2020/2021 NACHA Rules Updates - Secura Risk Management · 2020. 1. 13. · Increased Same Day ACH $ Limit •Increased the per-transaction dollar limit for Same Day ACH transactions

2020/2021 NACHA Rules Updates

AGENDA

• 2020 and 2021 NETWORK RULES CHANGES

• FASTER PAYMENTS AND STRATEGY

• QUESTIONS

Same Day ACH

Review of Same Day ACH

• Same Day ACH only impacts transactions that move on the ACH payments rail.

• Applies to debits and credits.

• Includes three payment deadlines (one recently added).

• Can be up to $100,000/transaction.

• Does not include International ACH Transactions.

A New Same Day Deposit Window

• A new (THIRD) Same Day ACH processing window expands the Same Day ACH availability by 2 additional hours.

• The current deadline included two processing windows:

• 10:30 a.m. EST/9:30 a.m. CT/8:30 a.m.MT/7:30 a.m. PT

• 2:45 p.m. EST/1:45 p.m. CT/12:45 p.m. CT/11:45 a.m. PT

A New Same Day Deposit Window

The new window added another processing window for ACH Originators/Third-Party Senders.


• 2:45 p.m. EST/1:45 p.m. CT/12:45 p.m. MT/11:45 a.m. PT

• NEW: 4:45 p.m. EST/3:45 p.m. CT/2:45 p.m. MT/1:45 p.m. PT

Balances the need of the industry to offer additional deposit times while not having a negative impact on the

end-of-day processing.Was Effective September 18, 2020

New Effective date March 19, 2021

Increased Same Day ACH $ Limit

• Increased the per-transaction dollar limit for Same Day ACH transactions from $25,000 to $100,000.

• 98% of ACH transactions were covered under the $25,000 limit; however, there was a need to enable the end user access to Same Day ACH for higher limit transactions.

• B2B payments, in which only approximately 89% of transactions are currently eligible.

• Insurance payments, which are often for larger dollar amounts and are time sensitive in nature.

• Reversals for a larger pool of transactions, including all Same Day ACH transactions.

2% of ACH transactions were not covered under the $25,000 limit. The

new limit of $100,000 enables the end user access to Same Day ACH for

higher limit transactions

Effective Date March 20, 2020

A New Funds Availability Requirement

• Same Day ACH Credits – those credits that are transmitted using the Same Day ACH Schedule.

• Non-Same Day ACH Credits –those credits that are next day ACH credits (simply means these are all other credits transmitted through the ACH network).


Funds from Same Day ACH credits processed in the existing, first processing window is now made available by 1:30 p.m. in the RDFI's local time.


• Must Be Made Available by 1:30 p.m. ET/12:30 p.m. CT/11:30 a.m./10:30 a.m. PT

• 2:45 p.m. EST/1:45 p.m. CT/12:45 p.m. MT/11:45 a.m. PT

• Must Be Made Available by 5:00 p.m. ET/4:00 p.m. CT/3:00 p.m. MT/2:00 p.m. PT


NEW FUNDS AVAILABILITY SCHEDULE: 4:45 p.m. EST/3:45 p.m. CT/2:45 p.m. MT/1:45 p.m. PT

An RDFI is now required to make funds available for Same Day ACH credits in this new Same Day ACH processing window no later than the end of its processing day.

The New Funds Availability Schedule for Same Day ACH and Non-Same Day

ACH now applies to all credits to businesses and consumers and

simplifies the Rules.

Became Effective September 20, 2019

New Indemnification Agreement for Use by Financial Institutions

▪NACHA published a new form called “Indemnification Agreement –Request for Return of Funds from ACH Entry”.

▪ This form can be used by financial institutions to use when an ODFI requests the return of funds from an ACH transaction, and the RDFI desires to receive a written indemnification in addition to the indemnification contained in the Nacha Operating Rules.

2020 and 2021 NACHA

Rules Changes

Fraud Detection Standard for Internet-Initiated (WEB) Entries

Fraud Detection Standard for Internet-Initiated (WEB) Debits

ACH Originators of WEB debit entries are required to use a “commercially reasonable fraudulent transaction detection system” to screen WEB debits for fraud.

This new Rule would include “account validation” as an inherent part of a “commercially reasonable fraudulent transaction detection system”.

This Rule further requires the dollar amount of the WEB debit to reasonably relate to the purpose of the payment. Such risk-based “reasonableness testing” would screen for large overpayments or irregular payment amounts.

