Compliance Resources
Compliance Resources for Third-Party Senders
EPCOR Can Help You Maintain Compliance and Manage Risk
Third-Party Sender ACH Compliance Audit & Risk Assessment Services
Leverage our payments experts to meet your requirements to conduct an annual ACH Audit and periodic Risk Assessment to gain actionable insight into compliance, efficiency, risk management and more.
Request a Quote
Customizable Third-Party Consulting Services
Our payments experts can help you with understanding your compliance requirements, enhancing your risk management program, increasing efficiencies and more.
Request a Quote
Third-Party Sender ACH Audit & Risk Assessment Workbooks
If you prefer to conduct your own ACH Audit and Risk Assessment, our helpful workbooks will guide you through the process, document your level of compliance and provide a report of findings.
Explore Workbooks
EPCOR Membership for Third-Party Senders
Consider becoming an EPCOR member for ongoing assistance with payments compliance covering all payments channels – not just ACH! Membership includes Members-only pricing for services, access to EPCOR Industry Update webinars, a private Knowledge Community, our toll-free helpline for answers to ongoing payments questions and more!
Explore Membership
FAQs
Explore our FAQs to get answers to common payment questions. Subsection(s) referenced in the FAQs can be found in the ACH Rules.
ACH Originator Authorizations
Do Originators need to obtain an authorization from a Receiver to originate transactions into the ACH Network?
Generally, an Originator must obtain authorization from the Receiver to originate one or more entries to a Receiver’s account, except for credit entries for which the Originator and Receiver are both natural Persons. (Subsection 2.3.1)
Do authorizations need to be in writing for ACH transactions?
The Originator of a credit entry to a consumer account of the Receiver may obtain the Receiver’s authorization in any manner permitted by applicable legal requirements. (Subsection 2.3.2.1)
The Originator of a debit entry to a consumer account of the Receiver must obtain a written authorization that is signed or similarly authenticated by the Receiver. (Subsection 2.3.2.2)
Can authorizations be obtained electronically?
The writing and signature requirements for consumer debit entries may be satisfied by complying with the Electronic Signatures in Global and National Commerce Act (E-sign Act). An electronic authorization must be visually displayed in a manner that enables the consumer to read the communication. (Subsection 2.3.2.3)
At a minimum, what must an authorization for a debit entry to a consumer account of the Receiver include?
- Language regarding whether the authorization is for a single entry, multiple entries or recurring entries.
- Amount of entry/entries or a reference to the method of determining the amount.
- Timing (including start date), number and/or frequency of entries.
- Receiver’s name or identity.
- Account to be debited.
- Date of the Receiver’s authorization; and
- Language that instructs the Receiver how to revoke the authorization directly with the Originator (including time and way Receiver communication with Originator must occur).
- For a single-entry scheduled in advance, the right of the Receiver to revoke the authorization must afford the Originator a reasonable opportunity to act on the revocation prior to initiating the entry.
What are the authorization requirements for an oral authorization?
For a single-entry authorized by a Receiver, Originator must make an audio recording of the oral authorization or provide the Receiver with written notice confirming the oral authorization prior to settlement of entry and retain the original or a copy of the written notice confirming oral authorization for two (2) years from date of authorization. For a recurring entry authorized by the Receiver, Originator must comply with the requirements of Regulation E for the authorization of preauthorized transfers, including the requirement to send a copy of the authorization to the Receiver and retain for two (2) years from the termination or revocation of the oral authorization, the original or duplicate audio recording of oral authorization and evidence that a copy of the authorization was provided to the Receiver in compliance with Regulation E. For a standing oral authorization, Originator must make audio recording of oral authorization or provide Receiver with written notice confirming oral authorization prior to settlement of the first subsequent entry and retain the original or duplicate audio recording of oral authorization or the original/copy of the written notice confirming the oral authorization for two (2) years from termination or revocation of standing authorization. (Subsection 2.3.2.4)
Do Originators need to retain copies of authorizations?
Yes, an Originator must retain the original or a copy of each written authorization of a Receiver, or a readily and accurately reproducible record evidencing any other form of authorization. (Subsection 2.3.2.5 (a))
How long must an Originator retain authorizations?
