what the nacha rules really say - prodevmedia.com play 25¢ responsible sara bareilles security otis...

What the NACHA Rules

Really Say

WACHA Conference

March, 2015

Fred Laing – UMACHA

Wendy Wishon - EPCOR

1 PLAY

25¢

Responsible

Sara Bareilles

Security

Otis Redding

You Send Me

Sam Cooke

Changes

David Bowie

Waiting on the World to Change

John Mayer

Bandstand Boogie

Barry Manilow

Who Are You?

The Who

Security

Otis Redding

• Released April 1964 from Redding’s debut album Pain In My Heart by Atlantic Record’s subsidiary Atco Records

• Rock & Roll Hall of Fame 1989

• 1999 Lifetime Achievement Grammy Award

Security Framework for the

ACH (Eff. Sept, 2013)

The Ballot said, “Under this Rule, non-consumer

originators, participating DFIs, third party service

providers, and third party senders would be required

to establish, implement and, as appropriate, update

security policies, procedures, and systems related to

the initiation, processing, and storage of Entries. “

Sounds simple….right?

Doesn’t everyone have these now? What, exactly does this mean? And

more importantly, how can we/you be sure all the parties listed above are

in compliance?

The Rule goes on to say:

These policies, procedures and systems must: 1. Protect the confidentiality and integrity of Protected Information;

2. Protect against anticipated threats or hazards to the security

or integrity of Protected Information;

3. Protect against unauthorized use of Protected Information that

could result in substantial harm to a natural person.

Q. How can you protect against “anticipated threats or hazards”?

A. A Crystal ball!

Q. What is “substantial harm”?

A. $25.00 or $2,500?? – It depends on who you are.

Q. And finally, what is “Protected Information?”

A. Never has been legally defined.

Protected Information

Defined

“The non-public personal information,

including financial information of a natural

person used to create or contained within,

an Entry and any related Addenda Record.”

Q. What’s in an Entry?

A. Account number, routing number, name (maybe), ID number

Q. What’s in an Addenda Record?

A. Now “free-form” information – how do you manage that?!?

Q. Which “fields” are considered non-public personal Information?

Securing Transmission

Data Q. Wouldn’t this include securing information transmitted

over unsecured electronic networks?

A. Yes.

Q. What’s the Rules requirement to secure those transmissions?

A. Use of a commercially reasonable technology that provides a level of security that, at a minimum, is equivalent to 128-bit RC4 encryption technology.

Q. Do you do that?

Q. What does NIST say about 128-bit RC4?

A. It’s NOT included in the recommended encryption technologies. Wikipedia states it’s unsecure at every level of SSL/TLS.

Now Back to the BIG

Question….. How do you (as an ODFI) monitor for compliance

with your originators and Third Parties?

NACHA’s answer; “The Rules do not establish specific oversight

requirements for ODFIs attempting to monitor and enforce the

compliance with these provisions by their originators, Third Party

Senders and other Third Party Service Providers. Instead, as with

all other provisions of the Rules, there is a requirement that ODFIs

perform due diligence with respect to their originators and Third

Party Senders sufficient to form a reasonable belief that the

Originator or Third Party Sender has the capacity to perform its

obligations in conformance with the Rules (see Rule 2.2.2.)”

So what are you planning on doing??

? ? ?

1 PLAY

25¢

Responsible

Sara Bareilles

Security

Otis Redding

You Send Me

Sam Cooke

Changes

David Bowie


John Mayer

Bandstand Boogie

Barry Manilow

Who Are You?

The Who

Responsible

Sara Bareilles

• Careful Confessions album released January 2004 on the Tiny Bear label

• Nominated for 5 Grammys

Rules Violations & Financial

Liability

Q. What group at NACHA determines if a Rules violation has actually taken place?

A. The NACHA Rules Enforcement Panel

Q. What group at NACHA determines the severity of a Rules violation and assesses fines to promote compliance?


Q. What group at NACHA can expose your financial institution to essentially unlimited liability?



Liability

Q. Are there any minimum requirements to be a member of the Rules Enforcement Panel (AAP, law degree, arbitration experience, etc.)?

A. No.

Q. Based on what you’ve heard so far, what is the most powerful group at NACHA?


Q. If you don’t feel a fine is appropriate, what process

do you go through to have it reviewed?

