There are Teeth to the Nacha Rules
Don’t Get Bit Due to Non-Compliance; it Hurts
BY: ANGI FARREN, AAP, APRP, UMACHA President & CEO
The teeth to Nacha rules are changing, and with a monetary bite. I’ve been working with the ACH network since the early 90’s. It bothered me when I would hear others in the industry say there were “no teeth to the Nacha Rules.” That was back when the ACH audit was required every three years, there was no such thing as an ACH exposure limit, and no substantial system of fines had been created. We have sure come a long way to make ACH safer for all to use! That said, I would like to take this opportunity to make sure all of our financial institution members have logged into Nacha’s Risk Management Portal and completed the Third-Party Sender Registration process. This Rule went into effect on September 29, 2017 and the implementation deadline was March 1, 2018. It requires Originating Depository Financial Institutions (ODFIs) to identify and register Third-Party Sender (TPS) customers or indicate you do not have any TPS. The spirit of this Rule is to identify all TPS in the network, promote appropriate “know your customer” due diligence among all ODFIs and create a tool that will assist Nacha in monitoring network quality and to have the ability to quickly respond to a risk event.
The teeth part of this new Rule comes into play when the participating Depository Financial Institution (DFI) fails to register their TPS status with the National Association. If Nacha believes that an ODFI has failed to register a TPS, or provide other required information, as required by Article Two, they may initiate a rules enforcement proceeding. Such proceeding will be according to the National System of Fines of Appendix Ten for a Class 2 Rules Violation. In situations involving a Class 2 Rules Violation, the ACH Rules Enforcement Panel may levy a fine against the respondent participating DFI in an amount up to $100,000 per month until the problem is resolved, ouch!
Will Nacha really start fining financial institutions for not registering TPS? The answer is yes. Nacha thinks that enough time has passed for reminders. Unlike other rule violations such as failure to respond to an NOC where you get an opportunity to rectify the situation to avoid a monetary fine, this Rule allows Nacha to move right to the assessment of the fine and it might bite you if you aren’t in compliance. Please call our office today if you need more information or help accessing the portal and we’d be happy to help you get registered right away to avoid getting bit.
What’s New with the Risk Management Portal?
In an effort to enhance network quality and security, Nacha has established a Risk Management Portal that provides secure access to several databases. Your participation in the portal reporting, both required and value added information, provides benefits for all financial institutions by helping to make the ACH network safer and easier to manage risk. The main database in the portal is specific to the Third-Party Sender Registration Rule that I mentioned previously. This Rule requires all ODFIs to either register TPS relationships or state that you do not have any. The Direct Access Status Registration Rule has been in effect for many years but with the new portal, financial institutions are required to re-register their status. This would be by either acknowledging that you have no Direct Access Debit Participants or providing specific information about each Direct Access Debit Participant. To help with due diligence for KYC (Know Your Customer), Nacha offers the Terminated
Originator Database or TOD through the portal. This complementary service can be used to add terminated originators or TPS, investigate new originators or TPS before onboarding, and to periodically verify your current originators or TPS to ensure they haven’t been terminated by another ODFI.
Nacha also provides a Financial Institution Contact Database to provide a vehicle for communications during operational and risk/fraud events. The ultimate goal would be to have all financial institutions who originate and/or receive ACH transactions be accounted for in this database. Today registration to the contact database is voluntary; however, just recently Nacha issued a Request for Comment (RFC) called ACH Contact Registration Rule. If passed, contacts collected through this registration will be an industry resource that can be used to connect with other financial institutions about ACH operations, exceptions and risk management.
The goal is to enable you to get to a person who knows or understands ACH processing when you need them the most, like during a fraud situation or operating crisis that can be time sensitive. Pending positive feedback on the Nacha RFC, the effective date to begin submitting mandatory contact information is July 1, 2020 and all participating DFI’s must complete registration no later than October 30, 2020.
We hope you have already registered your TPS status, that you become familiar with the resources available through Nacha’s secure Risk Management Portal, and refresh your DFI information periodically. We will share more information about the proposed ACH Contact Registration Rule as it proceeds through the rule making process. We look forward to seeing the Risk Management Portal evolve over time for the good of the ACH Network.
As with all aspects of the Nacha Rule making process, UMACHA does our best to inform you of what’s coming long before it goes into effect. We incorporate new Rules and requests for comments into our training events and educate while performing compliance services. We also send out email communications and post
information to our website to try and keep everyone informed of their obligations under the Nacha Rules to promote compliance in the network.
Please make sure you are receiving our electronic communications that typically come from our general email box email@example.com. We encourage you to add this email address to your safe/white list to ensure you are receiving the most up-to-date electronic payments information from us!