NAFCU Compliance Blog

Upcoming ACH Rules And Resources

Written By Stephanie Lyon, Regulatory Compliance Counsel

NACHA has been fairly busy these past few years finalizing and updating rules, issuing bulletins and seeking industry comments for new rules to make ACH transactions faster. A couple of ACH rule deadlines are looming, so it is a good time to review these rules, highlight resources and give you a heads up on things you may have missed from last year.

Same Day ACH Phase 3

Most credit unions that originate ACHs are well aware of the Same Day ACH rule that was passed a couple of years ago to expedite the sending and receiving of ACHs. As of today, the deadlines for Phase 1 and Phase 2 are long gone, paving the way for the effective date of March 16, 2018 for Same Day ACH Phase 3. Folks, this is only 58 days away!

Here is a table that details the different requirements of each implementation phase, highlighting Phase 3 requirements:

As noted on the table, the current NACHA requirement under Phase 2 is that credit unions give credit for same day ACHs by the end of the credit union's processing day. You can review Phase II requirements in more detail in this previous blog. Phase 3 establishes a more streamline funds availability timeline that requires Receiving Depositary Financial Institutions (RDFIs) to make same day ACHs credits available for withdrawal by 5:00pm RDFI's local time. While becoming an ACH originator is still optional, credits unions that receive ACHs are all bound by this requirement.

To make the process of complying with Phase 3 easier, NACHA published several resources available in its Resource Center, including its revised Guidance for RDFIs on Meeting Phase 3 Requirements. The guidance is especially helpful in determining the credit union's local time in cases where the RDFI's geographic footprint is not limited to one time zone.

Third-Party Sender Customer Due Diligence

Another ACH compliance deadline that is also around the corner is the registration of Third-Party Sender members by March 1^st, 2018. This requirement became effective in September 2017 to promote consistent customer due diligence among all Originating Financial Institutions (ODFIs). The rule generally requires that all ODFIs register their Third-Party Sender members or, in the alternative, confirm that the ODFI does not have any Third-Party Sender members. See, revised NACHA Op. Rules, Art. II, 2.15.1.

NACHA rules define a Third-Party Sender as "an organization that is not an Originator that authorized an ODFI or a Third-Party Service Provider to transmit, for its account or the account of another Third-Party Sender a credit entry, debit entry, or non-monetary entry to the Receiver’s account at the RDFI." As part of the rule, NACHA expects that credit unions will have effective procedures to determine if a corporate/business member is a Third-Party Sender. If the credit union is unsure whether a member is considered a Third-Party Sender, it may want to use NACHA's Third-Party Sender Identification Tool for assistance with this determination and/or contact their counsel.

The registration process for Third-Party Sender members can be found here. Some of the information required to be disclosed will be:

• The ODFI’s name and contact information;
• the name and principal business location of the Third-Party Sender;
• the ODFI’s routing number used in ACH transactions originated for the Third-Party Sender member; and
• the company identification(s) of the Third-Party Sender. 

Note that if for some reason the credit union later discovers an unregistered Third-Party Sender member, the credit union will have 10 days from the date it discovers the member to register them in the database.

Aside from the initial registration, the NACHA rules will also require supplemental registration for Third-Party Sender members if the credit union receives a request from NACHA for additional information. See, revised NACHA Op. Rules, App. 8, Pt. 8.4. The rule only gives the credit union 10 banking days to respond to supplemental information request so the credit union may want to obtain this information for all Third-Party Sender members ahead of time to avoid having to chase down this information later on.

Among the supplemental information that can be requested by NACHA is:

• Any doing-business-as names, taxpayer identification number(s), and street and website address(es) of the Third-Party Sender;
• the name and contact information for the Third-Party Sender’s contact person;
• names and titles of the Third-Party Sender’s principals;
• the approximate number of Originators for which the Third-Party Sender transmits entries; and
• a statement as to whether the Third-Party Sender transmits debit entries, credit entries or both. 

Additional information on Third-Party Sender registration requirements can be found here and in ACH Operations Bulletin #2-2014: ACH Transactions Involving Third-Party Senders and Other Payments Intermediaries.

Recent ACH Operations Bulletins

Towards the end of the year, NACHA release a couple of Operations Bulletins that may have flown under the radar. The first one is ACH Operations Bulletin #3-2017, released September 2017. Unlike most NACHA Operations Bulletins, this was not made public because it details fraud mitigation strategies for social media schemes. Each NACHA member should have received this bulletin, but if for some reason you cannot find it, you may want to contact NACHA to get a copy.

The second Operations Bulleting was #4-2017, issued November 2017. The bulletin provides risk mitigation strategies for consumer-to-other-consumer (C2C) debits for financial institutions and their service providers. Something to note from this bulletin is that "NACHA strongly discourages ODFIs from facilitating these payments unless the ODFI is certain of its full compliance with all rules that apply to the origination of all ACH debits, regardless of the nature of the Originator." So if your credit union is considering offering C2C debits, this is a good bulletin to keep in mind when establishing internal controls.

Finally, NAFCU recently hosted a webcast on ACH Operating Rules in 2018 that is available on-demand and goes over all these rule changes as well as NACHA rule proposals and available resources.

Same-Day ACH Phase 2 Deadline Fast Approaching; Programming Note

Written by Stephanie Lyon, Regulatory Compliance Counsel

Almost 2 years ago, NACHA adopted a Same-Day ACH system meant to move payments faster by using existing next-day capabilities and establishing a new option for same-day clearing and settlement of ACH transfers. We wrote a blog regarding this change, but now that Phase 1 of NACHA's Same Day ACH payments has come and gone, it is a good time to discuss progress, review what Phase 2 is all about and provide some NACHA resources.

As a refresher, Phase 1 affected the crediting of ACH payments, meaning those payments that are originated in the credit union and sent elsewhere. While the rule allowed credit unions the choice of becoming a same-day originator, all financial institutions had to receive and process same-day ACH transactions upon implementation of Phase 1.  On the flip side, Phase 2 affects the debiting of funds from a member's account. Credit unions will be required to provide Same-Day debiting capabilities staring September 15, 2017.  Here is a NACHA chart that summarizes these changes and implementation dates for Phases 1 through 3:

A couple of weeks ago NAFCU staff met with NACHA representatives and discussed progress with Phase 1. There were a couple of takeaways from the meeting that I wanted to share. First NACHA reported that no financial institution saw an increase in fraud since the implementation of Phase 1. This may be in part because Phase I was only debits.