A. There is NO process!

Q. What did you learn from this exercise?

A. To be very nice to the NACHA Rules Enforcement Panel


Liability

When an ODFI or RDFI is determined to be

guilty of a Rules violation, and that Rules

violation is also a breach of warranty, the

ODFI/RDFI is exposed to unlimited liability

under Sections 2.2.1, 2.2.2, 2.3, 2.4, 2.5, 2.8,

2.9, 2.10, 2.11, 2.12, 2.14, 2.15, and 2.17

(ODFI) or Section 3.1, 3.2, 3.3, 3.5, 3.6, 3.7,

3.9 and 3.13 (RDFI). “In the NACHA Operating Rules, an ODFI assumes responsibility for a number of

warranties and indemnifications made to other ACH Network participants. The warranty

language in the Rules is broad and does not limit itself to the timeframe for automated

returns. As a result, the ODFI’s potential liability under the Rules for a breach of warranty

is limited only by the statute of limitations for breach of contract claims under the

applicable state law. The ODFI’s liability for breach of warranty may exist for up to seven

years in some states.” -- NACHA Guidelines, Section II, Chapter 6

•And this as AFTER Rules Simplification


Liability ODFI Warranties (partial list)

• Authorization (including

revocation and termination

thereof)

• Compliance with the Rules and

the laws of the US

• Notification

• Timeliness

• Limits on re-initiation of returns

• Secure transmission of banking

info

• Verification of Identity of

Originators and/or 3rd Party

Senders

• Compliance with Reg. E

• Compliance with Reversal rules

RDFI Responsibilities (partial list))

• Warrants it must receive entries*

• Compliance with the Rules

• Verification of prenotifications

• Obligation to accept entries

• Receipt and availability of entries

• The right to return any entry

• Audit requirements are met

• Statement requirements

• Stop payments


Liability An RDFI accepted duplicated credits but rejected corresponding reversals, returning them as R20 – Non-Transaction Account. Duplicated credits were subsequently withdrawn by the Receivers and were unrecoverable. The ODFI filed a RPARV. RDFI was determined to be at fault. The ODFI obtained payment for a breach of the warranties contained in Section 3.8.

Total Amount Collected ≈ $20,000

A party impersonating an Originator sent a fraudulent credit to a Receiver

who was instructed to forward it to yet another party. The ODFI sent a

reversal that arrived after the funds had been disbursed. Because of OD

protection, the reversal posted and was not returned timely. A reversal to

correct a fraudulent transaction is not allowable under the NACHA Rules,

so the RDFI filed a RPARV. The ODFI was determined to be at fault.

The RDFI obtained payment for a breach of the warranties contained in

Section 2.4.


Liability

Q. If your financial institution suffers a loss, files an RPARV, and the other financial institution is fined, who covers the original loss?

A. Your financial institution does!

Q. Who can initiate a Rules Enforcement action?

A. Participant DFIs, and soon NACHA for something other than unauthorized returns above 1%

Q. How do you find out who has been fined, and how much they were fined?

A. This information is NOT shared!

1 PLAY

25¢

Responsible

Sara Bareilles

Security

Otis Redding

You Send Me

Sam Cooke

Changes

David Bowie


John Mayer

Bandstand Boogie

Barry Manilow

Who Are You?

The Who

You Send Me

Sam Cooke

• Released September 1957 on the Starlite label

• Hit #1 on the Billboard Pop and R&B charts

• Named one of the 500 Greatest Songs of all time by Rolling Stone magazine

Third-Party Funds Transfers

Q. Is a funds transfer from a consumer’s account to a biller (or to another individual) one transaction or two?

A. It depends, but most 3rd party payments involve two separate transactions – a debit against the sending party’s account with a credit to the recipient one or more days later.

Q. Why is that important? (Hint: 3 reasons)

A.

Q. Are you still a Sam Cooke fan?

(you send me where?)

•Authorization language

•Subsection 2.4.1.6 (Dr. entry satisfies an obligation)

•Reversals vs. “Recovery Entries”

Authorization

------------------

------------------


1. Consumer authorizes the funds transfer (“me to me” or “any to any”)

2. Consumer initiates funds transfer through 3rd party agent

3. Agent debits the funding account and holds the proceeds for 1- 3 days

4. Agent credits the beneficiary account if funding transaction is

successful Tw

o s

epara

te

transactions

Consumer’s

Bank

ACH

Network

TFTA


• Account ownership issue

– If the consumer is an authorized signer on both

accounts (i.e., the transactions will be “me to

me”/M2M), no problem.

– If the accounts belong to different consumers

(as in “any to any”/A2A), then one consumer

cannot authorize both sides of the transaction.

(Subsection 2.1.2: “The Receiver has authorized

the Originator to initiate the entry to the

Receiver’s account.”)

