QUESTION
In revising our EFT
policy, we want to be sure we have sections for all the areas involving ACH
transactions. Also, we want to begin the policy with the types of information
that must be disclosed to a consumer or financial institution. What are the
areas involving ACH transactions? Also, what types of information must be
disclosed?
ANSWER
The
Electronic Fund Transfer Act (EFTA) establishes the rights, liabilities, and
responsibilities of consumers and financial institutions as they relate to
electronic fund transfers. Its implementing regulation is Regulation E, which is updated and enforced by the Consumer Financial
Protection Bureau (CFPB). An automated clearing house or ACH transaction takes place in an
electronic network for financial transactions, such as credit transfers and
direct debits.
Certain ACH transactions fall under Regulation E’s
definition of “electronic fund transfers.”
The ACH transactions that are subject to Regulation E are:
- Prearranged payments and deposits (PPD);
- Point-of-purchase entries (POP);
- Accounts receivable entries (ARC);
- Internet-initiated/mobile entries (WEB);
- Telephone transfer entries (TEL);
- Machine transfer entries (MTE);
- Point-of-sale (POS);
- Shared network transaction (SHR); and,
- Consumer-to-consumer or consumer-to-business international ACH transactions (IAT).
It should be noted, though, that Regulation E covers many
types of electronic fund transfers, not just ACH transactions. Other types of
electronic fund transfers addressed in Regulation E include telephone transfers
(non-ACH), transfers made at point-of-sale terminals (non-ACH), automated
teller machine (ATM) transfers, and debit card transfers. This section focuses
on Regulation E as it applies to ACH transactions.
Generally, the rule or regulation that provides the greatest
protection to the consumer is the one that takes precedent. In cases where
there is an overlap between Regulation E and the ACH Rules, a comparison is
usually made to provide clarification as to how each one applies and to
indicate which one takes precedence.
With respect to the
types of information that mandate disclosure, certain
information must be disclosed to consumers by their financial institutions
prior to the first ACH debit or credit transaction that ever posts to the consumers’
accounts. The information may be provided in a document along with other
disclosure information that must be supplied to the consumer, or it may be
provided as a separate document. I’ve seen both methods in active use.
The receiving
depository financial institution, or RDFI, is the financial institution
qualified to receive ACH entries. These institutions are required to abide by
the NACHA Rules, the rules of the National Automated Clearing House Association.
The RDFI interlinks the receiver's account with the card association network.
The RDFI
has no way of knowing when an ACH debit or credit might be received, so our clients' ACH
policies usually state that it is best to give consumers this information at the time they open an account.
At a minimum, the
RDFI must provide the following information:
- A summary of the consumer’s liability when unauthorized ACH transactions are posted to his or her account;
- A contact phone number and/or address for reporting unauthorized transactions that appear on the account;
- A definition of “business days” for the financial institution;
- What types of transfers are allowed and whether there are limitations on either the dollar amount of the transfers or the number of transfers;
- Fees that may be charged for ACH transactions;
- Summary of the consumer’s right to receive receipts and periodic statements;
- Summary of the consumer’s right to place a stop payment on an ACH transaction and the procedure the consumer must follow to place the stop payment;
- The financial institution’s liability if it fails to stop payment or fails to make a certain transfer; and,
- The error resolution process the financial institution will follow when an unauthorized ACH transaction is reported. Note: The error resolution process needs to be provided not only initially, but also annually unless it is printed on every periodic statement.
Jonathan Foxx, PhD, MBA
Managing Director
Lenders Compliance Group
