ACH Rules with Nacha's Amy Morris

Speaker A: Hello and welcome back to Data Driven Finance, brought to you by Yodlee. I'm Mike Stiles and my guest today is Amy Morris, who is senior Director, ACH Network Rules at nacha. Prior to that, she was business leader for Global Operating Regulation Development at Visa. The electronic payments world is her specialty, having worked for more than 15 years as part of multiple councils working groups that look at the industry. Consider those rules. We've got some good questions around changes to nacha's ACH network rules and how data is impacting ACH operations. So, Amy, we are really glad to have you with us.

Speaker B: I'm very happy to be here. Thank you so much for having me.

Speaker A: Fantastic. Well, for our listeners and me, just kind of tell me a little bit about nacha, what it does, who it serves, et cetera.

Speaker B: So when you think about NACHA as an organization, we're sort of divided into two pieces. The first is the ACH Network side of which I'm a part of. And we perform the administrative functions around the ACH network. So that means rule writing, rule enforcement, as well as risk management functions for the ACH network. We don't actually process transactions. That is handled by the ACH operators, which are the Federal Reserve and the, uh, Electronic Payments Network. Um, but as I said, the network side, uh, performs those necessary functions to keep the ubiquity, to keep the standardization around the ACH network. And then our other side is our association side where we provide options for all different types of participants in electronic payments to come together, together to network, to have important conversations about what's going on in the industry, what innovation is needed. And we provide education to the industry on electronic payments in general. So in terms of who we serve, really, it's anybody that is in the business of making or taking payments. So our direct members are financial institutions and payments associations. But we have other opportunities, um, other membership opportunities, such as our Payments Innovation alliance that is open to all different types of participants. Those that take payments and make payments, um, receive payments, and those vendors that support them.

Speaker A: Well, there are many of our listeners who don't have direct use of or experience with ACH payments. There are rules and guardrails that apply to it, but as with everything in life, you know, those rules can change and do change. So what are some of the bigger changes to the NACHA ACH Network Operations operating rules that are going on? And if I'm a financial institution or a business, which I am, what should I know to be ready?

