2018 National Automated Clearing House ACH Association Rules

2018 National Automated Clearing House (“ACH”) Association Rules Michael Lopes Senior Internal Auditor MEMBER OF ALLINIAL GLOBAL, AN ASSOCIATION OF LEGALLY INDEPENDENT FIRMS © 2018 Wolf & Company, P. C.

Before we get started… • Today’s presentation slides can be downloaded at www. wolfandco. com/webinars/2018. • The session will last about 45 minutes, and we’ll then have time for Q & A. • Our audience will be muted during the session. • Please send your questions in using the “Questions Box” located on the webinar’s control panel. 2

About Wolf & Company, P. C. • Established in 1911 • Offers Audit, Tax, and Risk Management services • Offices located in: – – Boston, Massachusetts Springfield, Massachusetts Albany, NY Livingston, NJ • Over 200 professionals As a leading regional firm founded in 1911, we provide our clients with specialized industry expertise and responsive service.

Financial Institution Expertise • Over 45 Risk Management Professionals: – – IT Assurance Services Group Internal Audit Services Group Regulatory Compliance Services Group Wolf. PAC® Solutions Group • Provide services to over 300 financial institutions: – Approximately 85 FIs with assets > $1 B – Approximately 40 publicly traded FIs – Constant regulatory review of our deliverables • Provide Risk Management Services in 27 states and 2 U. S. territories 4

Meet Today’s Presenter Michael Lopes Senior Internal Auditor Phone: 617 -261 -8198 Email: mlopes@wolfandco. com

Today’s Agenda • ACH Rule Changes – 2017 Rule Changes Overview – 2018 Rule Changes – Proposed Rule Changes • Common Issues & Best Practices – – – ODFI’s / ODFI Return Monitoring ACH Risk Assessment Returns Training Missing Procedures 6

2017 ACH Rule Changes • September 15, 2017 – Same Day ACH Phase 2 • September 29, 2017 – Third Party Registration 7

What happened in 2017? Same Day ACH Phase 2 • With Phase 2 implementation, the addition of debits expands eligibility further – Same Day ACH debits will support use cases such as bill payment, account-to-account transfers, check conversion, business-to-business, and e-commerce payments – Prenotifications for future debit Entries and Reversals of credits will be eligible for same-day processing – Effective date: September 15, 2017 8

Potential Issues • Potential Issues with Same Day ACH Phase 2: – Early posting of debits • ARC, BOC, and POP transactions – Problems: Customer Expectations • Far more SDACH returns – How will you process? • Throughout the day or end of day? – What if a debit overdraws the account in the AM and a Credit is made in the PM? • Would you have already returned the AM transaction? 9

The Benefits • Moving payments faster – – Can now process same day credit and debits. SDACH restrictions do not apply for returns. There is no fee for SDACH returns You CANNOT return a debit that settles next day 10

Third Party Sender Registration Q: Who will this rule apply to? A: Every ODFI will be required to either register its Third-Party Senders, or state that it has no Third-Party Senders. 11

Third Party Sender Registration Q: Is this registration model the same as what is already used with Direct Access Registration? A: Yes, in fact, NACHA intends to provide both Direct Access Registration and Third-Party Sender Registration via a single platform because many ODFIs that have neither Direct Access customers or Third-Party Senders could attest to both at one time. 12

Third Party Sender Registration Requirements: • Initial basic registration information • Supplemental Registration • Enforcement 13

Third Party Sender Registration For ODFIs with Third-Party Sender customers, the Rule will require the ODFI to provide a limited set of initial, basic registration information for each Third-Party Sender that the ODFI should already have in its records: – the ODFI’s name and contact information; – the name and principal business location of the Third-Party Sender; – the routing number (Specifically, the ODFI’s routing number as included in the Originating DFI Identification field) used in ACH transactions originated for the Third-Party Sender; and – the Company Identification(s) of the Third-Party Sender 14

Third Party Sender Registration Beyond the initial registration, upon written request from NACHA, an ODFI will be required to provide within 10 Banking Days the following information: – any doing-business-as names, taxpayer id number(s), and street and website address(es) of the TPS; – the name and contact information for the TPS contact person; – names and titles of the TPS principals; – the approximate number of Originators for which the TPS transmits entries; and – a statement as to whether the TPS transmits debit entries, credit entries or both. – 15

Third Party Sender Registration Q: What about “nested” Third-Party Senders (the situation when a Third-Party Sender has a third-Party Sender between it and the Originators)? Should they be registered and by whom? A: A Third-Party Sender must disclose to the ODFI the identity of any other Third-Party Sender for which it transmits entries to the ODFI, prior to transmitting entries for the other Third-Party Sender. A Third-Party Sender must provide the ODFI, upon the ODFI’s request, the information necessary for the ODFI to complete registration, within 2 banking days. 16

