In recent blog posts, Nacha has shared updates about our First-Party Fraud workgroup and suggested actions that ACH Network participants can take to help identify and mitigate first-party fraud. In many cases, of course, it won’t be immediately clear whether first-party fraud is occurring. The parties may disagree about whether a transaction was actually authorized by a Receiver who now claims that it was not. When a consumer Receiver is involved, how is a claim of unauthorized resolved under the Nacha Rules and under Regulation E? 

Under the Nacha Rules, a Receiver submits a Written Statement of Unauthorized Debit (WSUD) to the RDFI. The RDFI must accept a WSUD that meets the formatting requirements of Rule 3.12.4 and must “promptly” recredit the Receiver’s account upon receipt of a timely WSUD (Rule 3.11.1). “Promptly” is not defined in Rule 3.11.1, but in practice, has sometimes been interpreted to mean almost immediately, and regardless of any investigation by the RDFI as to whether the transaction was actually unauthorized.   

In contrast, Regulation E generally provides that when a consumer gives notice (not necessarily in writing) of an “error” to its financial institution regarding an electronic fund transfer, the FI must “investigate promptly” and determine within 10 business days whether an error occurred, then correct the error within one business day of determination.  12 CFR 1005.11(c)(1). If the FI can’t complete its investigation within 10 business days, it must give provisional credit to its customer and complete its investigation within 45 days (with additional time in certain circumstances, such as new account transactions).  12 CFR 1005.11(c)(2). Thus, Reg E also has a “prompt” standard, but defines it in terms of a few important concepts:  (1) the RDFI’s need to investigate the claimed “error” before recredit; (2) specified deadlines in number of days; and (3) linking the first deadline—10 business days—to provisional, rather than final, credit to the customer’s account. 

Nacha is exploring whether to clarify the term “prompt” in Rule 3.11.1 and its relation to the requirement that an RDFI sending a return must do so within six Banking Days of the completion of its review of the customer’s WSUD (Rule 3.13.1). But the fact that “prompt” is not currently defined in 3.11.1 should not be read as precluding an RDFI’s investigation under Reg E. For example, “prompt” recredit under the Nacha Rule can take into account the timing of provisional recredit obligations under Reg E, the status of any applicable investigation, and the existence of any indication of fraudulent intent by the accountholder.