Second, some of the issues financial institutions encountered when implementing Phase 1 could have been smoothed out if more testing had been performed. As Phase 2 has more moving parts, testing is essential. Here are some testing tips from NACHA to get ready for Phase 2:

1. Contact your ACH Operator to sign up for a testing window and review testing options
2. Plan for testing across multiple, consecutive settlement days
3. Test with all your vendors and processors. Don't assume you are done just because you tested Phase 1 or your software vendor has tested Phase 2.
4. Test posting all the way through the Demand Deposit Account and other transaction platforms
5. Test with downstream applications for Same Day ACH reporting and origination
6. Test origination and receipt of debit returns through same-day windows
7. Test for balancing and reconciliation with your ACH Operator statements and advices
8. Provide your corporate members with the opportunity to test Same Day ACH origination and receipt
9. Include your Internal Compliance/Audit teams in your test plan
10. Consider the impact on your Federal Reserve Bank settlement account

And here are some additional resources pertaining to Same Day ACH Phase 2 that may be helpful while preparing to comply with this new process:

• Checklists for ODFIs, RDFIs and Processors
• Call to Action for ODFIs, RDFIs and Processors
• Testing Tips for FIs and Processors
• Effective Entry Dates: Considerations for ODFIs
• ACH Operations Bulletin – Same Day ACH and Debit Processing
• "Check and Correct" Effective Entry Dates for Same Day ACH Debits

Finally, we also received an answer to a somewhat common compliance question regarding the interplay between Regulation E's error resolution for ACHs and NACHA's timely return requirement as they are not the same. Under Regulation E, members have 60 days from the date the credit union sends a periodic statement to timely notify the credit union of an unauthorized ACH transaction while NACHA rules give the Returning Depository Financial Institution (RDFI) 60 days from the date of settlement to submit a return through the automated return system. See, 12 C.F.R. 1005.11(b)(1)(i) and NACHA Rules 3.2.1.  So what are credit unions to do if they find themselves past NACHA's timely return deadline but still having to credit a member's account under Reg E? According to NACHA Bulletin # 1-2014, the RDFI may go outside the automated return system and contact the ODFI directly to remind them about the contractual warranties the ODFI made in regards to the ACH. This should be sufficient in most cases to get the ODFI to reverse the unauthorized transaction so that the RDFI does not have to eat the loss. If it is not, then credit unions can also go through state contract enforcement channels as the warranty does not expire just because NACHA's automated return system rejects anything after 60 days.

Did you know... NACHA has a hotline that answers questions about NACHA rules and processes?  Credit unions may want to directly contact NACHA if stuck on an ACH question especially as Phase 2 deadline approaches. Credit unions may e-mail their questions or call NACHA offices that will route the credit union's inquiry to the correct department.

Programming Note. NAFCU will close at noon today and remain closed on Monday in observance of Memorial Day. At the nearby Arlington National Cemetery, yesterday the 3rd U.S. Infantry performed the "flags in" tradition, placing a small U.S flag a foot in front of each headstone at the cemetery. These flags will be removed after Memorial Day, but are present for the weekend's events taking place at the cemetery in honor of fallen service members. 

We will be back to blogging on Wednesday. Everyone have a safe weekend!

 

CFPB Issues Regulation Z Annual Threshold Adjustments; Fed Adopts Same-Day ACH Processing; A Penny for Your Thoughts

Written by Victoria Daka, Regulatory Compliance Counsel

The CFPB is required to annually adjust certain threshold amounts within various provisions of Regulation Z based on inflation. While it’s not the most exciting task, it has to be done. That said, on September 21, 2015, the bureau published a final rule implementing a few of these adjustments under the CARD Act, HOEPA, TILA, and the Dodd-Frank Act. The rule modifies the credit card penalty fee safe harbor, the HOEPA total loan amount and fee trigger thresholds, and the loan amounts for specific points and fees limits under Regulation Z’s qualified mortgage rule. These amounts are adjusted, where appropriate, based on the annual percentage change reflected in the Consumer Price Index in effect on June 1, 2015. The following will outline the adjustments of several provisions in Regulation Z, effective January 1, 2016. However, the minimum interest charge disclosure thresholds will remain unchanged in 2016.

Card Act                                                                                                                                                                              Under section 1026.52(b), fees on credit card accounts must generally be based on costs, but the rule contains safe harbor amounts that are considered compliant. The new safe harbor for a member’s first late payment will be $27 and $37 for subsequent late payments within the same six month period. Credit unions should note that while the first late payment fee remains unchanged, subsequent payments within the six month period decreased by $1 dollar to $37.

HOEPA                                                                                                                                                                       Under section 1026.32(a), for purposes of determining the total loan amount threshold that determines whether a transaction is a high cost mortgage when the points and fees are either 5 percent or 8 percentis $20,350. This is an decrease from the current $20,391 figure. Additionally, for purposes of determining whether a consumer credit transaction that is secured by a consumer's principal dwelling and is not otherwise exempt is covered by § 1026.32 a loan is covered if the points and fees exceed $1,017 or 8 percent of the total loan amount, whichever is lower. This is a decrease from the current $1,020 figure.

TILA                                                                                                                                                                                    Under section 1026.43(e)(3), for purposes of determining whether a covered transaction is a qualified mortgage, a covered transaction is qualified when: the transaction's total points and fees do not exceed 3 percent of the total loan amount for a loan amount greater than or equal to $101,749; $3,052 for a loan amount greater than or equal to $61,050 but less than $101,749;  5 percent of the total loan amount for loans greater than or equal to $20,350 but less than $61,050; $1,017 for a loan amount greater than or equal to $12,719 but less than $20,350, and 8 percent of the total loan amount for loans less than $12,719. Credit unions should note that these are all increases from the current figures.

The CFPB’s final rule can be found here.

***

Fed Adopts Same-Day ACH Processing                                                                                                                         

On September 23, 2015, the Federal Reserve Board approved the NACHA mandatory same-day automated clearinghouse processing rules adopted in May. Same day transactions will begin to phase in starting September 2016. The new rule “requires receiving depository financial institutions (RDFIs) to participate in the service and originating depository financial institutions (ODFIs) to pay a fee to RDFIs for each same-day ACH forward transaction,”

The Board's Federal Register notice can be viewed here. For more information on NACHA’s same-day ACH, check out this blog post.

