Third-Party Sender Registration
DEADLINE for initial registration is March 1, 2018.
This rule requires Originating Depository Financial Institutions (ODFIs) to identify and register their Third-Party Sender customers. The registration process promotes consistent customer due diligence among all ODFIs, and serves as a tool to support Nacha’s continuing efforts to maintain ACH Network quality.
Register your Third-Party Sender customers here.
Details
Initial Registration
For ODFIs with no Third-Party Sender customers, the Rule will require the ODFI to acknowledge this in a statement to Nacha. Nacha will provide a simple means through the registry to make such a statement.
For ODFIs with Third-Party Sender customers, the Rule will require the ODFI to provide a limited set of initial, basic registration information for each Third-Party Sender that the ODFI should already have in its records:
-
the ODFI’s name and contact information;
-
the name and principal business location of the Third-Party Sender;
-
the routing number (Specifically, the ODFI’s routing number as included in the Originating DFI Identification field) used in ACH transactions originated for the Third-Party Sender; and
-
the Company Identification(s) of the Third-Party Sender.
The registration requirement will apply to Third-Party Senders that are the ODFI’s direct customers, as well as those other Third-Party Senders that are direct customers of the first Third-Party Sender, otherwise known as “nested” Third-Party Senders. To aid ODFIs in collecting registration information, the Rule obligates Third-Party Senders to provide their ODFIs, upon request, with any registration information needed. Further, in order to aid ODFIs with due diligence regarding nested Third-Party Sender relationships, the Rule requires Third-Party Senders to disclose to their ODFIs any other Third-Party Senders for which they transmit ACH entries.
Supplemental Registration
Beyond the initial basic registration information, it may become necessary for Nacha to receive additional information about a Third-Party Sender. The Rule provides that, upon receiving a written request from Nacha, an ODFI will be required to provide within 10 Banking Days any or all of the following information that is requested:
-
any doing-business-as names, taxpayer identification number(s), and street and website address(es) of the Third-Party Sender;
-
the name and contact information for the Third-Party Sender’s contact person;
-
names and titles of the Third-Party Sender’s principals;
-
the approximate number of Originators for which the Third-Party Sender transmits entries; and
-
a statement as to whether the Third-Party Sender transmits debit entries, credit entries or both.
Nacha would be authorized to request this information regarding risk events, which the Rule defines as “cases in which it (Nacha) believes that a Third-Party Sender in the ACH Network poses an escalated risk of (i) financial loss to one or more Participating DFIs, Receivers or Originators, (ii) violation of the Rules or Applicable Law, or (iii) excessive Returns.”
Technical
The Rule will become effective on September 29, 2017. This will be the first date for which the Third-Party Sender registry will become available for ODFIs to begin submitting registration information. Many ODFIs will be focused on going live with Phase 2 of Same Day ACH in the time period leading up to that effective date of September 15, 2017; therefore the effective date after the go-live date for Phase 2 of Same Day ACH.
With this effective date, ODFIs will have more than a full year to be ready to register their Third-Party Sender customers. In addition, Nacha will provide ODFIs with an implementation period to submit initial registration information, or to provide statements that the ODFIs have no Third-Party Sender customers, in order to allow for implementation to be spread out across a reasonable time period. The implementation period will last through March 1, 2018.
The following changes to the technical language represent modifications to the Nacha Operating Rules:
-
Article Two, Subsection 2.15.1 (Third-Party Senders’ Provision of Information to ODFIs) – Creates obligations of Third-Party Senders to provide ODFIs with information necessary for registration, and to disclose to the ODFI the identity (ies) of any nested Third-party Sender(s)
-
Article Two, Subsection 2.17.3 (Third-Party Sender Registration) – Creates a new subsection for the Third-Party Registration data requirements
-
Appendix Eight, Part 8.4 (Audit Requirements for ODFIs, Third-Party Service Providers and Third-Party Senders) - Adds an audit item verifying that the ODFI has registered and updated information on its Third-Party Senders
-
Appendix Ten, Subpart 10.3.1 (Direct Access Registration) – Modifies the subpart title only
-
Appendix Ten, Subpart 10.3.2 (Third-Party Sender Registration) – Adds a new subpart to address rules enforcement for Third-Party Sender Registration
-
Appendix Ten, Subpart 10.4.7.4 (Class 2 Rules Violation) – Adds failure of the ODFI to register its Third-Party Senders to the list of Class 2 Rules Violations
Impact
ODFIs: ODFIs with Third-Party Sender customers will incur some direct costs to assemble and report the required information to Nacha, and to update the registration information on a periodic basis. ODFIs already should have thorough records of their existing Third-Party Sender customers, and likely will have obtained the relevant information during the on-boarding of new customers; therefore, Nacha does not expect these costs to be significant. There may be some ODFIs, however, that will have to enhance their customer onboarding and monitoring processes, and obtain the required information; these ODFIs may experience higher initial costs to comply with the Rule. ODFIs with no Third-Party Sender customers will have only de minimus administrative costs to provide Nacha with a statement.
Third-Party Senders: Third-Party Senders likely will incur some direct costs to assemble and provide required information to their ODFIs. Because the information is basic in nature, Nacha does not expect these costs to be so significant as to outweigh the benefits of the Rule.
Originators, ACH Operators, and RDFIs: These Network participants are not expected to incur any direct costs associated with Third-Party Sender Registration.
