Automated House (ACH) Key Facts & Responsibilities for ACH Originators

Originator Guide

July 2020

1

Contents Summary ...... 3 ACH Legal Framework ...... 3 Your Responsibilities as an ACH Originator...... 3 Industry Best Practices ...... 4 File Delivery Deadlines & Cutoff Times ...... 4 Direct Payroll Authorizations (Consumer) ...... 4 Debit Authorizations (Consumer) ...... 4 Corporate Authorizations ...... 5 Changing Date or Amount of Debits ...... 5 Pre-Notifications ...... 5 Notifications of Change (NOC) ...... 5 Returns ...... 6 Reversals ...... 8 OFAC (Office of Foreign Asset Control) ...... 8

2

Summary

The ACH Network provides for to bank clearing of electronic payments. It is governed by The NACHA Operating Rules and Guidelines (Rules), and these rules apply to all entries and data transmitted through the ACH Network.

As an ACH Originator, you are required to comply with and are bound by the Rules. All ACH Originators must have to a current copy of the Rules to ensure compliance. The ACH Rules for Corporate Originators are published annually and may be ordered for a cost at wespay.org/public under the resources tab, online store. The publication is offered in a variety of formats including printed and electronic versions.

East West Bank (the Bank) is providing this guide as a brief summary of ACH Facts and ACH Originator Responsibilities.

ACH Legal Framework

• An ACH originator is any entity or person that creates an ACH transaction. • ACH entries are categorized as “consumer” or “corporate.” • ACH is capable of crediting or debiting checking or savings accounts. • ACH entries are received by most financial institutions. • ACH is a batch system (not real time). • ACH entries are irrevocable once they have been submitted and approved for processing. • ACH stop payments no longer have an expiration date as of March 2010.

Your Responsibilities as an ACH Originator

As an ACH Originator, you are required to abide by multiple rules and agreements when initiating ACH transactions. Below is a list of key items: • NACHA Operating Rules – Visit nacha.org for details • Regulation E (“Reg. E”) – Federal regulation providing protections to consumers (NACHA rules comply) • UCC4 – Uniform Commercial Code Section 4 targets corporate transactions (NACHA rules comply) • Global Transaction Services Master Agreement • East West Bank Corporate Agreements, if applicable • Authorizations from employees, customers, etc. . Originators are required to provide proof of authorization upon request for any credit or debit entries submitted to the network.

3

Industry Best Practices

Listed below are the Industry best practices you can follow to ensure compliance with the above rules and regulations: • Depending on the transaction type, i.e. consumer or commercial, obtain proper authorizations and retain for two years past revocation. This is also the case with standard entry class code TEL if applicable. • If requested, you must provide a copy of the authorization. We may request to see your authorizations during the two-year period as part of a required annual audit. • Send entries on the proper date. • Give appropriate notice to receiver if changing amount or date of the transaction. • Cease subsequent ACH entries once notified by receiver. • Make necessary changes to payee account information within three (3) business days upon receipt of a Notification of Change or before another entry is sent. • Check payees against OFAC checklists: sanctionssearch.ofac.treas.gov/ • Protect banking information received for the purpose of originating ACH transactions. • Ensure your computer and you are protected as outlined in the Bank’s Master Services Agreement. • Ensure the Originator is clearly identified as the source of the ACH transaction. Specifically, populate the Company Name Field of the NACHA formatted file with a name known to and readily recognized by the Receiver of the entry.

File Delivery Deadlines & Cutoff Times All transmissions to the bank must be completed by the established Cutoff Times in order for processing to take place on the same business day. Any transmission completed and received by the bank after such Cutoff Times or on any non-business day, will be processed on the following Business Day.

Direct Deposit Payroll Authorizations (Consumer)

• Use a authorization form that collects employee account information. This form should allow the company to make credit and debit entries in the event a payroll adjustment is necessary. (The “Appendix” section of the NACHA rules includes a sample authorization form) • Obtain a voided check from the employee, if possible. • The most common Standard Entry Class (SEC) code for direct deposit is PPD.

