What is Nacha?
The National Automated Clearing House Association (Nacha) is the industry organization that administers the electronic payments system connecting all U.S. bank accounts and facilitates the movement of money among those banks. As part of this role, Nacha sets fraud prevention and other guidelines within the Automated Clearing House (ACH) network.
In November 2018, Nacha approved a security rule changes to reduce fraud across the ACH network. Effective March 19,2021 the rule will become mandatory for Nacha compliance. Due to the impacts of COVID-19, enforcement of this rule will not begin until March 19, 2022 for organizations “that are working in good faith toward compliance, but that require additional time to implement solutions.”
This article explores what those changes entail and how to help your organization become (and remain) compliant.
What are the new Nacha rules governing ACH WEB payments?
Under the current Nacha rules for internet payments (or “WEB debits”), ACH Originators are required to use any “commercially reasonable fraudulent transaction detection system” when screening for potential fraud. Effective March 19, 2021, the new Nacha rules will require that “account validation” be a part of the fraud detection system for all ACH WEB payments sent across the network.
Approved in November 2018, the new ACH rules were originally scheduled to go into effect on Jan. 1, 2020. However, Nacha extended the deadline to March 2021 to help ensure financial institutions and ACH Originators had sufficient time to learn about and implement the required account validation changes. As mentioned above, enforcement has since been pushed out to 2022.
What is account validation, and what are the impacts of Nacha’s new rules?
In the past, Nacha has required that ACH Originators use any commercially reasonable fraudulent transaction detection system when screening ACH WEB payments for fraud. The new Nacha rules add “account validation” as a requirement. This validation process involves verifying that ACH accounts are open and ready to accept payments. Note that proof of account ownership is not part of the updated ACH verification rules.
- An important element is use of risk assessment mechanisms designed to confirm the validity of an account number and that it is not closed
- Verification of account ownership not required – just proof that the receiving account is able to accept incoming ACH WEB payments
- Originator is in best position to be able to detect and prevent fraud; you are the guard protecting the system
- New ACH operating rules apply to first use of an account number, regardless of a new or existing customer relationship
- Nacha WEB debit rules are not retroactive – meaning they do not apply to account numbers that have already been used for ACH WEB payments. However, these rules will apply to updated ACH account numbers moving forward
Nacha does not dictate the solution for complying with these new ACH rules; it is important for the Originator to make that decision
Impacts of Nacha’s operating rules include:
- Originating Depository Financial Institution (ODFI) must change if they are doing nothing now; a risk-based mechanism must be implemented
- Receiving Depository Financial Institution (RDFI) could have greater volume of ACH prenotifications, micro-transactions, or other account validation requests
- Actual volume for Receiving Depository Financial Institution should not greatly change
The new ACH rules are neutral with regards to specific methods or technologies used to validate account information but do require that the account number is validated. This means that the account number is valid and that the account can accept transactions. It is up to Originators to determine what is commercially reasonable based on the risk assessment of their customer, their services, as well as their internal business practices.
What to consider when complying with these new Nacha rules
It is notable that Nacha has not prescribed one required compliance solution. Indeed, Nacha acknowledges the variety of solutions that may be available and appropriate based on the Originator’s business. Existing customer relationships and customer characteristics as well as the Originator’s business practices should all be considered.
Although Nacha offers little guidance on compliance steps, there exist several established methods for validating ACH accounts, including:
- Prenotification entries – i.e., the process of sending zero dollar amounts across the ACH network for testing and verification purposes
- Micro-transactions – i.e., the process of sending one or two mini deposits to verify the receiving ACH account is active. Usually these deposits are less than a dollar
The two methods represent the fastest ways to verify individual accounts. However, if you lack the in-house resources to handle either, Nacha maintains a list of third-party validation service vendors that can guide you through the ACH verification process. In addition to prenotification entries and micro-transactions, these third-party vendors can aggregate and verify online bank credentials and other relevant information on your behalf. When evaluating potential account validation solutions, it is important to consider the following:
- Data coverage – i.e., how many account records are in the third-party vendor’s database, what is the process used to analyze these accounts, and how often are these records updated?
- Customer friction – i.e., what is required from the consumer, what is the transaction time, and how much does ACH bank account verification cost?
Have questions about ACH bank account verification?
For ACH Originators, the upcoming Nacha WEB debit rule change will undoubtedly introduce extra costs and headaches – especially with the deadline fast-approaching. As with all Nacha operating rules, these new guidelines should help prevent abuse across the ACH network. Given the short- and long-term impact of payment fraud, the benefits of this added protection far outweigh the additional costs involved. Equally important, non-compliance with Nacha’s operating rules exposes you to penalties and, in some cases, account termination.
Have questions about ACH payments? To learn more about our secure ACH payment processing solutions, schedule a free consultation with Fiserv today.
This information is provided for informational purposes only and should not be construed as legal, financial, or tax advice. Readers should contact their attorneys, financial advisors, or tax professionals to obtain advice with respect to any particular matter.