***

A Penny for Your Thoughts

Back when I was new to compliance, I wish there had been a “compliance officer 101” type of resource. There are so many regulations that compliance officers need to be aware of, including -- TILA/RESPA Integrated Disclosures, Regulation B, Regulation CC, Regulation D, Regulation DD, Regulation E, Regulation J, Regulation P, Regulation V, Regulation X, Regulation Z, and UDAAP -- just to name a few. Oh yea, and then there is the E-SIGN Act, too! You can’t forget about those electronic disclosures.  With all of these regulations, how do they all work in tandem? And then there are policies, which ones require board approval?

Whether you’re new to compliance and share my rookie-days sentiments, or are a seasoned compliance officer, we’re working on a new electronic resource to help you navigate your way through the regulatory-compliance land of credit unions.

My question to you – what did you use when you were brand new to compliance? Or are you still looking for that perfect resource to help you with your day-to-day compliance needs?

Hodgepodge Monday and a Special Goody from NAFCU

Written by JiJi Bahhur, Director of Regulatory Compliance

NAFCU Goody.  Members asked, and today they will receive.  NAFCU’s compliance team has updated its consolidated regulatory text on the Truth in Lending Act and Real Estate Settlement Procedures Act (TILA/RESPA) Integrated Disclosure (TRID) rule.  Available with a NAFCU member log-in, the updated consolidated text can be located on NAFCU’s mortgage resources webpage here and serves as a great research tool. 

***

Free NAFCU-NCUA Webcast, Fine-Tuning Your Compliance Program: Common Compliance Violations.  On July 21, Bernadette and I will be joining NCUA’s Judy Graham, program director in the Office of Examination and Insurance, Patrick Truett, information system officer for E&I, and Matt Nixon, program officer in the Office of Consumer Protection, in presenting “Fine-Tuning Your Compliance Program: Common Compliance Violations.”  We will discuss how credit unions can navigate common compliance issues and examine various compliance areas of interest.

Online registration is available here and participation is free. You can find more information here.

***

CFPB’s Fifth TRID Webinar Available.  Part 5 of the CFPB’s TILA/RESPA webinar series is now available for viewing here.  This fifth and final webinar addresses specific questions related to rule interpretation and implementation challenges that have been raised to the CFPB by creditors, mortgage brokers, settlement agents, software developers, and other stakeholders. In particular, this session covers industry questions relating to operations and technology challenges.

Recordings of the previous webinars in the TILA/RESPA series are available at the links below:

TILA-RESPA Integrated Disclosure, Part 1 — Overview of the Rule

TILA-RESPA Integrated Disclosure, Part 2 - Various Topics

TILA-RESPA Integrated Disclosure, Part 3 — Completing the Loan Estimate

TILA-RESPA Integrated Disclosure, Part 4 — Completing the Closing Disclosure

Just a reminder – if you are looking for additional help with TILA/RESPA, NAFCU’s Credit Union Compliance GPS contains an appendix that is solely dedicated to TILA/RESPA.  Also, check out our TILA/RESPA Boot Camp and blog series.

***

CFPB Issues Guiding Principles for Faster Payment Networks.  Last week, the CFPB outlined guiding principles for faster payment networks.  In the CFPB’s guidelines, it states:

“Improvement in payment systems can aid many users — and consumers, in particular — if accompanied by more robust and timely information about payments and receipt of funds. When integrated with systems such as mobile banking and other channels by which consumers may obtain real time information about their account balances, consumers could know more definitively when they do and do not have funds with which to conduct transactions. At best, faster payments could enable faster, safer, and more accessible commerce.”

The guidelines focus on privacy, transparency, costs, security, access and more.  To view the guidelines, click here.  To view the press release, click here.

It should be noted that other federal agencies, including the Federal Reserve, have been engaged in initiatives to improve payment systems as well.  NAFCU has been very involved in these efforts and will continue to gather input on how to improve the U.S. payments system. 

NACHA Adopts Same Day ACH; CFPB Spring Rulemaking Agenda

Written by Brandy Bruyere, Regulatory Compliance Counsel

On May 19, NACHA announced the approval of Same Day ACH which would amend NACHA rules allow some Entries to be processed the same day, promoting faster payments. According to NACHA, the new provisions would “build upon existing, next-day ACH Network capabilities and establish a new option for same-day clearing and settlement via ACH.”

Currently, most ACH transactions are settled on the next business day after origination. The new rules, which will be implemented in phases, would ultimately allow Same Day ACH for most transactions. While Same Day ACH will be optional for Originating Depository Financial Institutions (ODFIs), receipt of such transactions will be mandatory for Receiving Depository Financial Institutions (RDFIs). The changes also add new Part 11.1 Determination of Same Day Entry Fee, requiring ODFIs processing Same Day ACH transactions to pay the RDFI a Same Day Entry Fee of 5.2 cents per transaction.  Also, Same Day ACH would not be available for any International ACH Transaction (IAT) Entry or large transactions exceeding $25,000. The rule also amends sections relating to the determination and revision of Same Day Entry Fees.

This blog is a very high-level summary of some of the key components regarding the phased implementation of the changes. For more detailed information including full text of the new rules and Frequently Asked Questions, check out this NACHA webpage.

Phase 1—Credit Entries and Non-monetary Entries—Effective September 23, 2016

In part, the first phase of rule changes would add a new Section 8.84 Same Day Entry which permits same day processing for most credit Entries transmitted by an ODFI to its ACH Operator. Phase 1 explicitly excludes debit Entries from Same Day ACH. During Phase 1, for Same Day credit Entries, Subsection 3.3.1.1 General Rule for Availability of Credits will require RDFIs to make funds available in the account “no later than the RDFI’s processing for that for that settlement date.” However, during Phase 1, the RDFI is not required to make funds available for withdrawal on the Settlement Date. The rule also amends sections such as Subpart 3.2.2 Glossary of Data Elements and Subpart 10.4.6.2 Responsibilities of Enforcement Panel.

Phase 2—Addition of Debit Entries for Same Day ACH—Effective September 15, 2017

In Phase 2, Section 8.84 Same Day Entry would change so that debit Entries will also be eligible for Same Day ACH. Phase 2 also includes various amendments relating to Reversing Entries, Reclamation Entries, and Data Elements. For example, Subsection 2.8.3 Time Limitations on Initiation of Reversing Files will include a new technical requirement relating to debit Reversing Entries. Debit Reversing Entries must not contain an Effective Entry Date that is earlier than the Effective Entry Date of the related credit Entry.