Speaker B: So you're right, there are times when rulemaking is needed to foster innovation within payment systems. And then that needs to also be balanced out by rulemaking that helps to assist with risk management or risk mitigation around those newer functions. And so that's where we have been living in the last couple of years. Um, in 2020 Nacha had a, uh, fairly significantly sized rulemaking, uh, package around risk management that was passed and it's been being implemented since then. So in 2024, um, we implemented the pieces of those rules that were designed to give financial institutions greater tools to recover if unfortunately a fraud or a scam situation does happen. We implemented rules that allow for additional time for receiving financial institutions to review incoming credits. We also provided clarity to both receiving and originating financial institutions on what their options are for returning or requesting return around potentially questionable transactions. And so what we're moving towards now in 2026 is the pillar of this whole risk management package that's intended to reduce the number of potentially questionable transactions that may be introduced into the network. So we've got tools that we've expanded to help us deal with it when it does happen, but we want to also focus on reducing uh, those instances in the first place. So this is a significant size change and it impacts literally everyone in the payments world and those that are again taking payments, making payments pretty much unless you're a consumer. So as a financial institution, what you need to be prepared for uh, next year is that if you are what we call an odfi, an originating depository financial institution, that's the FI that puts the transaction into the network. You need to, by March of next year have processes and procedures in place that are risk based and designed with the intent to identify transactions, design debits, credits, consumer, non consumer, any ACH transaction that may have been unauthorized or authorized under false pretenses. This is a new term, um, that basically means that it's not unauthorized because I, as an account holder, I did initiate that payment, um, but somebody tricked me into doing it. So these are a lot of the authorized push payment fraud schemes that we've been hearing about over the last couple of years that goes beyond just the financial institution. There are also requirements for any vendors or businesses, and when I say business, I mean any organization. It can be a government, a nonprofit, um, a merchant, a biller. But any organization that's creating ACH transactions for the functions that they're performing, they also need to have processes and procedures in place next year for the same purpose, risk based and intended to identify those questionable transactions so that we can either Prevent them the first time or prevent them from happening again. We're starting with those largest parties. If you're an ODFI, all of those ODFIs are in the march bucket for implementation. For the non FIs, we're starting with the largest folks first 6 million or more transactions in 2023, you'll also fall into that march bucket. Everybody else by June 22nd will need to be compliant with these rules. Then on the receiving side, when it comes to what we call an rdfi, receiving depository financial institution, you also have, uh, phase one in March and phase two June of next year to implement processes and procedures that allow for the monitoring of incoming ACH credits, again for the same purpose, risk based and intended, to identify transactions that may be unauthorized or authorized under false pretenses. So there's a lot of nuance and there's been a lot of training going on, um, around these changes. And you can find a lot of that information available, um, on our website, through recorded webinars, through FAQs. But that has been a major focus over the last year and a half, as I said. But we never stand on, you know, on our laurels here. So we just last week had a new set of rules that were passed and a good chunk of them have to do with what we call our international ACH transactions. So coming in September, September 18th of 26, we've updated the definition of what an IAT or an international ACH transaction is. There's no change to the intent, um, but it's clarifying the language that was originally written by a lot of really, really, really intelligent lawyers and to make it hopefully more understandable for the average regular person that's dealing in payments to understand when a transaction needs to follow that IAT format and when it doesn't. We've also got an additional new field coming in March of 27 to the IAT format. A couple of fields actually to support the optional inclusion of a date of birth for consumers that may be involved in an international transaction. We're expanding registration requirements for Nacha's ACH contact registry to include mandatory contacts for IAT transactions. January 1st of 27. And we also have a couple of changes coming to the descriptions around how certain fields are used to accommodate the understanding that outside of the United States, entities that hold accounts may not be what we consider a traditional financial institution like we have here in the US and then finally we're separating out an existing return reason, code R16. We're separating the account frozen function from the function of a Return that's due to a sanctions compliance program and that's going to take effect March 17th of 2028. We also had one other piece, uh, come through with that new rule package. This speaks about funds availability requirements for what we call non same day ACH credit entry. So those are next day or two day credits and that requirement is for all of those types of credits to be made available by 9am on that settlement date. And finally we have a few changes that are going in January of 2026, January 1st, that are just some cleanup. Occasionally as we're um, going through rulemaking we find some things that just, you know, might be a typo here and there. And so yes, the last uh, this past year has been very, very busy, um, for changes to the NACHA operating rules. And so those are in a nutshell, what financial institutions and users of the ACH network need to be aware of for those, those dates coming from 26 all the way through 28.

Speaker A: Boy, you guys sound like a bunch of slackers. That's a lot of stuff. And that's really great because listeners, these financial institutions know exactly what's coming and the dates that they're coming. So um, I'm sure they'll want to uh, listen to the whole episode and maybe even go back and re listen to the episode. But I'm going to put on my stupid question hat now and ask how do you know when a new rule or amending a rule is necessary? I mean you're always trying to keep one step ahead of the bad guys and how easy is it to get a rule change implemented?