Authorizations


• Account ownership issue

– Wait! Subsection 2.1.2 also says “In the case of

credit entries to a Consumer Account, the

authorization may be provided orally or by other

non-written means.” Since I have the Receiver’s

account number, does that imply authorization?

But how can I “prove” it is authorized?

– What about debits? “… in the case of debit

entries to a Consumer Account, the authorization

must be in writing…” and “The authorization

must be readily identifiable as an

authorization…”

Authorizations


"...you authorize Company, including its employees, agents and service providers, to initiate electronic debits and credits to your Account and Bank Account in order to process Transfer Instructions that you request through the Service. You also authorize Company to initiate electronic debits or credits to your Account or Bank Account in order to correct any error in a previous Transfer Instruction or in the event that Company cannot complete a requested Transfer Instruction. This authorization shall remain in place until you cancel the Service and Company has had a reasonable time to act upon your cancellation request. In the event of an outstanding error or a transaction that has been returned (such as described below), you agree that we retain the right to initiate debits or credits, even after your cancellation request, for a reasonable amount of time until the error has been corrected. If, subsequent to our completion of a Transfer Instruction, the debit to the Account or Bank Account to fund the transfer is not processed or is returned by the financial institution holding the Account or Bank Account for any reason, you authorize us to debit any Account or Bank Account that you have added to the Service, regardless of whether the Account or Bank Account was part of the Transfer Instruction."

Authorizations


• This is the “no float” rule for ACH.

• If the consumer authorization describes one entry, the “two-step”

payment approach is probably in violation of this rule.

Section 2.4.1.6

"Each credit entry is timely, and each debit entry is for an

amount that will be due and owing to the Originator from

the Receiver on the Settlement Date; for a sum specified

by the Receiver to be paid to the Originator, or is to

correct a previous credit Entry that was an erroneous

entry."



Authorizations

Does this authorization describe one transaction or two?



Authorizations



Authorizations

“Correcting Entries” or “Recovery Entries”


• If a correcting entry was authorized by the consumer and the consumer is a signer on both accounts, the entry is a PPD debit.

• If the correcting entry was not authorized by the consumer, it has to be considered a Reversal, and non-settlement of the funding transaction is not a valid basis for reversal.

• If the correcting entry was authorized by the consumer but the consumer is not a signer on the account getting the debit, the transaction is unauthorized.

Reversals vs. Recovery Entries

1 PLAY

25¢

Responsible

Sara Bareilles

Security

Otis Redding

You Send Me

Sam Cooke

Changes

David Bowie


John Mayer

Bandstand Boogie

Barry Manilow

Who Are You?

The Who


John Mayer

• Released August 2006 on the Aware label

• Stayed on the Billboard Hot 100 for 41 weeks

• Grammy for Best Male Pop Vocal in 2006

Varying the Rules by Agreement

Q. Are you familiar with Section 1.2 of the Rules?

A. “Each participating DFI agrees to comply with these

rules and warrants that it is legally able to comply

with all applicable requirements of these rules.”

Q. Does this mean that FI’s always have to follow the

Rules?

A. No! The Rules can be modified on a situational

basis by agreement of the affected FI’s.

Q. Does your organization always follow the NACHA

Rules?


Scenario 1:

• “Big Bank,” acting as an RDFI, wants to return a $245

item as “R10 – Customer Advices Not Authorized”, but it

doesn’t have a WSUD, as required by the Rules.

Assuming the ODFI and RDFI agree to this, what’s the

problem?

“Big Bank” does have an unofficial agreement with the

ODFI that states if an entry is under $500, the ODFI will

accept it within the 60-day timeframe without requesting

a WSUD.

If neither files a Rules violation, what is the

risk? … Do two wrongs make it right?


Scenario 2:

Sample authorization Language:

• I authorize you and XYZ Third Party listed below to initiate

electronic credit entries, and if necessary, debit entries and

adjustments for any credit entries in error to my

(checking/savings) account each payday. I understand

that XYZ Third Party is providing electronic funds transfer

services to (my company) and (my company) guarantees

those funds. In the event that a payroll is NOT funded by

(my company) I agree to allow XYZ Third Party to

withdraw/reverse from my account the amount of funds

transferred in error.

Is this “allowed” by the Rules, or more importantly, do the Rules prohibit it?


• Do we need language in the Rules that

specifically states that only certain provisions of

the Rules may be varied by agreement?

