Letter to Nacha on the ACH Risk Management Topics RFI

Maribel Bondoc
Manager, Network Rules
Nacha, The Electronic Payment Association
13450 Sunrise Valley Drive
Herndon, VA 20171

Thank you for the opportunity to submit feedback on the Request for Information on ACH Risk Management Topics issued on May 3, 2023. The American Bankers Association appreciates Nacha's efforts to protect the ACH Network and its efforts to seek feedback from industry participants on these issues. We are pleased to provide our comments on the four topics for consideration. ABA is providing these comments as guidance on the four issues discussed in the RFI. Recommendations to explore issues in greater detail should not be interpreted as endorsements of the proposal. ABA recommends that three of the four topics be considered worthy as proposed rules. As these issues become more refined as formal rule proposals and final rules, the specific requirements of each change become very important in determining if the cost of implementing the change is worth the benefit gained. At this stage, those details are not known.

Proposals

1. A New ACH Network Credit Return Threshold
   Should the Nacha Operating Rules establish a return rate threshold specific to ACH credits? Nacha should explore whether this change is warranted. It would be informative if Nacha could identify the size of ACH credit fraud in the network. If the size of credit fraud is defined and the potential to mitigate this fraud through a return rate threshold is promising, then it should be transformed into a formal rules proposal. The key is knowing the size of the fraud threat, the effectiveness of the proposed mitigating rule change, and the cost of implementation before proposing a rule change. This topic is worthy of additional research and may prove to be a beneficial risk management tool.
2. Define and Apply Rules to "Third-Party Receivers"
   Nacha should explore whether this change is warranted. It would be helpful if there were more data regarding "Third-Party Receivers" such as how many exist, how many transactions are they party to, and what is the dollar amount of these transactions? Like the first proposal, defining the size of the risk will help determine whether any proposed rule to mitigate that risk is worth implementing.
   
   The potential changes to the rules are quite large if they will be similar to the Originating Depository Financial Institution (ODFI) obligations regarding Third-Party Senders (TPS). The added burden of requirements concerning Rules compliance audits, risk assessments, and data security requirements are great, and they must be considered with any formal rule proposal. Gathering the additional data as to the size of the risk could prove could well demonstrate the need for an the change.
3. Risk-Based Approach to Early Funds Availability
   This proposal would affect the practice of some Receiving Depository Institutions (RDFIs) providing funds availability to customers before actually receiving from the ODFI. An RDFI could receive the PPD credit entry for a payroll payment on Thursday for credit and settlement on Friday and decide to grant the customer access to those funds immediately and in advance of actually receiving the payment.
   
   Financial institutions offering this service have determined that the competitive benefit of providing an enhanced service to their customer base outweighs the risk. The RFI suggests that Nacha could require that ODFIs conduct risk-based reviews to determine whether or not to offer this service that could include "...the establishment of policies, procedures and systems to assess risk, enforce eligibility/ineligibility, and report anomalies and violations."
   
   These are business decisions implemented by financial institutions and outside the scope of Nacha. Nacha should cease any rule activity in this area.
4. Create a New Notification of Change (NOC) for Standard Entry Class (SEC) Code/Account Type Mismatch
   Nacha should explore whether this change is warranted. Currently, NOCs are used when incorrect transaction codes or incorrect SEC Codes are used for internal payments. Creating a new NOC may be of help to mitigate risk if it informs the ODFI that the entry does not match account held at the RDFI.
   
   Nacha should compare the cost of implementing the rule change with any potential benefit if and when it makes a formal rule proposal. More information on the costs and benefits may make a proposed change even more attractive.

ABA would like to thank Nacha for the opportunity of responding to the RFI on Risk Management Topics. If you have any questions about these comments, please contact me at (202) 663-5147.

Sincerely,
Stephen K. Kenneally
Senior Vice President, Payments