01/21/2020

The Bite of Rule Violations

Rules Change. Stay Current and Compliant.

Written by:
Angi Farren, AAP, APRP, President and CEO of UMACHA
Don Jackson, AAP, CTP, President and CEO of Southern Financial Exchange

When I first entered the payments industry, some would say there were “no teeth to the Nacha Rules.” That may have been true 25 years ago, but it’s not any longer. Nacha is enforcing their Rules through a system of warnings and fines. If a violation is ignored or becomes an escalated issue, the offending organization can be fined up to $500,000 per month until the issue is resolved or may even face suspension of originating entries. Because the Nacha Rules change from year to year, new rules are sometimes overlooked. Every participant in ACH payments should follow these changes and remain committed to compliance.

Do you get paid by Direct Deposit? Do you pay your bills electronically via ACH? The ACH Network touches nearly all Americans, and the Nacha Operating Rules direct how it operates. The Rules ensure that everyone using the ACH Network—including consumers, businesses, credit unions, banks of all sizes, and government entities—have well-defined roles and responsibilities for every ACH payment. Non-compliance puts ACH participants in every category at risk.

Violations & Nacha Rules Enforcement

A Nacha Rules enforcement proceeding may be a response to an ACH rule violation filed against a participating financial institution by another financial institution, one of the two ACH Operators or by Nacha. Most rule violations are resolved without a fine as long as an accurate and timely correction is made. If the issue is not resolved, however, warnings may turn into the following penalties:

• Class 1 Rule Violation: Participants who do not resolve their rule violation within a one-year period or have a recurrence of the same violation could face a Class 1 Rule Violation with up to a $1,000 fine. The second recurrence may result in a fine up to $2,500. The third recurrence will result in a fine up to $5,000. If there is a fourth recurrence, the issue can be escalated to a Class 2 Violation.
• Class 2 Rule Violation: If an issue is considered serious enough to qualify as a Class 2 Violation, the ACH Rules Enforcement Panel (made up of industry representatives) may levy a fine in an amount up to $100,000 per month until the issue is resolved.
• Class 3 Rule Violation: If a Class 2 Rule Violation is unresolved for three consecutive months, the fine can be raised up to $500,000 per month until resolved.
• Suspension: In extreme circumstances, the ACH Rules Enforcement Panel may direct the Originating Depository Financial Institution (ODFI) to suspend the Originator or Third-Party Sender from originating additional Entries. A suspension can only be lifted by the ACH Rules Enforcement Panel or by an Appeals Panel comprised of at least three individuals selected by Nacha from the list of arbitrators.

By requiring participants to comply with the Nacha Operating Rules, Nacha maintains a high-quality, secure ACH Network. The National System of Fines provides the structure for evaluating possible rule violations. Through a formal system of warnings and fines, it corrects infractions and helps ACH Network participants to remain within the Rules' boundaries.

The most common rule violation is the failure to respond in a timely manner to Notifications of Change (NOCs). An example of a fairly recent Nacha Operating Rules change that is picking up attention is Third-Party Sender Registration. Effective in March 2018, Nacha requires ODFIs to register Third-Party Sender (TPS) status and re-attest its Direct Access Status. Failure to register at Nacha’s Risk Management Portal, even if the financial institution does not allow Direct Access or Third-Party Sender Origination, is classified as a Class 2 violation and Nacha has started issuing fines. If your financial institution has failed to register, it’s likely that a fine will result. The longer you wait, the larger the fine may be.

Our team has seen these penalties enforced and we encourage our members to stay current and compliant through:

• Attending training on a regular basis (especially What’s New in Payments)
• Weekly SFE newsletters & alerts
• Thorough audits performed by your trusted advisors at SFE

Since their inception in 1974, the Nacha Operating Rules have been a living document. The Rules are always open to change, and Nacha’s rulemaking process strives to be thorough, inclusive and responsive. Financial institutions and other organizations in the payments space are more apt to thrive, as well as avoid risks and non-compliance penalties, by keeping up with the rule and industry changes.

What’s New with the Risk Management Portal?

In an effort to enhance network quality and security, Nacha has established a Risk Management Portal that provides secure access to several databases. Currently only ODFIs are required to register in the Portal, but that is changing. The new Contact Registry will be available on July 1, 2020 and effective on October 30, 2020, all financial institutions will be required to have registered in the Contact Database. While a voluntary Contact Database has been available, only 1,389 financial institutions have registered as of the end of December 2019. The Contact Database will provide an improved method for communications during operational and risk/fraud events. The goal is to allow a financial institution to get to the right person quickly. Contacting an ACH professional when needed the most, like during a fraud situation or time sensitive operating crisis, can be critical.

All ODFIs should have already registered with a TPS and Direct Access status and be familiar with the resources available through Nacha’s secure Risk Management Portal. DFI information should be refreshed periodically (review at least once a year and make changes as needed). Participation in the portal reporting, both required and value-added information, provides benefits for all financial institutions by helping make the ACH Network safer and easier to manage risk.

As with all aspects of the Nacha rule making process, SFE does our best to inform you of what’s coming long before it goes into effect. We incorporate new Rules and requests for comments into our training events and educate while performing compliance services. Email is the primary source of communication with information also posted to our website. SFE will do what is possible to keep everyone informed of the obligations under the Nacha Rules to promote compliance in the network.

Please make sure you are receiving our electronic communications that typically come from tricia@sfe.org. We encourage you to add this email address to your safe/white list to ensure you are receiving the most up-to-date electronic payments information from us!