U.S. ACH: Nacha Rule Changes

1. Codify Use of Return Reason Code R17 (Rule #03 – Effective October 1, 2024)

Current:

• There currently is no defined Return Reason Code to return an entry as suspected fraudulent or “QUESTIONABLE”
  • Unauthorized reasons are based on a customer, dispute or claim
• The Rules provide for using the return code that most closely approximates the reason for the return
  • Nacha guidance has been that R17 is likely the closest return code for incidents of potential fraud
  • The word can continue to be used for high volume of invalid account number entries

Amendment as per Nacha:

• Clarifies that R17 “QUESTIONABLE” must be use by the RDFI to return an ACH entry that is suspected fraudulent
• This rule will explicitly allow, but not require, an RDFI to use R17 to return an entry that it thinks is fraudulent. Such use is optional and at the discretion of the RDFI
• The rule retains the current requirement to include the descriptor QUESTIONABLE in the return addenda record for such use
• The amendment is intended to improve the recovery of funds originated due to fraud

For more details, please refer to the Nacha website.

2. Expanded Use of ODFI Request for Return/R06 (Rule #04 – Effective October 1, 2024)

Change Brief:

• Expands the permissible uses of the Request for Return to allow an ODFI to request a return from the RDFI for any reason
• RDFI has 10 business days to respond to the ODFI after receipt

Amendment as per Nacha:

• This rule will expand the permissible uses of the Request for Return to allow an ODFI to request a return from the RDFI for any reason
  • The ODFI would still indemnify the RDFI for compliance with the request
  • Compliance by the RDFI would remain optional.
  • An RDFI’s only obligation to the ODFI would be to respond to the ODFI’s request
    • Regardless of whether the RDFI complies with the ODFI’s request to return the Entry, the RDFI must advise the ODFI of its decision or the status of the request within ten (10) banking days of receipt of the ODFI’s request
• This rule is intended to improve the recovery of funds when fraud has occurred.

For more details, please refer to the Nacha website.

3. Additional Funds Availability Exceptions (Rule #05 – Effective October 1, 2024)

Current:

• Currently, the Nacha Rules provide RDFIs with an exemption from funds availability requirements if the RDFI reasonably suspects the credit entry was unauthorized
  • This exemption encompasses cases of account takeovers, in which a party that is not the Originator is able to initiate an ACH credit from the Originator’s account

Amendment as per Nacha:

• Expands current RDFI exemption from funds availability requirements to include credits suspected are originated as part of a fraud scheme or event
• RDFI must make “reasonable efforts” to contact the ODFI to advise the delay

For more details, please refer to the Nacha website.

4. Timing of Written Statement of Unauthorized Debit (WSUD) (Rule #08 – Effective October 1, 2024)

Current:

• The current Rules require that the Written Statement of Unauthorized Debit (WSUD) be dated on or after the Settlement Date of the Entry

Amendment as per Nacha:

• This rule will allow a WSUD to be signed and dated by the Receiver on or after the date on which the Entry is presented to the Receiver (either by posting to the account or by notice of a pending transaction), even if the debit has not yet been posted to the account
• Allow a consumer Receiver’s Written Statement of Unauthorized Debit to be completed on the date an ACH debit is presented

For more details, please refer to the Nacha website.

5. RDFI Must Promptly Return Unauthorized Debit (Rule #09 – Effective October 1, 2024)

Current:

• Defines “promptly” that an RDFI return an unauthorized debit by the 6th banking after receipt and completion of the WSUD process
• The rule includes new language to set the return deadline to the opening of business of the 6th Banking Days after the RDFI completes its review of the Receiver’s signed WSUD (new language underlined):
  • “the RDFI Transmits the Extended Return Entry to its ACH Operator by its deposit deadline for the Extended Return Entry to be made available to the ODFI no later than the opening of business on the sixth Banking Day after the Banking Day on which the RDFI completes its review of the Receiver’s signed Written Statement of Unauthorized Debit, but in no case later than the opening of business on the Banking Day following the sixtieth calendar day following the Settlement Date of the original Entry.”

Amendment as per Nacha:

• This amendment will require that when returning a consumer debit as unauthorized in the extended return timeframe, the RDFI must do so by the opening of the sixth Banking Day following the completion of its review of the consumer’s signed WSUD
• The amendment is intended to improve the recovery of funds and reduce the incidence of future fraud
• The prompt return of an unauthorized debit alerts an ODFI and an Originator to a potential problem
• This is also true in first-party fraud schemes in which the party who disputes the debit Entry is the same party who benefits from the original entry
• A prompt return supports controls that an Originator may have enabled, such as a hold on funds or delayed shipment of merchandise
• This amendment will not change reasons or requirements for obtaining a Written Statement of Unauthorized Debit

For more details, please refer to the Nacha website.

