Third-Party Sender Registration

Table of Contents

AHA! Page ...... page 1

Since PSU Last Year ...... page. 2

Third-Party Sender Registration ...... page 8

Fraud Trends ...... page. 19

Regulatory Update ...... page. 20

Payment Trends ...... page 23

Same Day ACH Debits ...... page 31

Certificate of Completion ...... page. 37

PARTICIPANT GUIDE

EMV Compliance Mandate – October 2015 Liability Shift

Who Is Liable? Liability Condition – Counterfeit (Issuer or Merchant) • Mag stripe only card Issuer • Mag stripe only terminal Merchant • Chip card Issuer • Mag stripe only terminal Merchant • Mag stripe only card Issuer • Chip terminal Merchant • Chip card Issuer • Chip terminal Merchant

PARTICIPANT GUIDE

Same Day ACH Status

Merchant and Card Notes: ______

U .S . Treasury Proposal and NACHA Request for Comment on IAT Notes: ______

PARTICIPANT GUIDE

ACH Rules Update – Minor Changes Aug 2016

Clarification of Reinitiation 18 Effective August 18, 2016

Standard Entry Description ACH Rules Page OR 31 – Subsection 2 .12 .4 .2 Page OR 115 – Company Entry Description

Summary of ACH Rule Change: Clarifies that the RETRY PYMT descriptive statement applies to all cases of reinitiation and supersedes any other company entry description, including Rules-mandated company entry description for original entries .

Applicability to RCK ACH Rules Page OR 31 – Subsection 2 .12 .4 .1 (d) & (e)

Summary of ACH Rule Change: Clarifies the reinitiation rules as applicable to RCK Entries by eliminating the separate section on reinitiated RCK entries and re-locating RCK-specific details to within the general rule on reinitiated entries .

Non-Applicability to Corrected Entries Related to R03/R04 Returns ACH Rules Page OR 31 – Subsection 2 .12 .4 .1 (h)

Summary of ACH Rule Change: Clarifies that corrected entries resulting from R03/R04 returns are not considered to be reinitiated entries .

PARTICIPANT GUIDE

Rules Enforcement 18 Effective August 18, 2016

Monitoring of Class 2 Violations ACH Rules Page OR 226 – Subpart 10 .4 .7 .4 (9)

Summary of ACH Rule Change: Re-defines a Class 2 rules violation as the fourth or subsequent recurrence of a rule violation, where that fourth or subsequent recurrence takes place within one year of the resolution date of the immediately preceding infraction .

Protection of the National Association from Liability for Enforcement of the Rules ACH Rules Page OR 228 – Subpart 10 .4 .7 .7

Summary of ACH Rule Change: Modifies Appendix Ten to expressly provide that the ACH Rules Enforcement Panel, the Appeals Panel, the National Association (including staff), and members of its committees have no liability in connection with their role in enforcement matters .

Appeal Process for Suspension from the ACH Network ACH Rules Page OR 227 – Subpart 10 .4 .7 .6

Summary of ACH Rule Change: Expands Appendix Ten to define a process by which an ODFI may appeal the suspension of its Originator or Third-Party Sender customer when suspension has been mandated by the ACH Rules Enforcement Panel as the penalty for a Class 3 rules violation .

PARTICIPANT GUIDE

ACH Rules Page OR 125 – Originating DFI Identification

Summary of ACH Rule Change: Revises the description of the Originating DFI sept 2016 Identification field for IAT entries to reflect a current business practice . Funds Availability for Same Day Entries in Time Zones East of the Continental U.S. 23 Effective September 23, 2016 and March 16, 2018