Speaker B: Thank you. So as I mentioned before, you're right. We're always trying to move forward with anything necessary to promote innovation, but also balancing that with the risk, uh, mitigation and the input for rule changes can come from various different uh, avenues. It can be um, from some of our committees. We've got a rules and operations committee made up of members that meets monthly, the Payments and Innovation alliance that I mentioned before. They will sometimes work on projects that end up in recommendations. It can be as we're out and uh, attending and speaking at conferences and hearing the feedback from the industry. So we are constantly listening and we keep that information in mind. And so wherever it comes in from the first stop that it always makes is our rules and operations committee. And so as I said, that's made up of members from various different types of industries and sizes, financial institutions, end users, vendors, etc. And so they will hear what we're presenting, they will Vote on it and make a determination as to whether or not we move forward. And then we do have a rather specific process for rulemaking at nacha, and it is a public process. So depending on where we're starting from, we may need to do what's called a request for information, which is a proposal we put out to the public saying we're thinking about something, but we need some additional information from you to help us further craft that proposal. That isn't always needed, you know, sometimes done, but not 100% of the time. Once we get that information, or if we feel like we're starting with enough information to draft a fully formed proposal, um, with drafted rule language, et cetera, then we go out with what's called a request for comment. And once again, this is put out to the public through our website, where we describe our proposals and our drafted rule language. And we do a lot of promoting of the fact that this is out there and available, because the best rulemaking really is done when we can hear from all different types of participants. Once that comment period is closed, it depends. It can be anywhere from, excuse me, 30 to 90 days, depending on how complex the proposal may be. We take all of that input from the industry and we analyze it, we report it back to our Rules and Operations Committee, and we make any necessary adjustments. Also working with another committee that we call our Software Information Exchange Group, which is made up of a lot of the large, uh, software providers, um, and we get their input all throughout the. The proposal drafting process, basically, to be fair, to make sure we're not breaking anything and that our implementation dates that we're suggesting are viable according to their calendars, etc. And so if necessary, if the changes that have been requested are very significant, we may go back out for comment again. Otherwise, then we move forward into a balloting process where the NACHA members then vote to move that change forward or not. And if it gets approved, then we are in the process, um, that I just mentioned for the. Some of those rules that got passed last week, where we just launch right into education, um, really trying to reach the financial institutions and the vendors, help them have tools to push that information down, as well as talking to the end users.

Speaker A: So rules are always under consideration and those rules actually shape how ACH payments operate. Operate. It's not like you're not doing enough already. But are there any under consideration right now? Because it seems like with new technologies coming at us fast and furious, rules would be needed to adapt or quickly take advantage of those technologies.

Speaker B: Absolutely. And like you said, we're very lazy here. Um, but we do have uh, a good list of things that we're looking at uh, moving forward either through the rest of this year, um, but most likely most of them coming early next year. So we're looking at things like increasing the same day ACH dollar limit up from a million dollars per transaction based on requests heard from the industry. We're also looking at the potential need for some rule changes around bringing exception processing and the documentation exchange process around exception processing into more secure electronic channels. Um, so again this is, you know, another risk mitigation factor, trying to make sure that we don't still have pieces of paper flying around, you know, with PII on them and really encouraging the newer channels that are available for the secure exchange of this type of information. We're also um, working on a proposal uh, that really is not a sign, is not a change, but it is a clarification to the rules to call specifically those characters and extended characters that are accepted in the ACH network right now. It's kind of a vague reference to a couple of different standards. And what we're working on with our operators, um, is something we've heard from the tech side is, is very needed, which is just tell us exactly what, what the characters are. And then finally we will be putting out another phase of risk management topics that could be looking at authorization and data security requirements around pay by bank. So we've got a group in that payments innovation alliance that's doing some analysis on any gaps that may exist so that could come out of that group. Looking at rules that may be needed around third party receivers. Also looking at first party fraud, administrative return thresholds for ACH credits like we have currently for debits, potentially some more work around return reason codes and having a return reason code, um, with a longer time frame for questionable entries. And then also how can we um, really touch on our third pillar of this risk management concept which is around communication. Some of those tools that I mentioned that we implemented in October help with that communication. But we want to go to the next level and figure out how can participants better share information around questionable transactions to really help the industry as a whole. So a lot of exciting things for folks to keep their eyes peeled for by first quarter or next year.

Speaker A: Well, I'm assuming, which I'm not supposed to do, that data has a big impact on NACHA and how it does its work. Are new technologies helping you analyze and use data better and smarter? And uh, what effect can better data use eventually have on how the ACH network operates.