1. Fraud Monitoring by Originators, TPSPs and ODFIs (Rule #01)

• Effective date - Phase 1: March 20, 2026 for all ODFIs and non-Consumer Originators, TPSPs, and TPSs with annual ACH origination volume of 6 million or greater in 2023.
• Effective date - Phase 2: June 19, 2026 for all non-Consumer Originators, TPSPs, and TPSs that did not fall under the requirement threshold for Phase 1. (2023 is the baseline year for the volume thresholds)

Current:

• The Nacha Rules currently require Originators to use a commercially reasonable fraudulent transaction detection system to screen WEB debits and when using Micro-Entries
  • These rules are intended to reduce the incidence of unauthorized debits resulting from transactions initiated online, which can experience increased volume and velocity
• These current requirements do not encompass any other transaction types, and so do not currently apply to other types of debits or to any credits other than Micro-Entries
  • However, the existing Nacha Board policy statement “urges that all participants implement adequate control systems to detect and prevent fraud.”

Amendment as per Nacha:

• “Each Non-Consumer Originator, ODFI, and Third-Party Service Provider or Third-Party Sender acting on behalf of an Originator, Third-Party Sender or ODFI, must:
  • Establish and implement risk-based processes and procedures relevant to the role it plays in the authorization or Transmission of Entries that are reasonably intended to identify Entries that are suspected of being unauthorized or authorized under False Pretenses; and
  • At least annually review such processes and procedures and make appropriate updates to address evolving risks.

For more details, please refer to the Nacha website.

2. RDFI ACH Credit Monitoring (Rule #02)

• Effective date - Phase 1: March 20, 2026 for RDFIs with annual ACH receipt volume of 10 million or greater in 2023
• Effective date - Phase 2: June 19, 2026 for all RDFIs that did not meet the threshold requirement for Phase 1. (2023 is the baseline year for the volume thresholds)

Current:

• Historically, the RDFI has played a passive role in the ACH Network
  • The ODFI warrants that an Entry is authorized and that it complies with the Rules
  • The RDFI may rely solely on the account number for posting an Entry, and the RDFI may rely on Standard Entry Class Codes for the purpose of complying with the Nacha Rules
• Currently, the Nacha Rules require ODFIs to perform debit transaction monitoring, but do not apply transaction monitoring requirements to RDFIs

Amendment as per Nacha:

• “Each RDFI must:
  • Establish and implement risk-based processes and procedures relevant to the role the RDFI plays in connection with the receipt of credit Entries that are reasonably intended to identify credit Entries that are suspected of being unauthorized or authorized under False Pretenses, including processes and procedures for responding when credit Entries are identified as potentially unauthorized or authorized under False Pretenses; and
  • At least annually review such processes and procedures and make appropriate updates to address evolving risks.
    
    These processes and procedures do not require the screening of every ACH Entry individually, and do not need be performed prior to the processing of Entries.”

For more details, please refer to the Nacha website.

3. Standard Company Entry Description – PAYROLL (Rule #06 – Effective March 20, 2026)

Change Brief:

• Establishes the entry descriptions for payroll related entries to enable better transaction monitoring and risk management
• This rule would establish a new standard description for PPD Credits for payment of wages, salaries and similar types of compensation. The Company Entry Description field must contain the description “PAYROLL”.
• RDFIs that monitor inbound ACH credits would have better information regarding new or multiple payroll payments to an account.

Amendment as per Nacha:

• Language has been added to disclaim any representation or warranty about actual employment status:
  • “The use of the term “PAYROLL” in this field is descriptive and by use of the word, neither the Originator, nor the ODFI (or any Third-Party Service Provider acting on behalf of an Originator or ODFI), makes any representation or warranty to the RDFI or the Receiver regarding the Receiver’s employment status.
• Language also has been added to disclaim obligation on the part of ODFIs to “police” Originators’ correct use:
  • “The ODFI has no obligation to verify the presence or accuracy of the word “PAYROLL” as a description of purpose or employment status.”

For more details, please refer to the Nacha website.

4. Standard Company Entry Description – PURCHASE (Rule #07 – Effective March 20, 2026)

Change Brief:

• Establishes the entry descriptions for ecommerce purchase related entries to enable better transaction monitoring and risk management
• "PURCHASE" for an e-commerce (WEB or PPD) goods purchase debit authorized by a consumer Receiver.

Amendment as per Nacha:

• Language for the definition of e-commerce purchases has been refined to (new language underlined):
  • “For this purpose, an e-commerce purchase is a debit Entry authorized by a consumer Receiver for the online purchase of goods, including recurring purchases first authorized online. An e-commerce purchase uses the WEB debit SEC Code, except as permitted by the rule on Standing Authorization to use the PPD or TEL debit SEC Code.”
• Language has also been added to disclaim obligation on the part of ODFIs to “police” Originators’ correct use
  • “The ODFI has no obligation to verify the presence or accuracy of the word “PURCHASE” as a description of purpose.”
  • “For this purpose, an e-commerce purchase is a debit Entry authorized by a consumer Receiver for the online purchase of goods, including recurring purchases first authorized online. An e-commerce purchase uses the WEB debit SEC Code, except as permitted by the rule on Standing Authorization to use the PPD or TEL debit SEC Code.”

For more details, please refer to the Nacha website.