Clarifying Fraud Detection Standards for Internet-Initiated (WEB) Debits

Original Effective Date – January 1, 2020New Effective Date: March 19, 2021

Supplementing the Existing Account Information Security Requirements for Large Originators and Third Parties


• The ACH Security Framework has been in place since 2013 and was a response to industry concerns about data breaches and use of data

• The Rule expands the existing ACH Security Framework rules to require large, non-FI Originators, Third-Party Service Providers (TPSPs) and Third-Party Senders (TPSs) to protect deposit account information by rendering it unreadable when it is stored electronically.

• Originators and TPSPs covered by the rule would be required to attest compliance to their ODFI (or other counterparty with whom they have their agreement to originate or transmit ACH entries).


Implementation will begin with the largest ACH Originators and TPSPs (including Third Party Senders).

• The rule would initially apply to ACH Originators/TPSPs/TPSs with ACH volume of 6 million transactions or greater annually.

• A second phase would apply to ACH Originators/TPSPs/TPSs with ACH volume of 2 million transactions or greater annually.

Requirements for Existing Account Information Security Requirements for Large Originators

and Third Parties

Effective Date Phase 1 –June 30, 2020 for 2019 ACH Volume greater than 6 million.

Effective Date Phase 2 – June 30, 2021 for 2020 ACH Volume greater than 2 million.

R10 and R11: Separating Return Codes for Clarity

Repurposing the Return Reason Code R11

This Rule would repurpose the use of R11 for when

consumer claims there is an error but an

authorization is actually in place.

• This Rule would provide more specificity in the reason

for the Return and assist ACH Originators understand

the true reason for return.


Return Reason Code R10 will be defined as “Customer Advises Originator is Not Known to Receiver and/or Originator is Not Authorized by Receiver to Debit Receiver’s Account” and used for:

• Receiver does not know the identity of the Originator

• Receiver has no relationship with the Originator

• Receiver has not authorized the Originator to debit the account

• For ARC and BOC entries, the signature on the source document is not authentic or authorized

• For POP entries, the signature on the written authorization is not authentic or authorized

Repurposing the Return Reason Code R11Return Reason Code R11 will be defined as “Customer Advises Entry Not in Accordance with the Terms of the Authorization.” It will be used by the RDFI to return an entry for which the Originator and Receiver have a relationship, and an authorization to debit exists, but there is an error or defect in the payment such that the entry does not conform to the terms of the authorization. This includes:

• The debit Entry is for an incorrect amount

• The debit Entry was debited earlier than authorized

• The debit Entry is part of an Incomplete Transaction

• The debit Entry was improperly reinitiated

• For ARC, BOC, or POP entries:• The source document was ineligible

• Notice was not provided to the Receiver

• The amount of the entry was not accurately obtained from the source document

Repurposing the Return Reason Code R11R11 returns will have many of the same requirements and characteristics as an R10 return, and be considered unauthorized under the Rules

• Incorrect EFTs are subject to the same error resolution procedures under Regulation E as unauthorized EFTs

• RDFIs’ effort to handle the customer claim and obtain a WSUD remain the same as with the current obligations for R10 returns

• The RDFI will be required to obtain the Receiver’s Written Statement of Unauthorized Debit

• The return timeframe is 60 days

• R11 returns will be included within the definition of Unauthorized Entry Return Rate

• R11 returns will be covered by the existing Unauthorized Entry Fee

• The new definition and use of R11 does not include disputes about goods and services, just as with the current definition and use of R10


• A key difference between R10 and R11 would be that with an R11 return an Originator would be permitted to correct the underlying error, if possible, and submit a new Entry without being required to obtain a new authorization.

• The new Entry must be Originated within 60 days of the Settlement Date of the R11 Return Entry.

• Any new Entry for which the underlying error is corrected is subject to the same ODFI warranties and indemnification made in Section 2.4 (i.e., the ODFI warrants that the corrected new Entry is authorized)

Written Statement of Unauthorized Debit (WSOUD)

• Relocates introductory language in the NACHA Rules Book regarding an RDFI’s obligation to accept a WSUD from a Receiver.

• Subsection 3.12.1 Unauthorized Debit Entry/Authorization for Debit Has Been Revoked

• Includes invalid/inauthentic signatures for check conversion entries within description of an unauthorized debit;

• Removes references to amount different than or settlement earlier than authorized

• Includes "authorization revoked" (Note: continues to use return reason code R07).

Debit Entries Not in Accordance with the Terms of the Authorization

Subsection 3.12.2 Debit Entry Not in Accordance with the Terms of the Authorization

• Describes instances in which authorization terms are not met.

• Incorporates most existing language regarding improper ARC/BOC/POP entries; incomplete transactions; and improperly reinitiated debits.

• Incorporates language related to amounts different than or initiated for settlement earlier than authorized

Benefits of Separating R10 and R11

• Provides more specific reasons for the purpose of the return.