Phase 3—RDFIs Must Make Funds Available by 5:00 PM Local Time—Effective March 16, 2018

Subsection 3.3.1.1 General Rule for Availability of Credits would be amended to require RDFIs to make credit Same Day Entries available no later than 5:00 PM local time, subject to the RDFI’s right to return an Entry. However, the RDFI will generally be exempt from this requirement if it “reasonably suspects that a credit Entry is unauthorized.”

NACHA issued scenarios that provide illustrations of how the current rules function and how the different phases of implementation will function. This document may be helpful in understanding the rules and how they may impact your credit union. NACHA’s Executive Summary may also be useful as a basic starting point. NAFCU’s Regulatory Affairs team will soon release a Final Regulation which goes into further detail on NACHA’s Same Day ACH rules for our members.

In a related note, on May 21 and in response to the NACHA announcement, the Federal Reserve issued a request for comment for adopting same-day ACH service for the Reserve Banks’ ACH service. Comments are due by July 2, 2015. NAFCU members can send comments regarding the Fed proposal to NAFCU Regulatory Affairs Counsel Kavitha Subramanian, [email protected].

***

CFPB Issues Spring Rulemaking Agenda. On May 22, the CFPB published its Spring 2015 rulemaking agenda. For more information, here is the bureau’s blog and the agenda.

***

Palate Cleanser. NACHA is a lot for a Friday, so here are a couple of photos that might take the edge off. Nolan is not crawling, but he will roll to where he wants to go—which sometimes includes heading in Lemmy’s direction. Also, now that summer is here, we are glad that Nolan enjoys hats so much that he’ll even pull them down further over his face. At least it keeps the sun off?

NCUA Report; Understanding Risks in Electronic Payment Systems

Written by Bernadette Clair, Senior Regulatory Compliance Counsel

A couple of weeks ago, NCUA released its November 2014 Report. Featured articles include:

• Office of National Examinations and Supervision Report: ATM Skimmers: Can You Spot Them?
• Chairman’s Corner: Honoring Our Nation’s Veterans
• Board Perspectives: Taking the Time to Get it Right
• Board Actions October 2014: No Share Insurance Fund Premium for 2014; Board Approves Proposed Amendments to Corporate, Flood Insurance Rules
• Region II Report: Understanding Risks in Electronic Payment Systems
• Office of Small Credit Union Initiatives Report: Five New NCUA Videos to Fight Fraud
• Office of National Examinations and Supervision Report: Mobile Banking, Payments Increase Among Smartphone Users
• Find a Credit Union with our Locator App

***

Understanding Risks in Electronic Payment Systems. One of the articles in this month’s NCUA Report that caught my attention discusses the risks associated with electronic payment systems (ACH, ATM, wire transfers, and remote deposit capture) that credit unions should consider when offering or expanding these services. These risks fall into several familiar categories – credit, fraud, compliance, liquidity, systemic, operational or transactional, strategic, and reputation.

Here’s a snippet from the article, with just a few of the questions that NCUA has developed to help credit unions develop electronic payments risk-management policies and procedures:

“Policy and Procedures — Are our policies sufficient enough to address the risks associated with our credit union’s activities? Do our policies describe program objectives, the board’s risk appetite and tolerances? Have we identified and formally approved all activities the credit union will engage in? Do our written procedures match our current practices? Do our current practices address such things as Bank Secrecy Act or customer identification and verification concerns? Have we established and documented our incident response and communication expectations? Does our credit union have effective internal controls?

Audit — Has my credit union completed an acceptable audit? Was the audit completed by a person independent of my credit union’s operations? Do our internal audits sufficiently identify potential risk across all operational areas? Has my credit union taken action to correct any issues found in the audit?

Risk Assessment — Has our management evaluated the risks associated with electronic payments processing? Is our credit union’s risk assessment commensurate with the type and complexity of our activities? Does the assessment consider all categories of risk? Does it identify inherent risk, risk mitigating controls in place and residual risk?”

For the complete list of questions NCUA has developed, as well as links to several NCUA Letters to Credit Unions containing additional guidance, the article is available in its entirety here.

NACHA Approves New Rules Aimed at Improving ACH Network Quality

Written by Brandy Bruyere, Regulatory Compliance Counsel

Last week, the National Automated Clearing House Association (NACHA) announced the approval of two new amendments to the NACHA Operating Rules (registration & log in required). These changes aim to improve network quality “by reducing the incidence of ACH transactions that result in exceptions and returns.” The first rule adds a new section to Article One and establishes “Unauthorized Entry Fees.” The second rule is more complicated and largely makes changes to various subsections of Article Two relating to Unauthorized Entry Return Rate Thresholds, Overall Return Rate Levels, Reinitiation of Entries, and Third Party Senders. Here are brief summaries of these amendments.

“ACH Network Quality” Rule—Unauthorized Entry Fees.

This rule will require Originating Depositary Financial Institutions (ODFIs) to pay a fee to Receiving Depository Financial Institutions (RDFIs) for returning unauthorized transactions. The goal is to “encourage many ODFIs to perform enhanced risk management and monitoring of Originators with high volumes or rates of Entries that result in unauthorized returns.” NACHA estimates that these fees will range from $3.50 to $5.50 per unauthorized Entry and will benefit RDFIs by offsetting the costs of handling unauthorized transactions while also reducing customer service contacts.

This rule will go into effect for entries with a Settlement of October 3, 2016 or later. This means the fees could apply to transactions initiated as early as August 1, 2016. For more details, NACHA included a helpful FAQ section to a webpage dedicated to the rule that is worth reviewing.

“ACH Network Risk and Enforcement” Rule.