Speaker B: From Nacha's perspective, again, we don't view the actual transactions themselves, but this is something that we've been talking about to financial institutions, vendors, originators about the core of these um, risk management rules coming in, uh, for monitoring in 2026 really has to do with understanding what is quote unquote normal behavior for your customer, whether that's on the transaction sending side, origination as we call it, or on the transaction receiving side. And again this is applicable for vendors, FIS businesses, et cetera. And I think what AI can help us do is give us some more computing power potentially to allow us to determine what this quote unquote normal activity or what a normal pattern should be. Therefore helping us to better recognize when something abnormal is happening, which lends itself directly into the requirements for the processes and procedures to potentially identify questionable transactions. So while on the bad guys side, AI is also helping them potentially trick more people into falling for their schemes. I think, you know, we're having these conversations with FIS and providers about how on the flip side it can help us better understand our uh, customers expected activity.

Speaker A: Well, you've been at this a long time and you've seen how electronic payments has evolved. What's kind of your personal impression of the space as it stands right now? Are you wowed? Are you expecting major improvements? Are you optimistic but cautioned? Do you think it's a field fraught with danger? Where are you at?

Speaker B: Definitely not fraught with danger. I am very optimistic. I have been in this space for quite some time. Um, and I think from the consumer side what we're really seeing is still a good amount of strong growth. But truly I think consumers don't really care about how their transactions get processed. They just want to say, I want this amount to this place and it needs to be there by this specific time. However that gets figured out, as long as they still have um, the necessary coverages that they're expecting, I think that that is, you know, not top of mind for consumers. But we're really seeing, um, you know, over the last five years, really ever since the pandemic, we're seeing a lot of changes in the B2B space. We have been at double digit growth for B2B over you know, every quarter for the last, uh, five years, like I said. And so this is where I think the excitement stands right now, is moving businesses continually away from the paper processes and seeing how they're able to take advantage of the different kinds of technologies, but also going through the process of analyzing their use cases and figuring out what fits best for them. I have always believed that payments are uh, they're a universe, right. They're not just one thing. And so there's room for everybody within that universe because you're going to have these different use cases, different requirements for carrying information, different uh, requirements for how soon a transaction may need to arrive, the capability to explain the expectations of what you're happening from those payments. And I think that that's really where the excitement is right now. So I think that it's fortuitous that we're also at the same time going through some of these risk management rules so that we can teach at the same time that we're onboarding more and more new B2B folks into the electronic payment space. They're also learning at the same time about the risk management. So I'm very optimistic about that and excited.

Speaker A: Do you still carry cash?

Speaker B: So that's a funny question. I am um, pretty bad about that. I've always said that I only carry cash when I travel. But more and more with so many things moving over, uh, you know, the Uber and all of that, it's, I really have to make a very conscious effort to remember to get cash.

Speaker A: Yeah, well that's why the electronic payments thing is happening. But uh, institutions, a lot of our listeners, they do have to stay compliant with ACH transactions and that can sometimes be challenging. What do you think some of the challenges they face are and how is NACHA kind of trying to help them out?

Speaker B: So I think some of the challenges that they face are around education. Internal education is the first piece there talking about all the different areas even within the financial institution that needs to understand um, with these risk management rules. We've made some points about how a lot of these functions are actually being done within the financial uh, institution but perhaps in more of an aml, um, a BSA area and it's not being communicated across two operations. And so I think communication within a large institution is always a challenge and then communication with your third party senders or your account holders and just trying to you know, stay on top of clearly you know, a uh, lot of changes that come out. And so one thing I will call out is that we do have on our website a an email to sign up for NACHA Rules, news and risk management tools. This is not marketing, it is nothing uh, you know, salesy about. It truly is content that's created by the rules and risk team that allows for reminders, notifications, all of the good stuff around potential and upcoming rules. We also have been providing a lot more tools, um, one of which is a free end user webinar that financial institutions can refer their customers, whether they're vendors or so what we call third party senders or, or businesses to listen into. So I think it's really just the fact that everybody has so much to deal with. And outside of the financial institutions, if I'm in the business of selling widgets, I care m more about selling my widgets, but I can't forget about whatever my compliance requirements are. And that's where I think NACHA really tries to help with some of the educational tools that either can reach directly to those organizations or that fiscal and third parties can help to direct their customers too.