An Originator must retain the original or a copy of each written authorization of a Receiver, or a readily and accurately reproducible record evidencing any other form of authorization, for two (2) years from the termination or revocation of the authorization.
With respect to a standing authorization, Originator must retain original or a copy of each standing authorization for two (2) years following the termination or revocation of the authorization, as well as proof that the Receiver affirmatively initiated each payment in accordance with the terms of the standing authorization for two (2) years following the settlement date of the entry. (Subsection 2.3.2.7)
Do Third-Party Senders have to supply a copy of an authorization to an ODFI?
Upon the request of an ODFI (Originating Depository Financial Institution), a Third-Party Sender must provide the original, copy or other accurate record of the Receiver’s authorization, including, with regard to a standing authorization, evidence of the Receivers affirmative action to initiate a subsequent entry in accordance with the terms of the standing authorization. Third-Party Sender must provide in such time and manner as to enable the ODFI to deliver the authorization to a requesting RDFI (Receiving Depository Financial Institution) within ten (10) banking days. (Subsection 2.3.2.7 2(c)
How does an Originator satisfy the authorization requirement for an ARC (Accounts Receivable Entry) or POP (Point-of-Purchase) entry?
By providing the Receiver with a conspicuous notice including the following or substantially similar language prior to the receipt of an Eligible Source Document (i.e. check):
“When you provide a check as payment, you authorize us either to use information from your check to make a one-time electronic fund transfer from your account or to process the payment as a check transaction.” Copy of notice must be provided to Receiver at the time of transaction. (Subsections 2.5.1.2 and 2.5.10.2)
How does an Originator satisfy the authorization requirement for a BOC (Back Office Conversion Entry) entry?
By providing the Receiver with a conspicuous notice including the following or substantially similar language prior to the receipt of an Eligible Source Document (i.e. check):
“When you provide a check as payment, you authorize us either to use information from your check to make a one-time electronic fund transfer from your account or to process the payment as a check transaction. For inquiries, please call (retailer phone number.)” Copy of notice must be provided to Receiver at the time of transaction. (Subsection 2.5.2.2)
ACH Prenotifications
As an Originator and/or Third-Party Sender, am I required to send a prenotification for an ACH entry prior to initiating the first live entry?
No, according to the ACH Rules you may originate a prenotification entry to a Receiver’s RDFI prior to the first transaction you send. (Subsection 2.6.1)
If an Originator and/or Third-Party Sender decides to send prenotifications, what is the timeframe they have before they can send subsequent entries?
An Originator and/or Third-Party Sender that has originated a prenotification entry may initiate subsequent entries as soon as the third banking day following the settlement date of the prenotification entry, provided the ODFI has not received a return or notification of change related to the prenotification. (Subsection 2.6.2)
Notification of Change
How long does an ODFI have to notify a Third-Party Sender that a Notification of Change (NOC) was received from the RDFI?
An ODFI must provide the Third-Party Sender with the NOC information within 2 banking days of settlement date of the NOC or corrected NOC. (Subsection 2.11.1)
Are Originators and/or Third-Party Senders required to make NOC changes when received from the ODFI?
Yes, an Originator and/or Third-Party Sender must make the changes specified in the NOC or corrected NOC within 6 banking days of notification receipt or prior to initiating another entry, whichever is later.
An Originator and/or Third-Party Sender may choose, at its discretion, to make changes specified in any NOC or corrected NOC received with respect to any ARC, BOC, POP, RCK and Single-Entry TEL or WEB.
For an NOC received in response to a prenotification, the Originator and/or Third-Party Sender must make the changes prior to originating a subsequent entry if the NOC is received by the ODFI by the opening of business on the 2nd banking day following the settlement date of the prenotification. (Subsection 2.11.1)
ACH Returns
How long does a business have to return an ACH transaction that is unauthorized?
It is important for businesses to watch their accounts closely as the RDFI has only 2 banking days from settlement date to return CCD and CTX transactions that post to a non-consumer account. The RDFI may request a copy of the authorization for the transaction and ask the ODFI to accept a late return but the ODFI is not required to take a late return. This would only be an attempt to the recover the money. The Originator and Receiver may also deal directly with one another to resolve the issue.