Generally, these rule changes aim to “reduce the incidence of returned Entries and the associated costs, both financial and reputational, that such returned Entries impose…” The amendments cover five topics:

• Topic One—Reducing the Unauthorized Return Rate Threshold (effective September 18, 2015). These provisions amend Article Two, Subsections 2.17.1.1 through 2.17.2.3 addressing unauthorized Entry return rates. This change also updates the definition of “Unauthorized Entry Return Rate Threshold” in Article 8, Section 8.105.
• Topic Two—Establishing Inquiry Process for Administrative and Overall Return Rate Levels (effective September 18, 2015). These changes impact Article Two, Subsections 2.17.2.4 through 2.17.2.6 relating to ODFI responses to NACHA requests for information and the timeframes in which ODFIs must lower return rates. The changes also create a new definition for “Return Rate Level” in Article 8, Section 8.89 and amend parts of Appendix 10 relating to NACHA requests for information and inquiries.
• Topic Three—Reinitiation of Entries (effective date September 18, 2015). Reinitiation allows a Returned Entry to be resubmitted. Under the current version of the rules, reinitiation is “implicitly” prohibited outside of set circumstances under Subsection 2.12.4 such as insufficient or uncollected funds or a stop payment order. The rule will now make this prohibition explicit, consistent with ACH Operations Bulletin #3-2-13.
• Topic Four—Third-Party Senders (effective date January 1, 2015). This rule “makes explicit a Third-Party Sender’s existing obligation to monitor, assess and enforce limitations on their customer’s origination and return activities in the same manner the Rules require of ODFIs. The Rule also requires that a Third-Party Service Provider or Third-Party Sender provide proof of completion of its Rules compliance audit to its Participating DFI in order to fulfill a request from NACHA.”
• Topic Five—NACHA’s Enforcement Authority (effective date January 1, 2015). Finally, the amendments allow NACHA increased flexibility for initiating an investigation of a rule violation and allows RDFIs to voluntarily provide NACHA with information that may indicate a rule violation by other network participants.

Again, a FAQs section for this rule can be found here and is worth reviewing in full along with a summary of the expected impact of these rules and the technical changes.

***

NAFCU's 2014 Credit Union Compliance GPS is still available. This comprehensive, electronic resource translates complex regulatory language into plain English. The latest edition includes improved user-friendly search functions, including more hyperlinks and bookmarks and much more. You can purchase a copy for your credit union here!

***

Lazy Labor Day. While some of the holiday weekend was spent working on the nursery, I also spent some quality time with Lemmy. As you can see, he really enjoyed himself!

NACHA Issues Resource on Evaluating Higher-Risk ACH Originators

Written by Bernadette Clair, Senior Regulatory Compliance Counsel

NACHA recently issued a new resource entitled Sound Business Practices for Evaluating Customer Risk which is generally designed to help financial institutions assess and monitor the risks associated with ACH originators for which they open or maintain accounts.

The resource is divided into the following broad sections:

Enterprise-Level Policies, Procedures and Assessments

General Policies

Regulatory References

Line of Business-Based Policies

ACH Client Policies, Procedures and Assessments

General Policies

Line of Business-Based Policies

Activity Policies

Regulation-Related Policies

Additional Investigation and Recordkeeping

NACHA indicates that the “sound business practices in this document are not intended to be prescriptive; instead, they provide Originating Depository Financial Institutions (ODFIs) with approaches that may be useful in developing, assessing and tailoring an appropriate and comprehensive due diligence process.”

In addition to providing general practices related to evaluating the credit, operational, regulatory and reputational risk of ACH originators, the document includes practices aimed at evaluating the risk posed by an ACH originator as a result of its line of business.  For an example of the recommended practices, here’s an excerpt from pages 6-7 on the evaluation of specific risks posed by ACH originators based on their line of business.

"ACH Line of Business-Based Policies

• Identify classifications of businesses and transactions that are of specific concern to ACH:

− Identify concerns for business types defined as more likely to pose an elevated level of risk and determine what actions should be taken to address those concerns

− Understand the products or services that the Originator is selling and its target audience

− Ensure that authorizations for such products or services comply with NACHA Operating Rules

− Determine if the Originator is selling online. If so, review authorization verbiage as well as the product satisfaction guarantee

• Assess Standard Entry Class (SEC) Codes to be used (for example, PPD, WEB, or ARC) along with specific types of payments (for example, mortgage payments; online bill payment; recurring bill payment)

• Consider the varying risk of different kinds of payments even within classes, for example, routine bill payments typically pose little risk but some types of online purchases may be riskier than others

• Ensure that the nature of originated transactions fits with the nature of the customer’s business"

The document contains numerous other recommended practices and is a must read for any ODFI.  It may be found in its entirety here. 

DOJ’s “Operation Choke Point” Targets Banks’ Indirect Relationships with Payday Lenders

Written by Brandy Bruyere, Regulatory Compliance Counsel

In a move aimed at cracking down on payday lenders, the Department of Justice (DOJ) launched an investigation last year called “Operation Choke Point.” DOJ is probing whether banks allowed third-party payment processors working on behalf of payday lenders to illegally access billions of dollars from consumer checking accounts.

In essence, Operation Choke Point is an attempt to cut off some payday lenders’ “back door” entrance to traditional banking services. Like many merchants, payday lenders often use third-party payment processors to debit their customers’ checking accounts. The third-party payment processors, in turn, establish relationships with financial institutions. This allows payday lenders to indirectly access the Automated Clearing House (ACH) network to receive payments.

So what happens when a bank has an agreement with a third-party payment processor, but that third-party does business on behalf of a payday lender who is breaking the law? As it turns out, without proper due diligence, these agreements could be quite expensive for targeted financial institutions.

In its first Operation Choke Point action, DOJ filed a lawsuit against Four Oaks Bank (Four Oaks) of North Carolina. The various allegations included violations of Customer Identification Program requirements under the Bank Secrecy Act and allowing improper access to the ACH network. According to the complaint, Four Oaks worked with a third-party payment processor called TPPP-TX, which primarily represented payday lenders. Some of these payday lenders had rates of returned transactions that exceeded 30%, over 21 times higher than the national average of 1.38%. DOJ claimed that the Bank went so far as to design its internal policy for third-party payment providers to accommodate TPPP-TX despite these “extraordinarily high” return rates. Four Oaks was also accused of failing to properly identity foreign payday lenders accessing customer accounts via TPPP-TX.

