As a senior consultant within Nacha’s consulting group, I observe that one critical area of non-compliance with the Nacha Rules is related to ACH authorizations. ACH authorizations are the foundation under which Entries may be transmitted through the ACH Network. They enable Originators to comply with the Nacha Rules and allow Originating Depository Financial Institutions (ODFIs) to meet their Nacha Rules warranties. Under the Nacha Operating Rules, a debit authorization to a consumer account must include seven essential pieces of information that an Originator needs to create a compliant authorization. Unfortunately, authorizations often do not contain all the required information.  

An Originator must provide a copy of the authorization to the consumer for their records and be able to provide proof of authorization to the ODFI upon request. An authorization must meet additional requirements, such as compliance with applicable legal requirements, be readily identifiable as an authorization, and have clear and understandable terms.  

I often observe a trend when reviewing debit authorizations for our clients, where the Originator’s authorizations do not fully comply with the requirements of the Nacha Rules. The authorization defines the terms of the agreement between the Originator and the Receiver, including when the Originator can debit the account, the amount they can debit, and other terms. It gives the Receiver information on how to revoke their authorization directly with the Originator, including the timing, and how to inform the Originator of the Receiver’s revocation of the authorization. It is a critical part of the origination process, and the ODFI should not be passive in it.  

Although the specific requirements for ACH authorizations typically apply to debit Entries, one should not forget that ACH credit Entries should also be properly authorized. The Nacha Rules don’t prescribe a specific format for the authorization; they do, however, state that compliance with any applicable legal requirements is required. It is often the best practice in the industry to obtain written authorization for these Entries, especially in the case of payroll. This may also be useful in addressing recent credit-push fraud trends as noted in the upcoming Nacha Rules changes.  

Without proper authorization, Originators risk debiting a Receiver’s account incorrectly, which could lead the Receiver to claim that the debit was not authorized or in conformance with the authorization at their financial institution. In addition, a breach of warranty related to proper authorization could also result in extended returns up to two years for consumers, plus the first 95 calendar days, and one year for non-consumers. (Note that the first 95 calendar days refer to the first Entry associated with the authorization that resulted in an error.) 

Under Regulation E, a consumer Receiver can provide an oral or written notice to its financial institution up to 60 days after the financial institution sends the periodic statement or provides the passbook documentation on which the error is first reflected. If the consumer provided oral notice, the financial institution may require the consumer to give written confirmation of an error within 10 business days of an oral authorization. The notice must include the consumer’s name and account number, indicate why the consumer believes an error exists, and, to the extent possible, the type, date, and amount of the error.  

When an Originator fails to have a compliant authorization, leading to an unauthorized or inaccurate debit entry, the consumer can quickly escalate the issue to their financial institution. This results in unauthorized returns to the Originator’s account, increasing the unauthorized return rate, an outcome that could have been prevented.  

Nacha Consulting provides expertise for all things ACH compliance, including ACH authorizations to consumer and business accounts. We can review Originator’s authorizations to ensure they comply with both the Nacha Operating Rules and Regulation E.  

Click here to schedule a free 15-minute consultation and learn more about how we can help with ACH authorization compliance.