorized by the Receiver to either credit or debit their account. If your company is sending the employee s payroll deposit or customer s payment, your company is the Originator. The Originating Depository Financial Institution (ODFI) is the financial institution with which your company has the contractual relationship for ACH Services. The ACH Operator is the central clearing facility for ACH transactions. The Receiving Depository Financial Institution (RDFI) is a financial institution with which the Receiver has an account relationship. Prenotifications (prenotes) are zero-dollar entries used by your company to verify that the account number on an entry is for a valid account at an RDFI. Prenotes are optional and can be sent with an ACH application. If your company chooses to send prenotes, you are required to do so at least 3 banking days before sending the first live dollar entry. Transaction s If there are any errors in a prenote entry or it cannot be processed, a Notification of Change (NOC) or return will be sent by the RDFI to notify your company of the necessary corrections to be made. ACH entries may be directed to a variety of account types. Both credit and debit entries may be transmitted to demand accounts (a.k.a. checking, NOW, and sharedraft), savings accounts and financial institution general ledger accounts. Credit entries only may be transmitted to loan accounts. Demand (Checking) Credits 21 Notification of Change or 22 Deposit 23 Prenotification 24 Zero dollar with remittance data Demand (Checking) Debits 26 Notification of Change or 27 Payment 28 Prenotification 29 Zero dollar with remittance data Savings Credits 31 Notification of Change or 32 Deposit 33 Prenotification 34 Zero dollar with remittance data Savings Debits 36 Notification of Change or 37 Payment 38 Prenotification 39 Zero dollar with remittance data Financial Institution General Ledger Credits 41 Notification of Change or 42 Deposit 43 Prenotification 44 Zero dollar with remittance data Financial Institution General Ledger Credits 46 Notification of Change or 47 Payment 48 Prenotification 49 Zero dollar with remittance data
What is a Notification of Change (NOC)? An NOC is a non-monetary entry transmitted by an RDFI to notify your ODFI that previously valid information contained in a posted entry has become outdated or is erroneous and should be changed. NOCs allow the RDFI to return information to the ODFI and Originator without returning the value of the entry. Many NOCs are the result of a merger or consolidation at the RDFI, which requires changes in Receiver account information. When the RDFI is able to recognize the intended account, NOCs provide a means for the RDFI to post the entry to the Receiver s account and to notify your company of necessary changes. Upon receipt of an NOC, your ODFI must report NOC information to you. You are required to make the changes noted in the NOC. Change s Used by RDFI C01 C02 C03 C04 C05 C06 C07 C09 C13 Description of Error Account Number The account number is incorrect or is formatted incorrectly. Routing Number A once valid routing number must be changed. Routing Number and Account Number The routing number and account number are incorrect. Account Name - The customer has changed the name on the account or the Originator has submitted the name incorrectly. Transaction An incorrect transaction code is causing the entry to be routed to the wrong type of account. Account Number and Transaction The account number is incorrect and the transaction is being routed to the wrong type of account. Routing Number, Account Number and Transaction The routing number, account number and account type are incorrect. Individual ID Number Individual ID Number is incorrect. Addenda Format Error The Entry Detail Record was correct, but the information in the Addenda Record was unclear or formatted incorrectly. Action Required by Originator Change the Receiver s account number record so the correct information is entered. Change the Receiver s financial institution routing number so the correct information is entered. Change the Receiver s financial institution routing number and account number so the correct information is entered. Change the Receiver s individual name or receiving company name so the correct information is entered. Change the type of account. The account type is indicated on the ODFI s report by a two-digit transaction code. Contact your ODFI if clarification is needed. Change the Receiver s financial institution routing number, account number, and type of account so the correct information is entered. Change the Receiver s financial institution routing number, account number, and type of account so the correct information is entered. Change the individual ID Number so the correct information is entered. Review the formatting in the Addenda Record that accompanied the original ACH entry to determine errors and make corrections using only ANSI standards or NACHA-endorsed banking conventions. What is a Dishonored? A dishonored return is an ACH return entry transmitted by your ODFI in response to a returned ACH entry that was mishandled by the RDFI. Dishonored returns may be either by initiated by your company or your ODFI. If your ODFI receives a misrouted return, they will initiate the dishonored return. However, if your ODFI receives and untimely return, the decision to dishonor the return may be made by your company. To dishonor a return, your ODFI, on you company s behalf must transmit a dishonored return within 5 banking days of the Settlement Date of the return entry. For additional information regarding Dishonored s, contact your ODFI. Upon receiving the dishonored return, the RDFI may contest the return entry by sending a Contested Entry. Your ODFI must accept the contested dishonored/corrected return entry transmitted by the RDFI that complies with the ACH Rules.