Reports indicate that DOJ and Four Oaks already reached a tentative $1.2 million settlement in this case. Two members of Congress sent a letter to Attorney General Eric Holder expressing concerns about the investigation’s impact on legitimate payday lending business operations. While many credit unions do not work with third-party payment processors, this is a good reminder that third-party relationships come with additional compliance concerns. Here are some resources about managing risks stemming from relationships with third-parties including payment processors:

• NCUA Letter to Credit Unions, “Evaluating Third Party Relationships,” 07-CU-13
• NCUA's Third Party Relationships Questionnaire
• FFIEC’s BSA/AML Examination Manual, “Third-Party Payment Processors Overview”
• FinCen Advisory, “Risk Associated with Third-Party Payment Processors,” FIN-2012-A010
• FDIC Financial Institution Letter, “Payment Processor Relationships,” FIL-3-2012

***

Eye on the Olympics. Speaking of choking, I don’t know about the rest of you, but I’m a bit of a sucker for the Olympics. Maybe it’s the combination of patriotism and pageantry. Or maybe it’s that I experience a strange sense of joy watching people careen down a mountain headfirst on a tiny sled. Anyway, while figure skating is not normally my personal favorite, 19-year-old Jason Brown is an athlete to watch. Here is Jason’s impressive performance that helped earn him a trip to Sochi.

Creating a Safe and Modern 21st Century Payment System; Programming Note; Free Kick; Invaluable Knowledge

Written by Ricardo Piñeres, Regulatory Compliance Counsel

My name is Ricardo Piñeres, and I am the new Regulatory Compliance Counsel here at NAFCU.  I know what you’re thinking: “Did I somehow trip into a time machine and get propelled into the future?  Aren’t Alicia and Brandy the new Regulatory Compliance Counsels?”  Well, things move pretty fast here at NAFCU, and in an effort to better help our members navigate the crazy world of compliance, I have also been added to the team.  I truly look forward to sharing my thoughts on compliance issues on this blog.

While you may not have time traveled, I do want you to spend some time thinking about the future.  What will our payment systems look like as we continue boldly pushing forward into the 21^st Century?  While cash, checks, ACHs, and other forms of payment have served us well for many years, our industry is at an interesting crossroads.  Consumers are demanding more real-time transactions that do not compromise security.  Consumer electronics and the technology that powers them are getting more powerful with every passing second.  It’s only a matter of time before our current payment systems become obsolete.

So, why should you care?  Isn’t this a discussion for the technocrats, market researchers, and product development teams both within and outside of the financial services industry?  While they may be the driving forces behind much of the changes that will inevitably be coming, compliance specialists absolutely need to take an active role in the discussions.  It is you who will be tasked with ensuring that these payment systems and the processes that our institutions use in making them work are fully compliant with both current and future laws.  Therefore, you need to be thinking of what you want these systems to look like and how you think they should be regulated.

Back in September, the Federal Reserve Banks released a white paper that outlined what they preliminarily view as the goals of payment systems evolution and the hurdles that lie ahead.  In this white paper the Federal Reserve Banks have identified five desired outcomes that they want to be accomplished within ten years.  They are:

• Key improvements to the future state of the payment system have been collectively identified and embraced by payment participants, and material progress has been made in implementing them.
• A ubiquitous electronic solution(s) for making retail payments exists that does not require the sender to know the bank account number of the recipient.  Confirmation of good funds will be made at the initiation of the payment.  The sender and receiver will receive timely notification that the payment has been made.  Funds will be debited from the payer and made available in near real time to the payee.
• Over the long run, greater electronification and process improvements have reduced the average end-to-end (societal) costs of payment transactions and resulted in innovative payment services that deliver improved value to consumers, businesses, and governments.
• Consumers and businesses have better choice in making convenient, cost-effective, and timely cross-border payments from and to the United States.
• The Federal Reserve Banks have collaborated, as appropriate, with the industry to promote the security of the payment system from end-to-end amid a rapidly evolving technology and threat environment.  In addition, public confidence in the security of Federal Reserve financial services has remained high.

While it is great that the Federal Reserve Banks are proactively working towards the modernization of the U.S. payment system, it needs to be industry leaders that are the driving force behind any changes to the payment system.  It would be akin to the government having stepped in and mandated a winner in the VHS/BETA Max and Blu-Ray/HD-DVD wars.  The industry standards were set by consumer choice, and the same needs to happen with the evolution of payment systems.  The growth of a modern payment system must happen naturally with tech companies, financial services institutions, payment networks, consumer groups, and other interested parties coming together to see what are the best solutions to this complex puzzle.  The Federal Reserve Banks’ role should be akin to a moderator working to ensure that all interested parties are a part of the developmental process.  That being said, the various industries must be allowed enough autonomy from the Federal Reserve Banks to find real and practical solutions that address the various issues in creating a safe and modern payment system.

NAFCU’s Regulatory Alert (13-EA-31) on the Federal Reserve Banks’ white paper on improving payment systems is available here (NAFCU log-in required).  Also, take a look at this CU Insight post – written by Carrie Hunt: Let Industry Lead the Way for Payment System Reform. 

***

Programming Note.  NAFCU’s offices will close today at noon for the Martin Luther King, Jr. holiday and will reopen on Tuesday, January 21.  We will be back to blogging on Wednesday, January 22.

***

Free Kick. As you get to better know me, you will learn about my love for football (soccer), and with each one of my blog posts, I’ll be adding a short thought on the world of football.  Today’s thought:

What better way to mentally fight the cold of this winter than by being transported to Brazil through the sounds of Gaby Amarantos and Monobloco’s Todo Mundo, Coca-Cola’s anthem for this year’s World Cup (an English version was recently released by David Correy and a Spanish version has been released by Carlos Vives – my favorite musician).  It’s got a great beat and reminds me that there are only 145 days until the tournament begins!

***

Last Day for Early Bird Savings - NAFCU's Regulatory Compliance School.  Before you leave for the weekend, lock in your $100 in early-bird savings for NAFCU’s Regulatory Compliance School March 10-15 in National Harbor, Md. Today is the last day to save!  You’ll get credit union regulatory compliance from A to Z, plus the chance to take the exams to earn the respected title of NAFCU Certified Compliance Officer.

 

NACHA’s ACH Data Security Proposal

Written By JiJi Bahhur, Regulatory Compliance Counsel

NACHA Proposal

Last week, NACHA released proposed amendments to the NACHA Operating Rules that are aimed at protecting the security and integrity of certain ACH data.  The proposal addresses several areas of concern – protection of ACH sensitive data, access controls, self-assessments, and verification of third-party senders and originators – known as the “Security Framework.” 

I will touch very briefly on each of these elements, but please note that the executive summary and proposal go into far more detail on what is expected. 

Protection of ACH Sensitive Data

The proposal would require non-Consumer Originators, Participating DFIs, Third-Party Service Providers, and Third-Party Senders to establish, implement, and as appropriate, update security policies, procedures, and systems related to the initiation, processing, and storage of Entries. 

