NACHA Tightens Risk Management, Restricts Payment Aggregation

NACHA, the rules-setting body for the automated clearing house network, this week announced membership approval of a rule amendment that will raise fines for unauthorized transactions and cut off ACH access for companies that enter too many such payments into the network. NACHA has also issued a rules clarification that restricts the practice of aggregating transactions that may occur over several days or across multiple merchants into bundles for processing. The new amendment regarding unauthorized transactions, originally released for comment in February (Digital Transactions News, March 26), was approved by a near-unanimous vote of NACHA members earlier this month, the Herndon, Va.-based organization says. The amendment imposes new reporting requirements on originating banks suspected of entering too many transactions not properly authorized by consumers or other payors. According to the new rules, unauthorized transactions become excessive when they rise past 1% of total items entered. The amendment also hands NACHA for the first time the ability to initiate an action against offending parties. Previously, the association could not take actions that might result in fines until it had received complaints from third parties. But the biggest impact of the new rules lies in the more powerful punch they pack for offending companies and originating banks. The maximum fine for banks that enter transactions into the ACH on behalf of client businesses balloons 50-fold, from $10,000 a month to $500,000 monthly. And in extreme cases, the rules provide that offending businesses can be banned from entering transactions through any bank. Elliott C. McEntee, chief executive of NACHA, says the higher fines are necessary to get the attention of some originating banks and companies. “We hope we never have to impose a penalty that high,” he tells Digital Transactions News, “but every once in a while we have a financial institution that is not cooperative and won't work with us. We've had situations where we've fined [banks] $10,000 a month and it's had no impact on them.” The new penalties take effect Dec. 21. The reporting requirements for originating financial institutions become effective three months later. The amendment, which is part of a comprehensive risk-management initiative at NACHA, doesn't result from any alarm over rising fraud in the network. McEntee says. “ACH fraud is relatively small compared to the card networks, or certainly compared to checks,” he says. Earlier this year, when NACHA released what was then a proposal for the amendment, a spokesman noted that while fraudulent transactions are declining as a proportion of overall volume, the absolute number of such items was rising along with total ACH traffic. Separately, NACHA issued a rules clarification this week aimed at the practice of bundling transactions stemming from a period of days or from multiple merchants. The clarification prohibits such aggregation for transactions where payees must receive settlement within 14 days. Electronic funds transfers linked to ACH-based debit cards used at the point of sale, for example, are not eligible for aggregation. The practice would be permitted in cases of deferred payment where settlement isn't necessary until more than 14 days after the transaction. McEntee says the concern with aggregation arises from the need to show consumers the name of each merchant where transactions took place. With bundled transactions, he says, the network is losing that information as originators instead enter only the name of the originating institution or another consolidator. “If you don't include that information, it makes it difficult for NACHA to carry out its risk-management capabilities,” he says. The clarification is partly aimed at NACHA's POS standard entry code, which covers direct debits at the point of sale, usually tied to a debit card. Supermarkets for years have issued proprietary cards that use the ACH for settlement, and over the past few years third-party processors such as Tempo Payments have introduced ACH-linked products. The POS code accounts for between 20 million and 25 million transactions annually, says McEntee, though he adds it's difficult to estimate how much of this volume is being aggregated as businesses look for transaction efficiencies. “We don't think there's very much of it [going on], but we do know there's a number of companies looking at using the ACH network for aggregation,” he says. “It's an issue a lot of payment networks are looking at. When do you permit it, when do you not permit it?”