ACH Rules Page OR 43 – Subsection 3 .3 .1 .1 Page OR 211 – Part 8 .3 (d) mar 2018 Summary of ACH Rule Change: Under Phase 3 of Same Day ACH, RDFIs will have to make funds from Same Day credits available to Receivers by 5 PM in the RDFI’s local time . For 16 RDFIs located in time zones ahead of Eastern Time, it is unlikely they will be able to meet this requirement . For example, RDFIs in Puerto Rico and the U .S . Virgin Islands are in the Atlantic Time Zone, which is one hour ahead of Eastern Time . The ACH Operator distributes files at 4 PM ET, which equates to 5 PM Atlantic Time; thus, these RDFIs would not be able to meet the funds availability requirement . Effective March 16, 2018 RDFIs in Puerto Rico and the U .S . Virgin Islands must make funds from a Same Day credit available for withdrawal by 6 PM Atlantic Time; and for RDFIs in Guam and the Northern Mariana Islands in the Chamorro Time Zone, they will be required to make Same Day credits available to Receivers for withdrawal no later than the opening of business on the Banking Day following the Settlement Date of the Entry .

Additionally, the Rules compliance audit requirement 8 3. (d) was modified effective September 23, 2016 to adopt more general language referencing an RDFI’s obligation to comply with the funds availability requirements stated in the above paragraph .

PARTICIPANT GUIDE

ACH Rules Page OR 14 – Subsection 2 .5 .7

Summary of ACH Rule Change: This section of the Rules has been revised to make it clear that ENR Entries cannot be Same Day Entries .

Alignment of TRC/TRX Same Day Language Effective September 23, 2016

ACH Rules Page OR 119 – Effective Entry Date Page OR 133 – Settlement Date

Summary of ACH Rule Change: Removes language from the Effective Entry Date field description and the Settlement Date description that became outdated when Same Day ACH went into effect . This results in language for TRC and TRX entries being fully aligned with other SEC Codes, where settlement is based on the Effective Entry Date .

PARTICIPANT GUIDE

Identification of Third-Party Senders A Third-Party Service Provider is an organization other than an Originator, an ODFI or an RDFI that performs a function of ACH processing on behalf of the Originator, the ODFI or the RDFI .

PARTICIPANT GUIDE

ACH Operations Bulletin #2-2014: ACH Transactions Involving Third-Party Senders and Other Payment Intermediaries

ACH Rules Page OG 339 – Appendix N

Summary of ACH Rule Change: NACHA revised the definition of a Third-Party Sender (TPS) effective March 21, 2014 and issued an ACH Operations Bulletin to assist financial institutions in understanding the role of a Third-Party Sender and to help them identify Third-Party Senders .

Two Key Questions to Identify TPS

1. What is the underlying transaction? 2. Who has the Origination Agreement? ______LM

Third-Party Sender Identification Tool D

PARTICIPANT GUIDE

Property Partners Friendly Bank provides ACH origination services to Property Partners . Property Partners provides services to Home Owner’s Associations (HOAs) . One of the services allows the HOA to use the ACH Network to collect monthly HOA fees from their members . The HOA obtains an authorization from the member to debit their account, and the HOA provides the payment information to Property Partners . Property Partners creates an ACH file to debit the members’ accounts and sends the file to Friendly Bank for processing .

1 . Is there a Third-Party Sender in the scenario? If so, who and why? ______2 . Which parties, if any, should have agreements? ______3 . Does the relationship change if Property Partners provides a software system to the HOA’s to enter the payment information which creates the ACH debits and the HOA’s sends the ACH file to their own ODFI for processing? ______4 . If the relationship has changed which parties, if any, should have agreements? ______

PARTICIPANT GUIDE

Third-Party Sender Registration Rule Effective September 29, 2017 Third-Party Sender Registration

ACH Rules Page OR 39 – Subsection 2 .17 .3

▶▶ What is the purpose of the Third-Party Sender Registration? ______

▶▶ Why do we have to register TPS relationships? ______

▶▶ What will NACHA do with the data? ______

______

PARTICIPANT GUIDE

______

PARTICIPANT GUIDE

Impact of Third-Party Sender Registration Rule

______

PARTICIPANT GUIDE

______

PARTICIPANT GUIDE

Third-Party Sender Registration Scenarios

Secnario 1: Onboarding New Originator On January 27, 2018, Megamoney Processing LLC applied to your financial institution for ACH origination services .