Access Controls

The security policies, procedures, and systems must include controls on access to all systems used by the ACH participant.  The level of controls is not defined by the proposal.

Self-Assessments

The proposal would require an audit provision be incorporated into the rule.  In other words, those affected by the proposal would be required to verify, as part of their annual ACH audit, that it has established, implemented, and updated the data security policies, procedures, and systems required by the proposal.

Verification of Third-Party Senders and Originators

The proposal would require an ODFI to use commercially reasonable methods to establish the identity of each non-Consumer Originator or Third-Party Sender with which it enters into an Origination Agreement. 

For further detail on the proposed modifications, view the proposal here.  Note that the executive summary and the proposal are both short, but very informative, reads. 

***

NAFCU Members

Our Regulatory Affairs team is in the process of putting together a Regulatory Alert on the NACHA proposal which will be available for download here. 

 

 

Garnishment FAQ

Posted by Sarah Loats Zimmermann

Happy Monday - hopefully you all enjoyed your weekend! I think Steve and I bombarded you with enough sports rivalry banter last week so I'll just dive into it on Monday morning...

The garnishment interim final rule has been in place for a couple of weeks now and in light of some of the questions that have come up, the Treasury Dept. has issued a set of FAQs. As a refresher, this rule provides procedures credit unions must take when they receive a garnishment order against a member who receives certain Federal benefit payments by direct deposit.

It is a short document but it does address one of the more common questions we've received. Below is Q&A #2 from the document.

2.Are tax levies subject to the rule? Currently, the requirements of the rule are
triggered by the receipt of a “garnishment order,” which is defined as an order
issued by a court or a state child support enforcement agency.  Accordingly,
Federal or State tax levies issued directly by a taxing authority are not
subject to the rule. Treasury is seeking public comment on all aspects of
the rule, including whether levies should be included in the definition of
"garnishment order.”  The comment period for the rule extends through
May 24, 2011. 

As part of the Greenbook the Treasury Dept. has also issued Guidelines and a Quick Reference Guide.


If you are wondering what this Greenbook thing is, it is a guide for Federal ACH Payments and Collections. It is a useful guide if you receive payments from, and send payments to, the Federal government (it even devotes and entire chapter to reclamations, a topic which can cause confusion).

Risk-Based Pricing Notice and Recordkeeping; Other Stuff

Posted by Anthony Demangone

As you pore over your risk-based pricing notice procedures, you may come across an interesting discovery.  There really are no record retention requirements spelled out in the final regulation.  So, what is one supposed to do?  How can you prove compliance?

One thought is that a credit union could rely on its policies and procedures, which will spell out how a credit union has decided to provide notices under the rule - assuming it has to provide risk-based pricing notices. I don't think such a stance is unreasonable.  In fact, that is the requirement the Fed created for Regulation E.  Here's the Fed's description of Regulation E's record retention requirements, found in the Staff Commentary, Section .13(b).

A financial institution need not retain records that it has given disclosures and documentation to each consumer; it need only retain evidence demonstrating that its procedures reasonably ensure the consumers' receipt of required disclosures and documentation.

I'm curious to see how others are handling this.  Feel free to leave a comment on the blog with your record retention plans.

***

Here are some other items.

• The most recent episode of Current Issues in Credit Unions is available.  So fire up that iPod!
• At Compliance Seminar, a speaker noted that the best risk management guidance document for ACH is OCC 2006-39.  After looking at the document, it is hard to argue against the speaker's statement.
• Leave it to Saturday Night Live to create perhaps the most effective financial literacy tool for consumers that I've ever seen. (Video.)  Keep in mind that your workplace may have a policy on watching videos while at work.  Believe me, though - this one is gold.  Gold, Jerry. Pure gold.

NACHA Rule; SAR Activity Review: By the Numbers; Da Beach

Posted by Anthony Demangone

NACHA's membership has approved a rule on mobile ACH payments.   Here's what it does.

Specifically, the Mobile ACH Payments Rule incorporates mobile ACH debits into the existing category of Internet-Initiated Entries (WEB). This Rule requires that mobile payments use the WEB Standard Entry Class (SEC) Code. In particular, the Mobile ACH Payments Rule:

• Expands the definition of WEB entries to include debit entries authorized and/or initiated via wireless networks
• Applies all provisions of the WEB SEC Code to mobile debit entries
• Revises the definition of Unsecured Electronic Network to include wireless networks and provides additional clarification to the industry  

The rule takes effect January 1, 2011. NACHA has indicated that it is preparing education and training materials. 

***

FinCEN has released the latest issue of SAR Activity Review: By the Numbers.   Stop the presses, but SAR filings dropped in 2009.  Check out the guidance, as it is chock full of great numbers and statistics.

***

I'm at the beach next week, where I plan to get sunburned and watch Kate and Briggs eat sand. (And to be yelled out for getting sunburned.)  Have a good weekend, everyone!

Reg Alert; LUA; Supervisory Committees

Posted by Anthony Demangone

Here are a few things kicking around in my email inbox.

Regulatory Alert.  NCUA has issued Regulatory Alert 10-RA-07, which announces updates to the FFIEC Retail Payment Systems Handbook.  The handbook covers topics from Check 21 to ACH.  For those of you not familiar with FFIEC handbooks, they are a great resource. Here's a link to all of the handbooks.  The booklets are a treasure trove of useful information.

LUA.  NCUA has issued its third Letter of Understanding and Agreement of this year. NCUA noted deficiencies in six different risk areas.  I've said it before, and I'll say it again.  NCUA appears to be tightening the screws on credit unions.  NCUA officials have indicated that they plan on using administrative actions sooner than in years past in order to deal with operational issues at credit unions.  While the LUA does not carry with it a civil money penalty, the affected credit union has to complete a number of major projects that will involve outside consultants.  Without a doubt, the credit union will be working around the clock to meet NCUA's demands.

Supervisory Committees.  NCUA Board member Hyland reiterated the importance of credit union supervisory committees during a recent speech in Baltimore, Maryland.  She indicated the following:

"maintain appropriate independence. Your auditor should report to you and not management or the board of directors. (This) concept is universal regardless of the size or composition of the organization. When we as a regulator and insurer see serious breakdowns in these basic principles of independence, we often encounter serious and emerging problems in the organization. Erosion of the principles is often symptomatic of a larger lack of diligence and integrity of the overall control environment.”

