ACH Management Policy Original Issue Date: December 16, 2003 Last Revision Date: February 27, 2018 Last Review Date: February 27, 2018 Next Review Date: February 2019 Page 1 of 5
ACH Management Policy Last Revision Date: 02-28-2017 Purpose MembersOwn Credit Union recognizes that participation in the Automated Clearing House (ACH) network provides our credit union with significant opportunities to meet the ongoing needs and demands of our membership. When compared to paper check processing, the ACH program offers the credit union countless advantages including but not limited to: enhanced efficiency, reduced processing costs, clearly defined settlement times, control over payment timing and member retention. However, like any other program, ACH comes with associated risks. Policy Statement The intent of this ACH policy is to establish the framework and expectations for MembersOwn Credit Union ACH staff to follow and adhere to in an effort to mitigate and manage risk surrounding the ACH Program. The Program shall include written policies and procedures, a system of internal controls, and a risk-based audit program. The credit union will serve as a Receiving Depository Financial Institution (RDFI)] and/or an Originating Depository Financial Institution (ODFI)] for electronic payments made through the ACH network. The credit union will utilizes Innovative Technologies to facilitate its ACH activities. Compliance It is the policy of this credit union to comply with all applicable consumer protection and federal regulations relating to ACH including but not limited to NACHA Operating Rules, Regulation E, Regulation GG, Regulation J, UCC Article 4A, OFAC, BSA and the Green Book for federal government ACH items. In addition, the credit union will adhere to the NACHA Code of Conduct in conducting all ACH activities. Definitions ACH - Automated Clearing House. ACH Credits An ACH transaction which an originator initiates to move funds to a Receiver s account. ACH Operator - The central clearing facility operated by Electronic Payments Network (EPN), a private organization, or the Federal Reserve Bank. IAT International ACH Transaction entries are credit and debit payment instructions exchanged across internal boundaries to move value to or from an Originator and a Receiver. ACH entries that are part of a payment transaction involving a financial agency s office not located within the U.S. territorial jurisdiction must use the IAT standard entry class and formats. MICR (Magnetic Ink Carriage Return Line) - Magnetically encode line on the bottom of a check. NACHA The Electronic Payments Association. NOC (Notification of Change) - Notification to a merchant from a member's financial institution indicating the bank account information provided with a specific transaction is incorrect. OFAC - Office of Foreign Asset Control. Originator The entity that arranges with an RDFI for ACH entries to be entered into the payment system. An originator may be a company or a consumer. Originating Depository Financial Institution (ODFI) - A participating financial institution that originates ACH entries at the request of and by agreement with its members. Page 2 of 5
PPD (Pre-arranged payment and deposit entry) - The alphabetic mnemonic used to identify credit or debit entries initiated by an originator pursuant to a standing or single-entry authorization from its member or employee. Receiving Depository Financial Institution (RDFI) - A financial institution that provides depository account services to members, employees, and businesses and accepts electronic debits and credits to and from those accounts. Any financial institution qualified to receive ACH entries that agrees to abide by the NACHA Operating Rules and Guidelines. Receiver - The person or corporate entity that has authorized a merchant to initiate a refund or charge transaction to their bank account. Receiving Point - A site where entries are received from an ACH Operator for processing. It may be the RDFI, its data center or a data processing service bureau authorized to receive entries on behalf of a RDFI. Corporate credit unions act as a receiving point on behalf of natural person credit unions. Sending Point - A processing site from which entries are transmitted to the ACH operator. If may be the ODFI on its own behalf or a financial institution or private data processing service bureau on behalf of the ODFI. Corporate credit unions act, in some instances, as sending points for natural person credit unions. Responsibility, Oversight and Training The Vice President of Operations is responsible for oversight of the credit union s ACH program and ensuring ACH staff are adequately trained and supervised in their ACH responsibilities. Written procedures outlining all ACH processes will be required and implemented. All employees performing ACH functions will receive training no less than annually. The credit union will ensure the training provided is current and accurate in accordance with the NACHA Rules as well as any other applicable laws and regulations. Based on the employees level of ACH responsibility, the credit union may also require NACHA certification for certain employees to ensure adequate knowledge and experience with ACH operational and compliance issues. Internal Controls The Vice President of Operations will oversee the ACH program and establish and implement adequate segregation of duties surrounding it. Segregation of duties is a critical component to an effective internal control system that aids the credit union in reducing the risk of errors and inappropriate actions. Procedures and system controls will be established that segregate those who can create ACH files from those who can approve. Also, no individual responsible for ACH transmissions can also receive files or update files. Finally, those individuals responsible for creating origination files for internal departments will not have the ability to originate entries to staff accounts. In the event an ACH staff member is terminated, resigns, or is transferred to another department, the Vice President of Operations will remove their access and permissions effectively immediately. ACH Authorization for Originators MembersOwn Credit Union natural person and business members may authorize ACH transactions using a signed written agreement. The written agreement will address: liabilities and warranties, responsibilities for processing arrangements, and other originator obligations such as security, International ACH Transactions (IAT) and audit requirements. The member will be required to submit Page 3 of 5
