March - Supplementing Fraud Detection Standards for WEB Debits
Effective on March 19, 2021, the rule change is intended to enhance quality and improve risk management within the ACH Network by supplementing the fraud detection standard for Internet-initiated (WEB) debits. ACH originators of WEB debit entries have always been required to use a “commercially reasonable fraudulent transaction detection system” to screen WEB debits for fraud. The existing screening requirement is supplemented by this change to make it explicit that “account validation” is part of a “commercially reasonable fraudulent detection system”. The supplement requirement would apply to the first use of an account number or changes to the existing account.
March – Expanding Same Day ACH to Later Deadline
The effective date of a new, third Same Day ACH processing window is March 19, 2021. RDFIs must make funds available for SDA credits in this new SDA processing window no later than the end of its processing day.
April-R11 Returns
Effective April 1, 2021, the existing Unauthorized Entry Fee will be applied to R11 Returns.
June-Limits on Warranty Claims
This rule limits the length of time in which an RDFI will be permitted to make a claim against the ODFI’s authorization warranty. The Rule is effective June 30, 2021.
For an entry to a consumer account, there are two time periods.
- The Rule will cover the first 95 calendar days from the Settlement Date of the first unauthorized entry
- If outside the first 95 days, then two years from Settlement Date of the entry
- This allows for “extenuating circumstances” in which the consumer is delayed in reporting an error
For an entry to a non-consumer account, the time limit will be one year from the Settlement Date of the entry.
June-Reversals and Enforcement
This rule has two focal points:
- Deter and prevent the improper use of Reversals
- Improve enforcement capabilities for egregious violations of the Rules
While the Enforcement Rule is effective January 2, 2021, the Reversals Rule is effective June 30, 2021.
Rule expands and identifies permissible reasons for a Reversal to include a “Wrong Date” error.
- Reverse a debit that was for a date earlier than intended by the Originator
- Reverse a credit that was for a later date than intended by the Originator
- Reversal information must be identical to the original entry for Company ID, SEC Code, and Amount fields
When is the origination of a
Reversal Improper?
- Cannot initiate reversal because an Originator or Third-Party Sender failed to provide funding for the original entry or file
- Cannot initiate reversal of entry or file beyond the time period permitted by the Rules
- Must be sent to the Operator within five Banking Days after Settlement Date of the Erroneous File
Rule permits the RDFI to return an Improper Reversal, using
- R11 for Consumer Accounts with 60 day return upon receiving a consumer claim
- R17 for Non-Consumer Accounts with a two-day return timeframe
For Enforcement of the Rule, an Egregious Violation is defined as:
- Willful or reckless action
- Involves at least 500 entries or multiple entries in the aggregate amount of at least $ 500,000
The ACH Rules Enforcement Panel determines if violation is egregious and to classify as a Class 2 or Class 3 Rules Violation. The sanction for a Class 3 violation can be up to $ 500,000 per occurrence and a directive to the ODFI to suspend the Originator or Third-Party Sender. NACHA to report Class 3 Rules violations to the ACH Operator and industry Regulators.
June – Supplementing Data Security Requirements for Large Originators, Third-Party Service Providers (TPSPs) and Third-Party Senders (TPSs)
The Supplementing Data Security Requirements originally scheduled for a June 2020 implementation has been moved to a June 2021 implementation.
Effective on June 30, 2021, this change to the Rules is intended to enhance quality and improve risk management within the ACH Network by supplementing the existing account information security requirements for large-volume Originators and Third Parties. Participants are required to protect deposit account information collected for or used in creating ACH transactions by rendering it unreadable when it is stored electronically.
This change will be implemented in two phases:
- The rule initially applies to ACH originators, TPSPs and TPSs with ACH volume of 6 million transactions or greater annually. An ACH originator, TPSP or TPS that originated 6 million or more ACH transactions in calendar year 2019 would need to be compliant by June 30, 2021.
- The second phase would apply to ACH originators, TPSPs and TPSs with ACH volume of 2 million transactions or greater annually in the 2020 calendar year and compliance is required by June 30, 2022.