The following was provided on their application: ▶▶ Company Name, Address, Phone Number ▶▶ Origination will be ▶▶ Principal Owners and a Primary Contact ▷▷ ACH consumer debit transactions ▶▶ 2 years of financials were provided ▷▷ One file per week on Thursday ▶▶ Account relationships include checking and a sweep ▷▷ File totals = $50,000 account; one line of credit loan ◆◆ 1100 Debits ◆◆ Averaging $45 each

Your credit area has completed a credit review and established an approved exposure limit for Megamoney Processing’s anticipated ACH activity . Upon approval, Megamoney plans to originate the first files on February 20, 2018 .

Everything checks out until you ask about the nature of the transactions; at that time Megamoney Processing tells you they provide services to multiple health clubs across the country by originating dues debits monthly for each of their client health clubs .

1 . Does this information change any of your approval/onboarding processes? ______2 . What agreements are required? And why? ______3 . Is this a Third-Party Sender? ______

Continued on next page...

PARTICIPANT GUIDE

4 . What additional information would you require from this entity? ______5 . If this is a Third-Party Sender, what is the timeframe for registering them with NACHA? ______6 . Based on the scenario, do you have the required registration information? ______

Scenario 2: Existing Origination Customer – Change in Activity American Payments, Inc . has been an ACH origination customer with your financial institution for nearly one year . They signed an ODFI/Originator agreement at the time of onboarding . You’ve collected all the standard Originator information from them, their credit review checked out, etc .

Their activity includes processing their own payroll and a few CCD credits for vendor payments . Their activity has been benign, no issues; and they are considered a good customer .

As of March 13, 2018, their normal ACH activity looks like this: ▶▶ Payroll PPD credits ▷▷ $73,200 ▷▷ Single batch with 32 credits

Today, March 15, 2018 American Payments, Inc . transmits a file and a transmittal letter to match: ▷▷ File total $243,000 ▷▷ 5 batches and 175 entries

The processing of the file stops because this file total is well above the established exposure limit . When the operations staff looks at the file they discover that there are multiple batches, each with a different company name .

PARTICIPANT GUIDE

1 . What’s your first action on this situation? ______2 . If fraud is ruled out, what’s the next step? ______3 . Is this a Third-Party Sender situation? Why or why not? ______4 . Do you have the appropriate agreement with American Payments, Inc .? Why? ______5 . What is the timeframe for registering this entity with NACHA, if necessary? ______

PARTICIPANT GUIDE

Scenario 3: ACH Audit – A Discovery Congratulations! You engaged EPCOR to conduct your annual ACH audit, the date is set, you signed the agreement, and you’ve completed the pre-audit checklist . Now it’s time to gather all the requested documentation for the EPCOR auditor to review, so you’ll be ready for the audit when Amy arrives at your financial institution .

The audit is conducted on September 13, 2018 . Amy begins the audit by reviewing your responses to the pre-audit checklist, your ACH Management Policy and other procedures . Your ACH Policy does not contain a statement that precludes offering ACH origination services to Third-Party Senders, and you check ‘no’ to the question as to whether you currently have any Third-Party Sender Customers .

While reviewing originator files and going through transaction samples, Amy mentions to you that she is looking at the activity for one of your Originators and it looks a lot like the activity of a Third-Party Sender . They have multiple batches in their files and some of those files have different company names . Amy takes a look at the original ACH services application to determine if there is any information that might point to this customer being a Third-Party Sender .

1 . What action should be taken by the Operations staff right now? ______2 . What questions need to be answered to determine if this entity is a Third-Party Sender? ______3 . If it turns out this entity is a Third-Party Sender, what considerations and changes need to be reviewed and/or implemented? ______4 . If this entity turns out to be a Third-Party Sender, what’s the timeframe required for registering with NACHA? ______

PARTICIPANT GUIDE

Warning Signs

______

Posting Multiple Entries ▶▶ Limit 3 entries per account ______▶▶ Some exceptions, may be religious groups ______▶▶ There has been accountant fraud ______

If you can’t post it, return the entry!

