From Nacha.org

There’s an entire winter, spring and summer before Sept. 30, 2022, arrives, bringing with it the implementation of a new Nacha Operating Rule. While it may seem like a long way off, it would be better for ODFIs and Third-Party Senders to start considering whether the rule will impact your organization.

The Third-Party Sender Roles and Responsibilities Rule applies to Third-Party Senders (TPSs) and the ODFIs which originate for them. 

It’s a two-part Rule. The first concerns Nested TPSs and includes updates to both requirements for new Origination Agreements and existing TPS registrations in the Risk Management Portal, which we’ll cover in a future blog; the second relates to TPSs and Risk Assessments, which is the focus of this article.

“In many respects this Rule is clarifying existing Nacha Rules by making clear that a Risk Assessment is required for all Third-Party Senders,” said Jordan Bennett, AAP, Nacha Senior Director, Network Risk Management. 

“The Rule also spells out that a TPS cannot rely on another TPS in the chain for coverage under their Risk Assessment or Rules Compliance Audit. That is going to impact any TPS that has been relying on another TPS or payments processor for such assessments,” said Bennett. 

“Each participant in the ACH Network is responsible for its own Risk Assessment to identify the risks that apply to their organization, determine their organization’s risk tolerances, and implement appropriate controls to manage risk at an acceptable level,” said Bennett. He noted the Risk Assessment is in addition to the annual Nacha Rules Compliance Audit, which existing Nacha Rules require.

Both Bennett and Debbie Barr, AAP, CTP, Nacha Senior Director, ACH Network Rules Process & Communications, stressed that the new Rule ultimately has a single goal: keeping the ACH Network the safe and secure payment system that millions depend on. 

For those impacted by the new Rule, Barr said it boils down to this: “Understand your roles and responsibilities—and your risks—as part of the ACH Network.”

The time to be thinking about that is now.