Stephen Kenneally Vice President Center for Regulatory Compliance Phone: 202-663-5147 E-mail: skenneal@aba.com October 24, 2014 Maribel Bondoc Manager, ACH Network Rules 13450 Sunrise Valley Drive Herndon, VA 20171 Re: Request for Comment and Request for Information, Compliance and Operational Topics Dear Ms. Bondoc: The American Bankers Association 1 (ABA) respectfully submits its comments to NACHA, The Electronic Payments Association, on the Request for Comment (RFC) and Request for Information (RFI) on Compliance and Operational Topics published on September 16, 2014. The RFI seeks input from the payments industry on five specific rule changes intended to improve the efficiency of the ACH Network. These proposed changes were identified by industry participants to increase the clarity of the rules or to lower operating costs. The RFI asks for feedback on possible methods to minimize the financial harm caused by corporate account takeover fraud that could be further refined in a future RFC. Proposed Rule Changes Recrediting Receiver-Removal of the Fifteen-Calendar-Day Notification Timeframe A long time ago, before the implementation of the Electronic Funds Transfer Act and Regulation E, NACHA rules required Receiving Depository Financial Institutions (RDFIs) to recredit a consumer Receiver for an unauthorized debit Entry promptly provided that the consumer notifies the RDFI within 15 days of the date that the RDFI sends or makes available information about the Entry to the Receiver. This portion of the NACHA rules would provide consumers less protection than available under Regulation E which requires a consumer be reimbursed for all unauthorized transactions when they are reported within 60 days of the periodic statement being made available to the consumer. In practice, Financial Institutions provide greater protections to consumers than required by the NACHA rules by complying with Regulation E. The proposed change to the NACHA rules would align the provision for prompt recredit with the RDFI s receipt of a Written Statement from the consumer and the RDFI s ability to transmit an extended return entry. The new rule would permit RDFIs to submit recredit return entries no later than 60 days following the settlement date of the original entry, the time period for which extended return entries are allowed. This change would provide more time for consumers to submit claims of unauthorized transactions and reduce confusion caused by the language referencing the unenforceable 15 day limit. 1 The American Bankers Association is the voice of the nation s $15 trillion banking industry, which is comprised of small, regional, and large banks that together employ more than 2 million people, safeguard $11 trillion in deposits and extend more than $8 trillion in loans. Learn more at www.aba.com.
ABA supports this proposed rule change. Financial Institutions must comply with Regulation E and that requirement provides more consumer protection than the 15 day limit in the current NACHA rules. Eliminating the reference to the 15 day limit makes the rules clearer for all participants. The proposed effective date of September 18, 2015 is acceptable. TEL Entries Field Inclusion Requirement/Data Content for Payment Type Code Field This amendment would do two things. First, it would make the Payment Type Code field of a TEL entry required instead of optional. Second, it would eliminate the option to space-fill this field for Single Entry TEL entries, standardizing data content for all SEC Codes containing this field. TEL entries are reserved for ACH transactions initiated via telephone and WEB transactions are reserved for transactions initiated via the Internet. Currently, the Payment Type Code field is used to identify single or recurring transactions. TEL Entries permit a choice of S or spaces to identify a single entry and R for recurring transactions. This differs from WEB Entries that only permit the values of S or R. The rule change would make TEL entries subject to the same restrictions as WEB entries and increase the standardization of data across the network. ABA supports this proposed rule change. Standardizing TEL and Web entries will make it easier for ACH participants to standardize programming without having to make exceptions for Payment Type Code field differences. There will be costs associated with making this programming change, but they will be exceeded by the future benefits of standardization. The March 18, 2016 effective date is acceptable. Clarification of RDFI Warranties for Notifications of Change This rule change would make changes in the treatment of Notifications of Change. Notifications of Change are sent from RDFIs to ODFIs when Entries are received with incorrect data. The first change would clarify that an RDFI s warranty for information contained in a NOC would apply only to that information and removes language that suggests that the Receiver has authorized the underlying Entry. The RDFI only warrantees that the data is correct, not that the Receiver has granted authorization. For example, if an ODFI initiated a Debit Entry to a Receiver s account that included a misspelling of the Receiver s first name, the RDFI may issue a NOC with that correction. If it later is determined that the Debit Entry was not unauthorized, this rule change clarifies that the NOC sent by the RDFI correcting the name in no way validates that the Entry was approved by the Receiver. Second, an ODFI originating an Entry using data received via a NOC, would not be required to warranty that the adjusted data is correct. For example, an ODFI originates an Entry to a Receiver and the ODFI sends a NOC that includes a corrected account number. If the ODFI relies on the NOC s updated information, the ODFI would not be required to warranty that the updated data is correct. 2