the ACH authorization form no less than [5] days before the settlement date. In addition, the member will be required to provide written advance notification in the event they want to cancel an ACH. Types of ACH Activities Debits for Payment on Credit Union Loans: The credit union originates a debit entry to a member s account at another financial institution, and applies the credit to a member s loan at the credit union. These entries would only be used in situations where the member chooses not to maintain a deposit account with the credit union from which the payment could be transferred internally. The member can avoid having to send a check via the mail, and the credit union would therefore not have to process checks received in the mail. In the event there are insufficient funds in the member s account, the return entry would be received in a day or two as an ACH entry rather than the longer 5-7 days usually experienced with NSF checks. Telephone authorizations are popular for single entry debits used for late payment or collection type payments. Credits for Deposit to Accounts at Other Financial Institutions: The credit union originates a credit entry for deposit to a member s account at another financial institution, and debits the member s account at the credit union. Members may also originate these transactions via ebranch. These entries would avoid the member from having to send a check or wire transfer the funds. Entries will be done on a scheduled recurring basis with a fixed amount, or could be done as requested for variable amounts. Typical uses for these entries are for periodic dividend payments on certificates, scheduled IRA distributions, and as replacements for recurring transfers now done by wire transfer or mailed checks. Same-Day ACH The Credit Union shall receive same-day ACH transactions (credit entries with an effective entry date and/or settlement date that is the same banking day as the date on which the entry is transmitted by the ODFI). A process to ensure that same-day ACH credit transactions in the amount of $25,000 or less (with the exception of IAT entries) will be available no later than 5:00 p.m. ET on the day the credit is received. ACH Transaction Limitations The credit union does not have a daily or monthly transaction limit. However, transactions through Home Banking are limited to $2,500 each day. ACH Notification of Change (NOC) and Returns Report As an ACH Originator, it is the credit union s responsibility to review all NOC and returns from the Receiving Depository Financial Institution (RDFI) and make the appropriate changes. To limit the credit union's liability, returns must be processed the day following settlement. Certain types of returns can be processed up to 60 days from receipt. General return time frames are as follows: NSF, account closed, unable to locate account, invalid account number, payment stopped, uncollected funds, beneficiary or account holder deceased, and account frozen must be returned no later than the day after settlement. Most items are returned the day of settlement because automated posting allows for the items to be processed quicker. Returns for unauthorized debit, authorization revoked, or customer advises not authorized may be processed up to 60 days from date of receipt. Additionally, an entry of a deceased account holder "deceased" may be returned up to 60 days from receipt. Normally, the credit union is notified a member is deceased, the account is coded "deceased," and any future entries automatically generate an exception for return processing. Page 4 of 5
There are numerous return reason codes. Each return reason code is meant for a specific type of transaction or incident and they are not interchangeable. The Vice President, Operations will develop and implement written procedures to ensure ACH staff applies the appropriate return reason code for returns. Information Security MembersOwn Credit Union has included ACH-related systems, processes and controls in its Information Security Program to ensure that protected information, defined as non-public personal information, will be protected from unauthorized use. This includes the use of systems to initiate, process, and store ACH entries to protect the confidentiality and integrity of member information. ACH security is a component of the credit unions overall risk management assessment. Audit NACHA rules require the credit union to obtain an internal or external audit of their ACH function from a qualified individual not involved in the ACH operation annually. The depth and breadth of the audit program will depend on the volume and complexity of the ACH operations. The audit will assess compliance with ACH rules and will be completed no later than December 31 of each year. The Supervisory Committee will be responsible to ensure the annual ACH audit is completed each year and that it is conducted by someone with sufficient expertise. The credit union will retain ACH audit documentation for a period of six years. In addition, the External Auditor will occasionally assess compliance with ACH rules, operating procedures, internal controls, and personnel procedures of the ACH department. The results and findings from ACH audits and reviews will be reported to the board of directors as well as the corrective action implemented to address the concerns. Record Retention All ACH data files including returns and adjustments, programs, and software will be backed up on a daily basis with a copy maintained at an off-site storage facility and retained for a period of six years. Page 5 of 5