Speaker A: We talked about education, that's great. But wherever there are rules, there has to be some sort of enforcement or some sort of discipline. What's the process of enforcing all these rules? And what kind of shared accountability is needed between NACHA financial institutions and regulators?

Speaker B: So regulators are going to come in and they are going to audit and check against, um, you know, private system rules, which includes the NACHA operating rules. So I just did a session last week with a party, um, and fi and he made a very smart comment I thought, and he said, you know, one of the things that we did was go out and talk to our regulators and say, when you come in next year, what specifically are you looking for? And I think that was a really great idea. Um, when it comes to the enforcement from nacha, nacha kind of similar to how the card networks, um, operate as well. Nacha's enforcement is between the financial institutions. Our rules basically put the vast majority of liabilities and warranties on that odfi, the originating depository financial institution. Not to say that the RDFI doesn't also have its own set of rules as well. But, um, when something is reported to us or something has risen to the level that we have come to notice that that has to be fairly significant. Um, then we initiate what's called, um, a potential rules violation process. We will reach out to the financial institution and ask basically, hey, what is going on? This is the potential rules violation. Explain this to us. Provide us the information either from you or your customer. And once they explain, then we move into a process of determining, okay, is this a violation or no? If it is, then we need to have a remediation period. So there's a date in which usually 60 days in which folks are given to fix things. And then if they're not fixed. Then it starts moving down through the enforcement process where they may go in front of the rules enforcement panel that's made up not of NACHA implementation employees, but of industry folks that would determine any financial penalties up to and including even being kicked out of the network for those financial institutions. So when we're talking about vendors, third party service providers, third party senders, businesses, merchants, originators, you need to talk to your odfi, your financial institution, because your ACH origination contract is going to dictate any liability that that financial institution may pass back to you in terms of rules violations. So like I said, I uh, explained the process from nacha's perspective. Again, that just goes to the fis. But um, like I said, most likely there are going to be provisions in your contracts with your financial institutions that says if I'm dinged for this, then I have the ability to pass that back. And also even with these new rules around risk mitigation, you would want to be in contact with your third party sender or your ODFI to again know what they are expecting of you in terms of meeting these rule requirements.

Speaker A: You know, you've given so much good advice and good tips. What would your high level best advice be for financial institutions right now? Things that they should know. When you think about how can they stay ahead of compliance, how can they optimize, optimize their ACH products, how do they approach innovation and data use to offer next level customer solutions? Like what would your parting thoughts for

Speaker B: them be so high level? Again I would say try to sign up for things like our rules news, things that are going to deliver to you, um, the important information at a high level. Continue to move forward in understanding more about your customers business and their patterns and then also to keep your ear to the ground in terms of how risks are changing. Another one of the requirements in our 2026 monitoring rules is that those processes and procedures be kept up to date based on the changing risk factors. So nacha's website, through our risk resource center, as well as our reference page, we've got a lot of good different links to good sites such as things available out of the FBI, the financial regulators that are keeping lists of what the current threats are. And so having somebody that is keeping their ear to the ground in terms of the NACHA operating rules, has a copy of the NACHA operating rules and is also keeping their ear to the ground in terms of how they threats are changing will really help you to continue to take the information you're learning about your customers and protect them in the best way possible and protect yourself truly.

Speaker A: Well, Amy, thanks again for being a guest on our little show. Uh, here. If listeners want to find out more about you or Nacha, uh, what's the best way for them to do that?

Speaker B: Nacha's website, um, we have a LinkedIn page. I'm on LinkedIn, but I would also mention that Nacha has, has a YouTube channel. And we keep very short and concise videos out there that help to promote a lot of what's going on. And so I hope to see you out there.

Speaker A: Well, great. We'll put links to all that in the show notes and for our listeners, not that you're forgetful, but just go ahead and subscribe to the show now. We'll reward you with smart people like Amy. And if you want to see how aggregated financial data might be of great use in your business, visit resources.yodlee.com podcasts and we'll see you next time on, uh, Data Driven Finance.