ABA supports both proposed rule changes related to NOCs. The changes clarify that NOCs don t need to be validated by Receivers and that ODFIs won t be held liable for using information received in a NOC. It is appropriate to make clear that initiating NOCs is voluntary and that there is no obligation to match account names and account numbers to validate transactions. The effective date of September 18, 2015 is acceptable. Valid Characters for ACH Records This amendment is intended to clarify the characters that can be used within ACH Entries. In particular, NACHA has been receiving requests to provide information regarding the validity of using ASCII characters. This rule change would clarify that ASCII values, including extended ASCII characters may be used in ACH Entries. ABA supports this proposed rule. ABA recommends that NACHA consider creating a table of acceptable and unacceptable characters that can be used within ACH Entries. ABA recognizes that it can be difficult to keep such a database up to date, but believes that being able to determine with certainty which characters are eligible or not would be worth it. The effective date of March 18, 2015 is acceptable. Disclosure Requirements for POS Entries This rule change addresses circumstances where retailers have issued cards to consumers that use them to initiate Point of Sale (POS) Entries at those retailer locations. Retailers offer these products with customer loyalty programs and also use them to reduce credit card interchange costs. Financial Institutions have informed NACHA that these card products have caused confusion among consumers regarding overdraft protection and card network liability programs. The proposed rule would require Originators or Third-Party Service Providers that issue these ACH cards to provide specific disclosures to consumers prior to card activation. The three required disclosures would be: The ACH card is not issued by the consumer s Depository Financial Institution. POS Entries made with the ACH card that exceed the balance in the consumer s financial institution account may result in overdrafts and associated fees, regardless of whether the consumer has opted to allow overdrafts with respect to debit cards issued by the Depository Financial Institution that holds the account. Benefits and protections made using the ACH card may vary from those available through debit cards issued by the consumer s Depository Financial Institution. This proposal would not require these disclosures for any cards issued prior to the effective date. ABA supports this rule change because of the large number of customer service calls that its member banks must respond to that originate with retailer issued POS cards. Any effort that may cut down on the number and expense related to these inquiries needs to be explored. ABA 3
requests that additional details be provided on how this requirement will be monitored and enforced and which parties in the ACH Network will be held responsible for ensuring compliance with the disclosures. The September 18, 2014 effective date is acceptable. RFI-ODFI Request for Return for Fraudulently-Originated ACH Credit Entries NACHA is considering expanding the ODFI s Request for Return capability to provide Originators and ODFIs the means to attempt to recover funds lost due to unauthorized credit Entries commonly occurring during corporate account takeover frauds. Under current NACHA rules, when an Originator claims that a credit Entry was unauthorized, that Entry does not fall into the category of erroneous error that can be corrected easily. Reversing these payments requires the Receiver s authorization because the NACHA rules definition of erroneous entry is based on UCC 4A language that doesn t include fraudulentlyoriginated entries. Corporate account takeovers occur when a business authentication is compromised allowing the fraudster to gain control of their online banking system and create fraudulent credit entries. The NACHA RFI asks for input as to the concept of expanding the Erroneous Entry definition to include corporate account takeover scenarios where credits are initiated without authorization. NACHA outlines a situation where the ODFI could submit a Request for Return but the RDFI would not be obligated to honor it. If the RDFI agrees to make the return it would be indemnified against the loss by the ODFI. ABA applauds NACHA for recognizing the need to mitigate ODFI risks associated with corporate account takeover. ABA encourages NACHA to consider changes to network rules that could further this effort. ABA is supportive of the idea that ODFIs should be able to use the ODFI Request for Return process to recover fraudulently initiated ACH credit Entries. ABA also supports exploring a proposal where the ODFI could submit a Request for Return, but that would not compel the RDFI to accept that request. ABA is also supportive of further discussion where the ODFI would indemnify the RDFI from liability associated with the Request for Return. This would encourage RDFIs to accept the returns and place a substantial, but appropriate, responsibility on the ODFI for initiating the Return. The indemnification by the ODFI should also mitigate any RDFI concerns about Returns being initiated due to buyer s remorse and it should negate the need to require the ODFI produce proof or documentation. ABA appreciates the opportunity to comment on NACHA s Request for Comment and Request for Information on Compliance and Operational topics. We look forward to reviewing a more detailed proposal related to corporate account takeover mitigation in the near future. If you have any questions about these comments, please contact the undersigned at (202) 663-5147. 4
Sincerely, Stephen K. Kenneally Vice President 5