Debit Authorizations (Consumer)

• For consumers, an authorization to debit an account must be in writing or “similarly authenticated.” • The most common SEC code for consumer debits is PPD.

4

Corporate Authorizations

• For companies, there must be a record of an agreement between the two parties. • The most common SEC codes for corporate transactions are CCD or CTX, depending upon the number of addenda included in the payment. Both SEC codes are used for debits and credits.

Changing Date or Amount of Debits

• ACH Rules require you to notify ACH recipients of any changes in date or amount debited under the following circumstances:

o Seven (7) calendar days’ notice for a change of date (consumer and corporate). o Ten (10) calendar days’ notice for a change in amount (consumer only). • Sending the notice via U.S. Mail is acceptable.

Pre-Notifications

• Pre-notes are zero-dollar entries that precede the first live entry. The purpose of a pre-note is to verify account information. • Although optional, if you elect to send a pre-note, rules require that a pre-note must precede the first live entry by at least three (3) business days. • The Receiving Bank is not required to validate the name of the payee on the pre-note, although many do. Receiving are only required to review the account number.

Notifications of Change (NOC)

NOCs are created by the Receiver’s to notify the originator that information in the previous transaction sent needs to be updated. The information must be updated or corrected before the transaction is originated again. The Bank will notify you if any NOCs are received for any of your transactions. Some of the more common reasons for initiating an NOC are:

• Previously valid information in an ACH entry (Direct Deposit/Direct Payment) is now outdated and needs to be changed. • Information in an ACH entry (Direct Deposit/Direct Payment) is erroneous and needs to be corrected. • Banks have elected to consolidate routing numbers and want originators to use a different one.

The Receiving Bank warrants that the Information they provide in a notification of change which they would like updated is correct.

ACH Rules require the originator to make changes or corrections within three (3) business days of receiving the notification of change before another entry is sent. The Bank may pass along any fines incurred based upon your non-compliance.

5

Notification of Change (NOC) Codes (most common) NOC Code Reason Description

C01 Account Number Account number is incorrect or is formatted incorrectly.

C02 Transit/Routing Number Due to a merger or consolidation, a once valid routing number must be changed.

C03 Transit/Routing Number and Due to a merger or consolidation, a once valid transit/routing Account Number number must be changed, and the account number structure is no longer valid.

C05 Transaction Code Transaction code is incorrect, and this is causing the ACH entry to be routed to the wrong application (demand or savings).

C06 Account Number and Account number is incorrect or is formatted incorrectly and the Transaction Code transaction code is incorrect causing the ACH entry to be routed to the wrong application (demand or savings).

C07 Transit/Routing Number, Due to a merger or consolidation, a once valid transit/routing Account Number and number must be changed, the account number structure is no Transaction Code longer valid, and the transaction code is incorrect causing the ACH entry to be routed to the wrong application (demand or savings).

C09 Individual Identification The individual id number was incorrect. Number C13 Addenda Format Information in the Entry Detail Record was correct, and the entry was processed and posted by RDFI. However, information found in the addenda record was unclear or was formatted incorrectly. Typically for a CCD transaction.

Returns

Returns must be processed by the Receiving Bank within 24 hours of settlement. Returns that are unauthorized beyond the 24 hours are the company’s liability and any disputes may have to be settled outside of the banking network. Review your account activity daily. • An exception to the 24-hour rule is consumer unauthorized returns, which may be returned within 60 days of posting. • The use of consumer (PPD) or corporate (CCD) entry codes determines the applicable ACH return rules. • If the Receiving Bank is presented with a claiming a debit was unauthorized, the Receiving Bank must obtain a signed Written Statement of Unauthorized Debit from the account holder. • You may re-initiate a debit entry to two times if (1) the entry has been returned for insufficient or uncollected funds (Return Reason Code R01 and R09), (2) the entry has been returned for stopped payment and re-initiation has been authorized by the Account Holder, or (3) the Bank has taken corrective action to remedy the reason for the return. • A “Stop Payment” return may be re-initiated only if you receive approval from the payee to re-send the item. • It is a violation of NACHA Rules to re-initiate the debit entry if a return is received for any other reason. • Disagreements regarding authorization should be handled OUTSIDE of the ACH Network. • Originators must maintain a return rate below .5% for entries returned as unauthorized. • Originators can have no more that 3% of your total debit entries returned due to administrative or account data errors. 6

• Originators can have no more than 15% of your total debit entries returned for any return reason.