Third Party Sender Registration became effective on September 29, 2017. This date was when the Third-Party Sender registry became available for ODFIs to begin submitting registration information. This provided institutions with more than a year to be ready to register their Third-Party Sender customers. The implementation period lasted through March 1, 2018. 17

What’s Next for 2018? Same Day ACH Phase 3 • With Phase 3, RDFIs must make funds available for withdrawal by 5: 00 PM RDFI local time – Effective Date: March 16, 2018 18

Proposed Changes NACHA Request for Comment on proposals to: – Add a third Same Day ACH processing window that expands access to later in the day; – Provide faster funds availability to receivers of both Same Day and non-Same Day ACH credits; – Raise the per-transaction dollar limit on Same Day ACH transactions to $100, 000; – Explore the industry’s interest in ACH processing on weekends and holidays. 19

Proposed Changes NACHA Request for Comment on proposals to: – Add a third Same Day ACH processing window that expands access to later in the day; “Estimated” Processing windows – ODFIs to submit SDACH files until 5: 15 PM – RDFIs to receive SDACH files by 6: 00 PM – Funds available for withdrawal by end of processing day 20

Proposed Changes NACHA Request for Comment on proposals to: – Provide faster funds availability to receivers of both Same Day and non-Same Day ACH credits; New Funds Availability Windows – SDACH Credits: • First Window: Must be made available by 1 PM Local Time – Non-SDACH Credits: • Must be made available by 9 AM Local Time on the settlement date if the credit is received prior to 5 PM Local Time the previous banking day. • Must be made available by 1 PM Local Time on the settlement date if the credit is receive after 5 PM Local Time the previous banking day. 21

Proposed Changes NACHA Request for Comment on proposals to: – Raise the per-transaction dollar limit on Same Day ACH transactions to $100, 000; At the current dollar amount, approximately 98 percent of ACH transactions are eligible for Same Day ACH processing – An additional 1. 3% of ACH volume would become eligible for SDACH – For B 2 B payments, an additional 7% would become eligible 22

Proposed Changes NACHA Request for Comment on proposals to: – Explore the industry’s interest in ACH processing on weekends and holidays. Asking participants are there benefits for availability of ACH processing on weekends and holidays. – Currently, there is no interbank settlement of ACH transactions on weekends and holidays (not Federal Reserve banking days). What is the industry’s interest in, and what is the feasibility of, exchanging ACH transactions on weekend and holidays? 23

Common Issues & Best Practices 1. ODFI’s 4. Returns 2. ODFI Return Monitoring 5. Training 3. ACH Risk Assessment 6. Missing Procedures 24

Common Issues & Best Practices • ODFIs – – – Contracts & Agreements Evaluating and approving exposure limits Reviewing exposure limits for originating customers Monitoring daily/multiple day exposure limits Prefunding ACH credit batches

Common Issues & Best Practices • ODFI Return Monitoring – Thresholds are not being tracked • 0. 5% Unauthorized Return Rule (R 05, R 07, R 10, R 29, R 51 & R 53) - Threshold • 3% Admin Return Rule (R 02, R 03 & R 04) - Level • 15% Overall Return Rule (All Return Reason Codes) - Level – Threshold – a limit that cannot be exceeded. – Level – Can be exceeded, but should be evaluated and researched. if surpassed – Are outside of compliance, and Originators are not being educated.

Common Issues & Best Practices • ODFI Return Monitoring – How do we calculate? • Dividing the number of debit Entries returned as unauthorized for the preceding sixty days or two calendar months by the total number of debit Entries contained within the ACH File(s) in which the original Entries were transmitted; or • Dividing the number of debit Entries returned as unauthorized for the preceding sixty days or two calendar months by the total number of debit Entries originated for the preceding sixty days or two calendar months, respectively.

Common Issues & Best Practices • ACH Risk Assessment – Performing annual risk assessment – Presenting to the Board for approval • Returns – Stop payment vs. unauthorized/revoked transaction – Ensuring proper documentation is obtained – Properly handling unusual returns such as commercial credits/debits (CCD and CTX) 28

Common Issues & Best Practices • Training – A best practice recommendation – Employees & ODFI Customers involved in the ACH process should receive training at least annually, or have information readily available. – Common Issues: Training is not provided and rules changes go unaddressed

Common Issues & Best Practices • Policies and Procedures – Common missing procedures include: • Retaining ACH records • Handling death notification entries (DNE) and government reclamation • Handling destroyed check entries • ODFIs request for written statement

Additional Resources • www. nacha. org • www. achrulesonline. org • www. neach. org • https: //web. nacha. org/system/files/resource/2 017 -11/Same-Day-ACH-Guidance-Local-Time -April-13 -2017. pdf 31

Questions?

Thank you Michael Lopes Senior Internal Auditor Phone: 617 -261 -8198 Email: mlopes@wolfandco. com