See UCC 4A-501 – Variation By Agreement

And Effect of Funds-Transfer System Rule

• What about Pilot programs and Opt-in

programs?

• How should we deal with the “white space”

between the Rules?


Scenario 3:

• Bank A sends a request for a copy of a debit authorization

to the Chairman of Bank B. In the letter, Bank A provides

the name of the consumer and the amount of the

transaction in question, but not a trace number, account

number or date. Bank B fails to provide the copy of the

authorization within 10 banking days as required in Section

2.3.2.5, so Bank A demands that Bank B accept a return of

the item in question as unauthorized.

Is this a valid request for authorization?

The NACHA Rules do not prescribe the minimum requirements for a request for

authorization, nor do they indicate the address to which such requests must be

made. In theory, this is a valid request for a copy of the Receiver’s authorization.

Working in the White Space


Scenario 4:

• Bank A, the ODFI, asks Bank B, the RDFI, to return an

erroneous or fraudulent entry. Bank B asks for a letter of

indemnification and a cashier’s check in the amount of

$30.00. Payment of the $30.00 service charge does not

guarantee that the money will be returned. It is intended to

compensate Bank B for its research time.

• Same as above, but this time Bank B asks for a letter of

indemnification and asks Bank A to complete multiple forms

that are part of Bank B’s internal investigative process. Bank

B then says it will take at least 90 days to complete the

investigation after receipt of the requested paperwork.

Are these practices “allowed” by the Rules, or more importantly, do

the Rules prohibit them?

Working in the White Space

1 PLAY

25¢

Responsible

Sara Bareilles

Security

Otis Redding

You Send Me

Sam Cooke

Changes

David Bowie


John Mayer

Bandstand Boogie

Barry Manilow

Who Are You?

The Who

Changes

David Bowie

• Released in December 1971 on the RCA labeled album Hunky Dory

• Two Grammy Awards & 3 BRIT Awards

• Inducted into the Rock & Roll Hall of Fame in 1996

• Turned down knighthood in 2003

Changing the NACHA

Rules Q. Who gets to vote on a Rules change?

A. Direct Financial Institution Members and Regional

Payments Associations (aka Direct Members)

Q. What percentage is needed for a Rules change to be

approved:

a. >50% of the eligible votes

b. >50% of the votes cast

c. >66% of the votes cast

d. >75% of the membership

Q. Can any group besides NACHA’s Direct Members

amend the Rules?

A. Yes – The NACHA Board of Directors (Subsection 1.3.2)

Changing the NACHA

Rules

Q. How many rules changes are there in a “typical” year?

A. 5 – 12ish

Q. How many proposed amendments didn’t pass in the

past 10-15 years?

A. Two-Network Return Entry Fees (NREF’s) and Same-

Day ACH

Q. Recognizing that Rule changes are what keeps the

Network current, what changes will we see in the near

future?

A. ???

Changing the NACHA

Rules

You have a great idea!!

IF:

• You’re a company, third party, etc. – talk to your bank or C.U.

• You’re a financial institution or RPA – Submit an “Idea Submission Form”

to the NACHA Rules Department (they’ll get back to you)

• Ideas are reviewed by NACHA Rules & Ops Committee – if accepted,

R&O decides if the idea falls into the Compliance, Innovation, or

Operations Product Group

• Depending on what it is, a business case is prepared

• Product group crafts idea and proposal

• RFI and/or RFC, ballot, RULE

• This could anywhere from 6 months to…………………

So What if You Don’t Think

a Rule is Clear??

Section 1.3.3 – Official Interpretation

of the Rules The Board of Directors of the National Association may issue

written interpretations of these Rules that are consistent with

the express language of these Rules. Such written

interpretations apply and are binding as if they were set forth

in full in these Rules and were adopted in accordance with

Subsection 1.3.1 (Procedures for Amending the Rules).

So What if You Don’t Think

a Rule is Clear??

Q. Can anyone submit a request for interpretation?

A. Yes

Q. Is there a time frame within which NACHA must respond?

A. No

Q. Who approves a request for interpretation?

A. Staff reviews it and forwards it with a recommendation to

the Rules & Operations Committee. The R&O Committee

decides if it is a misinterpretation, requires a rule

amendment, or requires a formal rules interpretation. The

R&O Committee makes its recommendation to the Board

of Directors for its approval.

Q. How many official “interpretations” are there in the Rules?

A. Two

1 PLAY

25¢

Responsible

Sara Bareilles

Security

Otis Redding

You Send Me

Sam Cooke

Changes

David Bowie


John Mayer

Bandstand Boogie

Barry Manilow

Who Are You?