Return Entry Codes (most common)

Reason for Return Action by Originator Available Return SEC Codes Deadline R01 – Insufficient Funds Originator may initiate a new ACH entry ALL 24 HOURS within 180 days of original Settlement date. R02 – Account Closed Originator must stop initiation of entries ALL 24 HOURS and obtain an authorization from the Receiver for another account. R03 – No Account / Unable to Originator must stop initiation of entries ALL 24 HOURS Locate and contact the Receiver for correct account information. R04 – Invalid Account Originator must stop initiation of entries ALL 24 HOURS until account number / structure is corrected. R05 – Unauthorized Debit to Originator must stop initiation of entries. CCD. CTX 60 Days – Written Consumer Account Using Statement of Corporate SEC Code Unauthorized Debit

R06 – ODFI Request for Return Originator must accept requested return. ALL Not Applicable

R07 – Authorization Revoked Originator must stop initiation of entries PPD, TEL, 60 Days – Written until new consumer authorization is WEB Statement of obtained. Unauthorized Debit R08 – Payment Stopped Originator must contact Receiver to ALL 24 HOURS identify the reason for the Stop Payment and obtain authorization before reinitiating the entry. R09 – Uncollected Funds Originator may initiate a new ACH entry ALL 24 HOURS within 180 days of the original Settlement Date. R10 – Customer Advises Not Originator must stop initiation of entries. ARC, BOC, 60 Days – Written Authorized, Notice Not POP, PPD, Statement of Provided, Improper Source TEL, WEB Unauthorized Debit Document, or Amount of Entry Not Accurately Obtained from Source Document

R11 - Customer Advises Entry Used to return a debit in which there is an ARC, BOC, 60 Days – Written Not in Accordance with the error, but for which there is an POP, PPD, Statement of Terms of the Authorization authorization in file. TEL, WEB Unauthorized Debit R12 – Account Sold to Another Originator must stop initiation of entries ALL 24 HOURS DFI and obtain correct routing number information for initiation of subsequent entries. R16 – Account Frozen Originator must stop initiation of entries. ALL 24 HOURS R20 – Non- Originator must stop initiation of entries. ALL 24 HOURS R24 – Duplicate Entry Originator should accept the return. If the ALL 24 HOURS entry has already been reversed, Originator should contact the RDFI to determine a solution. An Originator may reverse an erroneous or duplicate ACH entry/file up to 5 business days after the Settlement Date of the entry/file. OR it may request the RDFI to send a return. R29 – Corporate Customer Originator must stop initiation of entries CCD, CTX 24 HOURS Advises Not Authorized until subsequent authorization has been obtained.

7

Reversals

If a reversing entry must be made, please contact GTS Customer Service for instructions. • Reversals may only be made for the following three conditions:

o Wrong dollar amount o Wrong account number o Duplicate transaction • When initiating a reversal, the reversing entry must be for the full amount, must be sent within five (5) business days of original entry and must be sent within 24 hours of discovering the error. • The Receiving Bank is under no obligation to post the reversing debit if it overdraws the payee’s account or if the payee’s account is closed. • A payee must be notified if a reversing entry debits his or her account. However, a payee does not need to authorize the reversing debit. • The word “REVERSAL” must be placed in the Company Batch Header Field and if the file is reversing an erroneous file, then a correcting file must be initiated with the reversing file

OFAC (Office of Foreign Asset Control)

• You are required to check payees/ACH recipients against OFAC compliance checklists.

• OFAC checklists contain lists of countries, groups and individuals with which U.S. Companies are not permitted send or receive funds.

• The Bank helps protect our clients by informing them that it is against the law to send debit or credit entries to OFAC-blocked entities.

• You may check the OFAC SDN list at sanctionssearch.ofac.treas.gov

8