An Originator and/or Third-Party Sender is notified that an ACH transaction they originated has been returned R10. What does this mean for the Originator or Third-Party Sender?
This means the Receiver did not know the identity of the Originator or Third-Party Sender, had no relationship with the Originator or Third-Party Sender or did not authorize the Originator or Third-Party Sender to debit their account. For an ARC or BOC entry it means the signature on the source document (check) is not authentic, valid or authorized. For a POP entry it means the signature on the written authorization is not authentic, valid or authorized.
If an Originator has a valid authorization on file and receives an R10 return, can they reinitiate the entry?
If a consumer Receiver completes a Written Statement of Unauthorized Debit form, the RDFI may return a consumer transaction within 60 calendar days. The Originator or Third-Party Sender must not reinitiate the entry. The Originator can settle the matter with the consumer outside of the ACH Network or gain a new authorization and send another transaction through.
An Originator and/or Third-Party Sender is notified that an ACH transaction they originated has been returned R11. What does this mean for the Originator or Third-Party Sender?
This means the Receiver has a relationship and authorization for a debit with the Originator or Third-Party Sender, however; an error in the payment exists such that the entry does not conform to the terms of the authorization obtained from the Receiver. For example, the entry is for a different amount than authorized, the entry was initiated for settlement earlier than authorized, the entry is part of an incomplete transaction, the debit entry was improperly reinitiated and for an ARC, BOC or POP entry, the source document was ineligible, notice was not provided or the amount was not accurately obtained from the source document. It could also mean that a reversing entry was improperly initiated or the Receiver did not affirmatively initiate a subsequent entry in accordance with the terms of a standing authorization.
Is an Originator and/or Third-Party Sender allowed to reinitiate an ACH transaction that has been returned R11?
An R11 return does not require a new authorization, however; an Originator or Third-Party Sender may reinitiate an R11 return entry (other than an ARC, BOC, or POP) if the Originator or Third-Party Sender transmits a new entry that conforms to the terms of the original authorization.
ACH Origination
Why is it important for an Originator and/or Third-Party Sender to utilize the proper SEC (Standard Entry Class Code) code when originating transactions into the ACH Network.
Utilizing the proper SEC code is paramount for several reasons:
- Returns are based on SEC code. For example, a business originates a debit to another business for supplies they have shipped, and they use the PPD code. This transaction should be coded as a CCD. Since the PPD code was utilized, the business Receiver of the transaction now has 60 days to dispute the transaction as unauthorized versus the 2 days for a CCD transaction.
- There are different authorization requirements depending on the SEC code. Utilizing the correct SEC code for a transaction tells the RDFI what type of authorization was obtained.
- When your company signed an ODFI/Third-Party Sender agreement you agreed to originate certain SEC codes based on that agreement.
Reversing Entries (Section 2.9)
How must an Originator and/or Third-Party Sender initiate a proper Reversing Entry?
An Originator and/or Third-Party Sender may initiate a reversing entry to correct an erroneous entry previously initiated to a Receiver’s account. An authorization is not required for a reversal entry if all the requirements of Section 2.9 of the ACH Rules are followed.
Appropriate Reason to Send a Reversal (Subsection 2.9.1)
|
Must Not Use Reversal Process (Subsection 2.9.5)
|
| Duplicate file or entry |
Failed to fund entry*
- Originator
- Third-Party Sender
|
| Payment in wrong amount |
Outside of 5 banking days of Settlement Date of erroneous entry |
| Payment destined to wrong Receiver |
*Effective 6-30-21 |
| Employee received both a separation check and a direct deposit |
| Error in Effective entry date* |
For each reversing entry, the content of the following fields must remain unchanged from the original, erroneous entry to which the Reversal relates:
- Standard Entry Class Code
- Company Identification/Originator Identification; and
- Amount
The description “REVERSAL” must replace the original content of the Company Entry Description field within the file format transmitted in the original batch, including content otherwise required by the ACH Rules.