FAQs Section
Q: What is the purpose of this Rule?
The purpose of this rule is to improve quality in the ACH Network. The registration process will promote consistent customer due diligence among all ODFIs, and serve as a tool to support Nacha’s continuing efforts to maintain ACH Network quality.
Q: Who will this rule apply to?
Every ODFI will be required to either register its Third-Party Senders, or state that it has no Third-Party Senders.
Why are there no exceptions to the registration, such as by volume or risk profile?
Exceptions to registration would lessen the effectiveness of the registry.
What if an ODFI knows a business is a Third-Party Sender with another ODFI, but as its own client the business only acts as an Originator?
The ODFI should register a business based on its own customer relationship. If the business acts as a Third-Party Sender with another ODFI, the other ODFI should register it.
What about “nested” Third-Party Senders (the situation when a Third-Party Sender has a Third-Party Sender between it and the Originators)? Should they be registered and by whom?
A Third-Party Sender must disclose to the ODFI the identity of any other Third-Party Sender for which it transmits entries to the ODFI, prior to transmitting entries for the other Third-Party Sender. A Third-Party Sender must provide the ODFI, upon the ODFI’s request, the information necessary for the ODFI to complete registration, within 2 banking days.
Is this registration model the same as what is already used with Direct Access Registration?
Yes, in fact, Nacha intends to provide both Direct Access Registration and Third-Party Sender Registration via a single platform because many ODFIs that have neither Direct Access customers or Third-Party Senders could attest to both at one time.
What information is included in the initial registration information?
An ODFI registering a Third-Party Sender would provide only the following, limited information about the Third-Party Sender:
-
The name and principal location (city, state) of the Third-Party Sender
-
The routing number (Specifically, the ODFI’s routing number as included in the Originating DFI Identification field) used in ACH transactions originated for the Third-Party Sender; and
-
The Company Identification(s) of the Third-Party Sender
What is the initial registration time period?
An ODFI would be required to register the Third-Party Sender within 30 days of transmitting the first entry on behalf of the Third-Party Sender. If an ODFI determines that an unregistered customer is actually a Third-Party Sender, the ODFI has 10 days to register the Third-Party Sender.
How should an ODFI handle updates to registration information?
An ODFI must update registration information within 45 days following any change. This time period allows an ODFI to provide regular updates within two weeks after the end of a calendar month.
What is a request for supplemental registration information and what information should be included?
ODFIs would be required to provide supplemental registration information when requested due to a risk event. A risk event is defined as an elevated risk of:
-
Financial loss to one or more Participating DFIs, Originators or Receivers
-
Violation of the Rules or other applicable law
-
Excessive levels of returns
When requested to provide supplemental registration information, the ODFI would be required to provide any of the following within 10 banking days:
-
The Third-Party Sender’s doing-business-as name, taxpayer ID, street address, and web site address;
-
The name, title, telephone number, and email address for a contact person at the Third-Party Sender;
-
The name(s) and title(s) of the principal(s) of the Third-Party Sender;
-
The approximate number of Originators for which the Third-Party Sender transmits entries; and
-
A statement as to whether the Third-Party Sender transmits debits, credits, or both
Would the Third-Party Sender Registration rule be subject to enforcement?
Yes, just as with any other rule, the existing enforcement approach and procedures would be used. This includes:
-
Risk investigation and Rules enforcement communications always begin with the ODFIs
-
ODFIs would have opportunity to respond, including whether alleged violation has been remedied
-
Nacha would have authority to sanction and/or fine ODFI for non-compliance. There are no automatic fines. Fines, if at all, occur at the end of the enforcement process.
Is there a cost to participants to register?
There is not an ODFI registration charge. The cost of implementing the registry will be covered by Network Administration Fees, which fund Nacha’s Network administration responsibilities at cost to the industry.
Are the consumer privacy protections in the Gramm-Leach Bliley Act (GLBA) applicable to the supplemental registration information that would be provided to NACHA, upon NACHA’s request?
The GLBA and Regulation P contain certain limitations on the sharing of nonpublic personal information received by certain financial institutions in connection with a consumer obtaining a financial product for personal, family or household purposes. Because ODFIs and Third-Party Sender relationships are commercial, and not consumer relationships, Nacha believes that Regulation P should not apply to sharing such information with Nacha. This is consistent with card network registration requirements for similar types of organizations.
What will NACHA do with the information?
This registry would be a foundational tool for ACH Network risk management and could be helpful in the following scenarios:
-
Provide baseline information on Third-Party Senders in the ACH Network
-
Identify instances in which a Third-Party Sender uses multiple ODFIs
-
Identify instances in which a Third-Party Sender is terminated by one ODFI but is registered by one or more other ODFIs
-
Facilitate risk investigations when necessary
What is the effective date? When will the registry be available?
The rule will become effective on September 29, 2017. This would be the first day that the registry will be available for ODFIs to begin submitting registration information and will provide ODFIs more than a full year to be ready. An implementation period through March 1, 2018 will be provided to spread initial registrations over a reasonable period before enforcement would take place.
What other education is available to understand Third-Party Sender relationships?
Nacha issued an Operations Bulletin ACH Operations Bulletin #2-2014: (ACH Transactions Involving Third-Party Senders and Other Payments Intermediaries) in December 2014 that is available on Nacha's website. In addition, an Online TPS Identification Tool can be found at https://www.nacha.org/third-party-sender-identification-tool