Semi-Annual Agendas; NACHA Operating Rules

Posted by Anthony Demangone

Tis the season for agency semi-annual agendas, which show what agencies are working on from a regulatory point of view.  I'm not sure these documents are super useful, but there is some information buried within them.

• NCUA's agenda.   NCUA discusses the privacy rule it issued a while ago, its decision to remove a confidentiality of SAR reports rule from the agenda, and its decision to withdraw the UDAP rule that pertained to credit cards.  
• The Fed's agenda.   As I read this, we may see the Reg Z closed end rule in May.
• The FTC's Agenda.  It just mentions the privacy rule that it issued, along with NCUA and other financial regulators.  Old news.
• Treasury's Agenda.  Now, this has a little more meat on the bone.  FinCEN looks like they'll have a stored value card proposal out in April. (They better hurry up.)  My first read is that this rulemaking is limited to MSBs and should not affect depository institutions (including credit unions. ) But we'll have to wait for the proposal to know for sure. In addition, the OCC looks to issue a final SAFE Act rule in May.  If they do, I would expect NCUA and other financial regulators to follow suit. 

 ***

NACHA has announced that its membership has approved a "simplification" of its Operating Rules.  The effort, according to NACHA, shouldn't change the substance of the rules.  They'll just be easier to digest and understand.

Previously organized around major topics, the simplified Rules framework is structured around the rights and responsibilities of participants in the ACH Network, making them more navigable by participants. In addition, clear, understandable, and consistent language has been adopted throughout the Rules as part of this process. This new version of the NACHA Operating Rules will go into effect on  January 1, 2011.

NCUA Board Meeting Agenda; This and That

Posted by Anthony Demangone

NCUA has released the agenda for this Thursday's NCUA Board Meeting.  It is a light agenda, and no, the SAFE Act is not one of the items to be discussed.  (Speaking of the SAFE Act, a little birdie tweeted in my ear that the federal mortgage underwriter registration system likely will not be ready until 2011.)

***

Here are a number of items of interest.

• Reputation. Here's a wonderful blog post from the Bank Lawyer's Blog that reminds us that just because we can do something, it doesn't mean that we should. Before moving forward, we should always think about our reputation.  The post describes how a JP Morgan Chase marketing campaign designed to push customers to use "signature" rather than "PIN" on their debit cards backfired.  It turns out that the marketing materials went to a journalist who viewed them as misleading.  It sort of went downhill from there.

• Misleading Overdraft Program.  The OTS issued a $400,000 civil money penalty against a bank for a number of things.  But what caught my eye was that a good deal of the cease and desist order centered on a misleading overdraft protection program.  Moving forward, the bank must set aggregate overdraft fee limits for account holders as well as giving customers a reasonable opportunity to stop "daily overdraft fees." (see page 8.)  Oh, and now the bank has to repay customers who were "harmed" by the overdraft protection program.  How much?  A total of $12 million. Granted, this is a bank that is regulated by OTS.  But generally, all federal regulators have very similar administrative powers.  That should get your attention.

• OTS Best Practices.  When the OTS issued the CMP above, it also issued proposed supplemental guidance for overdraft protection "best practices."  This guidance is not joint in nature - it was only issued by the OTS.  I may look into this in greater detail later on.  But for now, I just pass it along as an FYI.

• BOD. Filene's blog does a nice job of highlighting how the role of a credit union director is becoming more difficult.

• The most recent issue of NACHA's Risk Management News is available.  This is a good overview document for ACH peeps.

• Check out the new $100 bill. The presser links to an interactive program that shows off the new security features of the new "Benjamin."  I bet your tellers could use that information.

• The FTC is looking into whether they need to tweak COPPA.

IAT Compliance Deadline is Tomorrow; Charleston; Compliance Survey

Posted by Anthony Demangone

The delay of the original compliance date for NACHA’s IAT rule is nearing an end as the revised compliance date, September 18, 2009, is around the corner. Actually, it is tomorrow!  The rule requires that an international ACH transaction entry contain a list of required information as well as BSA’s "Travel Rule" data.

An International ACH Transaction is defined as an ACH entry that is part of a payment transaction involving a financial agency’s office that is not located in the territorial jurisdiction of the United States. Financial agency means an entity that is authorized by applicable law to accept deposits or is in the business of issuing money orders or transferring funds.

An office of a financial agency is involved in the payment transaction if it:

1. holds an account that is credited or debited as part of a payment transaction; or

2. receives funds directly from a Person or makes payment directly to a Person as part of a payment transaction; or

3. serves as an intermediary in the settlement of any part of a payment transaction.

Fortunately, NACHA does provide a wealth of information on its website on the rule, including FAQs, which you can access by clicking IAT Rule Helpful Materials.

***

For those of you attending our Regulatory Compliance Conference next month in Charleston, SC, you may want to take a look at TripAdvisor's Charleston page.  On the left-hand side, you'll see links for restaurants and "things to do."  Both list the top attractions in each category.   I can't wait!  But no internet surfing at work!  I don't want you getting fired before the conference.

***

Yesterday, NAFCU sent a compliance-related survey to member CEOs and to everyone in our database who has a job title related to compliance.   We're seeking feedback on our performance.  If you are a NAFCU member who didn't receive an email and you'd like to take part, email Lindsay Hunter at [email protected]. She'll email you a copy of the survey, which you can then fax back.

September 18, 2009; CTR Exemption Guidance

Posted by Anthony Demangone

Look at the date above.  Does it ring any bells?  That's the implementation deadline for the new International ACH Transaction (IAT) rules.  Here's a good resource for you if ACH compliance is one of your responsibilities - NACHA's IAT webpage.

***

FinCEN has released guidance to help credit unions and other financial institutions comply with CTR exemption requirements.  Specifically, the guidance should help you determine what supporting information is suitable for determining what portion of a business member's annual gross revenues is derived from activities that are ineligible for CTR exemptions.  Read the press release and access the guidance here.  Here's a snippet from the guidance.

The Financial Crimes Enforcement Network (FinCEN) is issuing this guidance to assist banks in determining the appropriateness of exempting from currency transaction reporting requirements non-listed business customers that derive some portion of their annual gross revenues from ineligible business activities.

Kudos to FinCEN.  I've always thought that there isn't enough guidance on CTRs, while we are buried in SAR-related documents. I hope this signals a new trend.