What is the ACH? An ACH return is an ACH entry that the RDFI is unable to post for reasons defined by the return codes listed in the table below. An RDFI may use the return process for valued ACH entries as well as prenotifications (zero-dollar entries). Most ACH returns must returned to the ODFI within 2 banking days following the Settlement Date of the original entry, with a few exceptions. The ODFI will send notification to you for ALL return entries with a code that describes the reason for the return. The codes are listed below with the appropriate action that should be taken for each ACH return. Reason for SEC Timeframe Action by Originator Insufficient Funds Available balance not sufficient to cover amount of debit entry. Account Closed Previously active account has been closed. No Account Account number structure is valid, but doesn t match individual or open account. Invalid Account - Account number structure not valid. Most commonly seen with checking tran codes on savings accounts and vise versa. R01 ALL 2 Banking R02 ALL 2 Banking R03 All 2 Banking R04 All 2 Banking Originator may initiate a new ACH entry; must be initiated within 180 days of original entry. May not be reinitiated more than two times after original entry. Contact customer to obtain authorization for another account. Customer should be contacted for correct account information. Stop initiation of entries until account number/structure is corrected. Unauthorized Debit to Consumer Account Using a SEC A debit entry that uses a corporate SEC code was transmitted to a consumer account but was not authorized by the consumer. R05 CCD, ODFI Request for ODFI requested that the entry be returned. R06 All Undefined Accept requested return. Rarely used. Authorization Revoked Customer who previously authorized an entry claims authorization has been revoked from the Originator Payment Stopped The customer has requested the stop payment of a specific ACH debit entry. Uncollected Funds Sufficient ledger balance exists, but value of uncollected items brings available balance below amount of debit entry. Customer Advises Not Authorized, Improper, Ineligible, or Part of an Incomplete Transaction Not authorized, wrong amount; debit date before authorized; incomplete transaction; or improper source document. Account Sold to Another DFI Account has been sold to another financial institution. R07 PPD, TEL, WEB R08 All 2 Banking R09 All 2 Banking R10 BOC, POP, PPD, TEL, WEB R12 All 2 Banking Stop initiation of entries until new customer authorization is obtained. Depending on the terms of the original authorization, the Originator may have recourse for collection outside the ACH Network. Contact the customer to identify the reason for the stop payment and obtain authorization before reinitiating the entry. Originator may initiate a new ACH entry; must be initiated within 180 days of original entry. May not be reinitiated more than two times after original entry. Contact customer to obtain correct routing number information for initiation of subsequent entries.
ACH s (cont.) Reason for SEC Timeframe Action by Originator Account Frozen/Entry ed per OFAC Instruction Access to the account is restricted due to action by RDFI or by legal action. Non-Transaction Account - RDFI policies or regulations restrict activity to account indicated. Credit Entry Refused by Receiver Customer refuses transaction because amount is inaccurate, results in overpayment, account is in litigation or Originator is not known to the Receiver. Duplicate Entry Entry is a duplication. The trace number, date, dollar amount, etc. match another entry. Customer Advises Not Authorized customer has notified that a specific entry is not authorized. Permissible Entry ODFI agrees on behalf of the Originator to accept the return after the deadline for an unauthorized corporate entry. Source Document Presented for Payment The source document to which an BOC, or POP entry relates has also been presented for payment. Stop Payment of Source Document - A Stop Payment has been placed on the source document to which the ARC or BOC entry relates. Improper Source Document/Source Document Presented for Payment The RDFI determines the source document used for the BOC or POP entry is not an eligible item or was presented for payment. State Law Affecting RCK Acceptance RDFI is located in state that requires all canceled checks to be returned to the Receiver. Item is Ineligible, Notice Not Provided, Signatures Not Genuine, Item Altered, or Amount of RCK Not Accurately Obtained from the Item Stop Payment on Item A Stop Payment has been placed on the item to which the RCK Entry relates. R16 ALL 2 Banking R20 ALL 2 Banking R23 All Credit Entries Dependent Upon Notification by Customer R24 All 2 Banking R29 R31 R37 R38 R39 CCD, CCD, BOC, POP BOC BOC, POP 2 Banking Undefined 2 Banking R50 RCK 2 Banking R51 RCK R52 RCK Terms of authorization may offer recourse outside the ACH Network. OFAC may have instructed the debit be returned. Obtain customer authorization prior to reinitiating the entry. If entry is a duplication, Originator should accept the return. If the entry has already been reversed, Originator should work with ODFI to determine a solution. Stop initiation of entries until subsequent authorization has been obtained. If a valid authorization exists, the Originator may have recourse outside the ACH Network. Accept requested return. If the Originator or ODFI has not given permission for the untimely return, the return may be dishonored by the ODFI. Rarely used. Accept return. The source document (i.e. check) may not be presented for payment if ACH debit is initiated. Contact customer to identify the reason for stop payment and obtain authorization from the customer before reinitiating the entry. Do not reinitiate the entry. Originator may attempt collection of item outside the ACH Network. Contact the customer to identify the reason for stop payment before reinitiating the entry.