Increase of Same Day ACH Transaction Limits — Effective March 18, 2022

• This rule expands the capabilities of Same Day ACH. Increasing the Same Day ACH dollar limit is expected to improve Same Day ACH use cases, and contribute to additional adoption.
  • Increases the Same Day ACH limit for both eligible debit and credit entries from $100,000 to $1 million USD.
• Increasing the dollar limit has been a frequently asked for change by ACH end-users. Most recently, a summer 2020 survey of corporate ACH end-users resulted in recommendations for Same Day ACH:
  • Increase or remove dollar limits
  • Expand processing hours and days

For more information on this rule, please refer to the formal press release on the Nacha website, here.

Supplementing Data Security Requirements – Phase 2 - Effective June 30, 2022

• The existing ACH Security Framework including its data protection requirements is supplemented to explicitly require large, non-FI Originators, Third-Party Service Providers (TPSPs) and Third-Party Senders (TPSs) to protect deposit account information by rendering it unreadable when it is stored electronically.
  • June 30, 2021 - Implementation began with the largest Originators an TPSPs (including TPSs) and initially applies to those with ACH volume of 6 million transactions or greater annually.
  • June 30, 2022 - A second phase becomes effective for those originators with ACH volume of 2 million transactions or greater annually
• The Rules are neutral as to the methods/technologies that may be used to render data unreadable while stored at rest electronically.
  • Encryption, truncation, tokenization, destruction, or having the financial institution store, host, or tokenize the account numbers, are among options for Originators and Third-Parties to consider

For more information on this rule, please refer to the formal press release on the Nacha website, here.

Use of Micro-Entries — Effective September 16, 2022

• This Rule will define and standardize practices and formatting of Micro-Entries, which are used by some ACH Originators as a method of account validation
• This Rule will become effective in two phases:
  • Phase 1 – September 16, 2022
    • The term Micro-Entry will be defined, and Originators will be required to use the standard Company Entry Description and follow other origination practices
  • Phase 2 - March 17, 2023
    • Originators of Micro-Entries will be required to use commercially reasonable fraud detection, including the monitoring of Micro-Entry forward and return volume

For more information on this rule, please refer to the formal press release on the Nacha website, here.

Third-Party Sender Roles and Responsibilities — Effective September 30, 2022

• The overarching purpose of these Rules is to further clarify the roles and responsibilities of Third-Party Senders (TPS) in the ACH Network by
  • Addressing the existing practice of Nested Third-Party Sender relationships, and
  • Making explicit and clarifying the requirement that a TPS conduct a Risk Assessment
• These two rules will become effective September 30^th, 2022, with a 6-month grace period for certain aspects of each rule (March 31, 2023) if any of the below are met:
  • ODFIs to update TPS registrations to denote whether or not a TPS has Nested TPSs
  • TPSs that have not conducted a Risk Assessment to do so
  • A TPS need not wait for passage of this rule, or its effective date, to conduct a Risk Assessment

For more information on this rule, please refer to the formal press release on the Nacha website, here.

New Third Same-Day ACH Processing Window — Effective March 19, 2021

• A third Same-Day ACH processing window is being created, expanding Same-Day ACH availability by 2 hours to provide greater access for all Originators and their customers.
• The timing of this new processing window is intended to balance the desire to expand access to Same-Day ACH through extended hours with the need to minimize impacts on financial institutions’ end of day operations and the re-opening of the next banking day.
• Specific cut-off times for J.P. Morgan U.S. Same Day ACH origination will be determined.
• eLockbox Same-Day report delivery will be extended by approximately two hours, to 8 p.m. ET instead of 6 p.m. ET.
• Non-consumer receivers subscribing to eLockbox will be required to post same day entries received by J.P. Morgan by 5:30 p.m. ET with same-day value during their normal posting schedule.

Supplementing Fraud Detection Standards for WEB Debits — Effective March 19, 2021

• As a supplement to existing requirements, Originators of WEB Debits will be required to use a commercially reasonable fraudulent transaction detection system to ensure new and changed customer receiving accounts are able to successfully receive transactions prior to origination of WEB Debits. 
• U.S. ACH Originators of WEB Debits may need to make changes to their account validation processes.
• J.P. Morgan offers tools and services to complete this validation, but you can use any commercially reasonable fraud detection system.
• Please reach out to your Relationship Management team if you have questions.

Differentiating Unauthorized Return Reasons – Phase 2— Effective April 1, 2021

• Re-purposed return reason code R11 will now be covered by the existing Unauthorized Entry Fee.
• Clients will be billed on their monthly statement of charges.

Supplementing Data Security Requirements – Phase 1 — Effective June 30, 2021

• The existing ACH Security Framework including its data protection requirements will be supplemented to explicitly require large, non-FI Originators, Third-Party Service Providers (TPSPs) and Third-Party Senders (TPSs) to protect account numbers collected for or used in ACH transactions by rendering them unreadable when they are stored electronically.
• Implementation begins with the largest Originators and TPSPs (including TPSs) and initially applies to those with ACH volume of 6 million transactions or greater annually.