The Who

Who Are You?

The Who

• The album Who Are You released in August 1978 on the Plydor, MCA label

• Topped at Billboard’s #2, behind the soundtrack to Grease

• Grammy Lifetime Achievement Award 2001; Rock & Roll Hall of Fame Induction 1990

http://lynnrockets.files.wordpress.com/2010/02/who_are_you.jpg

Third-Party WHAT?

• There are two definitions when it comes to

Third-Parties in the Rules: – Third Party Sender: An organization that is not an Originator that

has authorized an ODFI or a Third Party Service Provider to

Transmit, for it’s account or the account of another Third Party

Sender, a credit Entry, debit Entry, or Non-Monetary Entry to the

Receiver’s account at the RDFI. An Organization acting as a Third

Party Sender also is a Third Party Service Provider.

– Third Party Service Provider: An Organization that performs any

functions on behalf of the Originator, the ODFI, or the RDFI (not

including the Originator, ODFI, or RDFI acting in such capacity for

such Entries) related to the processing of Entries, including the

creation of the Files or acting as a Sending Point or Receiving Point

on behalf of a participating DFI. An Organization acting as Third

Party Sender also is a Third Party Service Provider.

So what determines if someone is acting as a

Third-Party Provider, Sender, or BOTH?

Fiserv

Bankers Bank

Corp Credit Union

Agreements

TPSP/ODFI

Third-Party

Service Provider (ODFI Service)

Third-Party Service Provider/Processor

Agreement

Grocery Store

Production Company

Company/ODFI Agreements

Accounting Firm

Agreements

TPS/ODFI

There is NO AGREEMENT (Relationship) between the

Originator and the ODFI

Third-Party Sender Agreement

(Company/ODFI Agreement)

Health Club

Quilt Shop

Agreement between Originator & TPS –

similar to Company/ODFI

agreement (as outlined in Article 2)

Third-Party WHAT? Scenario 1:

Company A hires CPA firm X to do their payroll. They pay

twice a month and all transactions are appropriately

authorized (with the company listed as the party getting the

authorization). The financial institution that Company A uses

is the same one as the CPA firm uses and the institution has

an ACH contract with the company. The payroll is prefunded

4 days ahead of payday and the CPA firm holds those funds

which are applied on payday.

Q. What is Company A?

A. The Originator.

Q. What is the CPA firm?

A. Third-Party Service Provider

Same scenario, but the financial institution does NOT bank Company A and

has no contract with them…

Q. What is Company A?

A. The Originator.

Q. What is the CPA firm?

A. Third-Party Sender

Q. Why?

Third-Party WHAT?

Scenario 2: Mary contracts with Company Z to rent a

house in Hawaii. That house is owned by a

private party who Mary does not know. Mary

pays Company Z for the rent. Company Z

keeps their fee and remits the rest of the

funds to the owner of the home.

Q. What is Company Z?

A. Originator

Q. What is the owner of the home?

A. We don’t know

Third-Party WHAT?

52

Scenario 3: ABC Homeowners Association is quite small, so they contract

with LMN Property Management Company to collect the fees

from all their homeowners. The agreement signed by the

homeowners shows that the funds are going to LMN Property

Management. Of course they take their cut, hold the funds for

5 days to see if they get any returns, and then remit the rest of

the funds to ABC Homeowners Association. ABC and LMN do

NOT bank at the same financial institution.

Q. What is ABC Homeowners Association?

A. Originator

Q. What is LMN Property Management Company?

A. Third-Party Sender

Q. ARE YOU CONFUSED? So are we!

Other Questions

53

Q. Does the “name” (originator) on the

authorization matter?

A. E-Wallet Example: Originator is the E-Wallet

provider, but the merchant name goes on

the entry.

Q. Does the receiver “knowing” the originator

have a bearing on who’s what?

A. It’s based on who is “obligated” to pay

whom – NOT who knows who.

Q. Is an institution REQUIRED to have

contracts with all the players that might

impact an Entry?

A. Not always - Third-Party providers may NOT

have a contract with the ODFI.

Q. Who is who in joint ownership situations?

A. Great Question – Not an ACH Issue!

1 PLAY

25¢

Responsible

Sara Bareilles

Security

Otis Redding

You Send Me

Sam Cooke

Changes

David Bowie


John Mayer

Bandstand Boogie

Barry Manilow

Who Are You?

The Who

what the nacha rules really say - prodevmedia.com play 25¢ responsible sara bareilles security otis...

Documents