• ODFIs and Originators would have clearer information in instances in which a customer alleges “error” as opposed to “no authorization”

• Corrective action is easier to take in instances in which the underlying problem is an error (e.g., wrong date, wrong amount)

• More significant action can be avoided when the underlying problem is an error (e.g., obtaining a new authorization, or closing an account)

• Allows collection of better industry data on types of unauthorized return activity

Impacts of Rule Change

• ACH Operator and financial institution changes to re-purpose an existing R-code, including modifications to return reporting and tracking capabilities.

• RDFI education on proper use of return reason codes.

• Education, monitoring and remediation by Originators/ODFIs.

• Change in a 2-day return timeframe for R11 to a 60-day return timeframe; this could include system changes.

• Inclusion of an additional return code within existing rules on ODFI Return Reporting and Unauthorized Entry Fees.

Unauthorized Entry Fee Remains the Same

The amount of the Unauthorized Entry Fee will remain at $4.50 per covered return during the next 3-year period, through

September 30, 2022.

Rule Change in Two Phases

Phase 1: Effective Date – April 1, 2020Financial institutions will begin using R10 and R11

Phase 2: Effective Date – April 1, 2021Re-purposed return code would become covered by

the existing Unauthorized Entry Fee

Progress through Connecting Participants:Nacha’s ACH Contact Registry

• Currently, all ODFIs are required to register with Nacha both their DirectAccess status, and their Third-Party Sender status.

• ODFIs are required to add an additional registration category to providetheir contact information for ACH operations and risk/fraud, andmaintain updated contact information.

• ODFIs need to implement procedures to maintain updated contactinformation.

ODFI Required Registration

▪Currently, financial institutions that are only RDFIs are not required to register information with Nacha.

▪RDFI’s may enroll on a voluntary basis through the Risk Management Portal for the optional Financial Institution Contact Database and the Terminated Originator Database.

RDFI Only Participants – Optional Registration

• Participants in the ACH Network will be required to register contact information with

Nacha for personnel or departments responsible for ACH operations and fraud/risk

management.

• The contact information will be available for other registered ACH participating

financial institutions, Payments Associations, the ACH Operators, and Nacha for

operational, fraud, and risk management issues in the ACH Network (e.g., proof of

authorizations, ACH-related system outages, erroneous payments, duplicates,

reversals, fraudulent payments, etc.).

• Contact information will be only for those parties own, internal use and limited to

these purposes.

Registration

• Beginning July 1, 2020 All financial institutions participating in the ACH Network will be required to register contact information with Nacha for individuals and areas responsible for ACH operations and fraud/risk management.

• All financial institutions are required to register their contact information through Nacha’s Risk Management Portal no later than October 30, 2020.

Registration

•Participants will register through Nacha’s Risk Management Portal.

• The registry contacts will be made available to registered financial institutions, ACH Operators, and Payment Associations to use in addressing and resolving ACH operations and risk management situations.

Registration

Registration Begins July 1, 2020

Financial Institutions must register by

October 30, 2020

GRACE PERIOD FOR AVOIDING RULES VIOLATION

There will be a 9-month grace period to August 21,

2021 will be provided to ensure communication of

this Rule has been completed and before a Rules

Violation is possible.

Faster Payments and Operational Strategy

Faster Payments Risks

• Operational Risks – peoples/processes/systems

• Security/Customer Privacy Risks – authentication/information

• Liquidity Risks – funding/credit/fraud/payments speed

• Third Party Risks –dependency of third-party providers

Operational Risk

The overlay of the new with the old systems

• Support of different systems (real-time payments on an

existing batch process)

• Support of different methods for authentication, approval,

etc. (manual vs. automated)

• 24/7 support

• Staffing of different expertise to handle respondent banks’

needs based on their strategic priorities

Security/Customer Privacy Risks

Information and account protection are critical in todays environment and

adds a level of protection for faster payments environment.

• Cyber Risk – the inability to protect information that causes

reputational and/or monetary damage and the ability to

prevent/mitigate in a faster payments environment.

• Information Security Risk – the inability to protect information in

todays environment and in a faster payments environment.

Organizational structure and compliance culture is critical to that success

Liquidity Risks

• Banks face additional liquidity risk in a faster payments

environment.

✓ More deposit windows

✓ Untrained staff

✓ Broken processes with an overlay of the new process

✓ Absence of settlement risk strategy

✓ Unknown fraud (faster payments/faster fraud)

✓ Absence of appropriate forecasting of the right funding

model

✓ Absence of faster payments incident response

plan/business continuity plan/contingency plan

A Great Resource

as financial

institutions

strategically plan

for faster

payments.

Documents

2020/2021 NACHA Rules Updates - Secura Risk Management · 2020. 1. 13. · Increased Same Day ACH $ Limit •Increased the per-transaction dollar limit for Same Day ACH transactions