What is the ACH Application? ACH applications are payment types used by Originators, such as your company, to identify ACH debit and/or credit entries transmitted to a corporate or consumer account at the RDFI. Each ACH application is identified and recognized by a specific Standard Entry Class (SEC) code. The SEC code also identifies the specific record layout that will be used to carry the payment and payment-related information. ACH APPLICATION Accounts Receivable Entries Back Office Conversion Credit or Debit Trade Exchange SEC CODE ARC BOC CCD APPLICATION USE Convert checks received via the US mail, drop box, or manned bill payment location and collect the funds via the ACH Network. Convert checks received at point-of-sale or a manned bill payment location to ACH transactions in the back office. Make regular payments or distribute or consolidate funds between corporate entities. Transfer funds within a trading partner relationship, including payment-related information. Point-of-Purchase POP Convert checks received at the point-of-sale or manned bill payment location to ACH transactions. DEBIT/ CREDIT Debit Debit Credit or Debit Credit or Debit Debit CONSUMER/ CORPORATE Consumer/ Consumer/ Consumer/ AUTHORIZATION REQUIREMENT Notification Notification Agreement Agreement Notification and Written Direct Deposit PPD Payroll, expense reimbursement, etc. Credit Consumer Oral or nonwritten means Direct Payment PPD Preauthorized bill payment Debit Consumer Written Re-presented Check Entries RCK Collect funds via the ACH Network for checks returned insufficient or uncollected funds. Debit Consumer Notification Telephone- Initiated Entries TEL ACH entry initiated pursuant to an oral authorization obtained via the telephone. Debit Consumer Verbal Internet-Initiated/ Mobile Entries WEB ACH entry initiated pursuant to an authorization obtained via the Internet or mobile device (except when a verbal authorization is used on the mobile device). Debit Consumer Similarly Authenticated
ACH RULES COMPLIANCE Security continues to be foremost in all of our minds as criminals become more sophisticated on how they obtain information. NACHA, the organization who governs the ACH Network, created the Security Framework rules in 2013. These rules are designed to ensure that protected information (non-public personal information that you used to create an entry or is included in an entry) remains secure from time that it is received until it is destroyed. This includes times when the information is not being used. These rules also require that you, as an Originator, have, enforce, and update security policies or procedures to keep this information safe. These rules also allow the Bank to audit you to verify that you have done the first part, and that you should be willing and able to prove that you have done so. Here are a few questions to address when creating or updating your policies and procedures. 1. What kind of protected information to obtain in order to process an ACH entry? Example: Name, SSN, Routing and Account Number, etc. 2. How is that information stored and who has access to it? Employees, Bank, Third-Parties 3. In the event of a break-in or property destruction, how secure is the information? 4. How easily could an unauthorized employee have access to protected information? 5. How is it transmitted? Does a third party (example: payroll or accounting firm) have access to it? 6. Is the information securely transmitted between you and the third party? Unencrypted Email is not considered a secure method. 7. If the transactions are uploaded to the Armstrong Bank Cash Management, what happens to the original file? Is it deleted or kept? Is it kept securely? 8. Once an ACH batch is initiated, is it deleted from Cash Management? If so, after what timeframe? The Bank recommends that you delete previously initiated batches. 9. What devices are used to access the protected information? Example: Desktop, Laptop, Mobile Device, Saved on CD or USB Drive, etc. 10. What devices are used to log into Online Banking/Cash Management? 11. How are these devices secured? Anti-virus, Anti-malware, Passwords, File Deletion software, Encryption software, etc. 12. What other internet activities are conducted on these devices? Gaming, shopping, email, social media, etc. 13. Are passwords shared? 14. What do you do if information becomes compromised? 15. When you destroy information, how do you destroy it? Bank Recommended Best Practices: 1. Use a strong password that is unique to each user and do not share the password with other employees. 2. Have passwords on your computers and change them regularly. 3. Have Anti-virus/Anti-malware software and have it regularly scan the computer. 4. Using business computers for business purposes only. 5. Make sure that access to protected information is restricted to only necessary personnel. 6. Educate employees to keep protected information safe and secure at all times including in phone calls, emails, and snail mails. 7. Educate staff to only click on links from known sources in email, social media, and internet surfing. 8. Have a Disaster Recovery Plan. FEMA has collected a number of resources to help you do so at http://www.fema.gov/smallbusiness-tools-resources. Additional Resources: s Originators and Third Parties Better Business Bureau Data Security - www.bbb.org NACHA NACHA joins Better Business Bureau (BBB) in Data Security- Made Simple National Education https://www.nacha.org/node/891 General Computer & Email Security Tips https://www.nacha.org/c/newresources.cfm/aid/1052 Understand & Reporting Phishing / Email Scams https://www.nacha.org/c/newresources.cfm/aid/1047 Federal Trade Commission Practical tips for business on creating and implementing a plan for safeguarding personal information http://business.ftc.gov/documents/art01-protecting-personal-information-five-steps-business Federal Communications Commission Ten Cybersecurity Strategies for Small Business http://www.uschamber.com/sites/default/files/issues/defense/files/10_cyber_strategies_for_small_biz.pdf