If You Suspect Fraud ... Return Using R17 (File Record Edit Criteria) Use Addenda Information Field: ▶▶ 17 = ______IRS Refund Return Opt-in ▶▶ 18 = ______Program rules and agreement ▶▶ 19 = ______LM ▶▶ If none, IRS default to name mismatch ▶▶ Return within 60 days of Settlement Date D

PARTICIPANT GUIDE

FinCEN Customer Due Diligence Effective May 11, 2018

______

FinCEN Customer Due Diligence LM

CFPB Prepaid Account Final Rules D Effective October 1, 2017

▶▶ Protections ▶▶ Disclosures ▶▶ Credit ______

CFPB Prepaid Account Final Rules LM

D PARTICIPANT GUIDE

CFPB Payday Lending Proposal Comment period closed October 7, 2016

▶▶ Consumer Loans ▶▶ Ability to Repay (ATR) ▶▶ Payment Restrictions ______

CFPB Payday Lending Proposal LM

CFPB Arbitration D Comment period closed August 22, 2016

▶▶ Blocking class action lawsuits ▶▶ Submit arbitration claim filed & awards to reviewed by the CFPB ______

CFPB Arbitration LM

D PARTICIPANT GUIDE

Joint Proposal

______

Joint Proposal LM

D FFIEC Mobile Financial Services Guidance

______

FFIEC Mobile Financial LM Service Guidance

D

PARTICIPANT GUIDE

Account Validation

“A service wherein a business or financial institution can validate the accuracy of the account information received from a consumer or business, and the ability of that account to receive electronic payments ”. —NACHA Account Validation Survey, 2013

Account Validation Survey Results

Why is Account Validation Important? Using an incorrect routing and/or account number can: ______

PARTICIPANT GUIDE

Account Validation Methods

Manual ______

Prenote ______

Micro deposit ______

Validation service ______

Future Opportunities

______

The “Helping Your Originators Understand Account Validation” for financial institutions and “Account Validation: A Tool for Businesses to Improve ACH Transactions” for corporates discuss the importance of account validation services, current account validation methods,LM use cases for account validation and potential options for the future.

D

PARTICIPANT GUIDE

Tokenization

What Is a Token? ______

Why Are Tokens Used? ▶▶ Mask real account information ______▶▶ Single Originator issuance ______▶▶ Additional controls Credit only designations ______Dollar limits ______

PARTICIPANT GUIDE

ISO 20022

What is ISO 20022? ______

PARTICIPANT GUIDE

Wires & ISO 20022 Adoption – Implementation Strategy

______

The Fed’s Resource Center for Adoption of ISO 20022 for Wire Transfers and ACH Payments

LM

D

PARTICIPANT GUIDE

ACH & ISO 20022 Integration – ACH Network ▶▶ No changes to current ACH formats ▶▶ Support of the ACH Rules

NACHA’s ISO 20022 Resource Center LM

D

MERCK ISO 20022 Case Study LM

D

PARTICIPANT GUIDE

Real-Time Payments

The Clearing House’s Real-Time Payments LM

D

PARTICIPANT GUIDE

Payment System Disrupters

There are many new products being developed to move money outside of normal banking channels for both consumers and businesses .

Alternative Faster Payments

Watch News You Can Use for the Federal Reserve’s Faster Payments Task Force Report

LM

The Federal Reserve Payments Study 2016 D

PARTICIPANT GUIDE

▶▶ What debit payments do you think may be sent as Same Day ACH? ______

TEL Written Notice – Subsection 2.5.15.2, OR 22

PARTICIPANT GUIDE

Returns & Reversals

Processing Returns Return Entry Processing

______

PARTICIPANT GUIDE

RDFI Considerations

RDFI Implementation Checklist Posting Early ▶▶ Ensure debits are posted on the Settlement Date and not the Effective Entry Date ▶▶ Risks/impacts of posting early ______

PARTICIPANT GUIDE

Posting Order ▶▶ Do you know your institution’s posting order? ______▶▶ If so, are you posting payments in the order outlined in your disclosures? ______▶▶ What impact could the posting order have on your account holders and/or institution when Phase 2 is implemented? ______

Same Day ACH Debit Education ▶▶ Account holders ▷▷ Consumer ______▷▷ Business ______▶▶ Frontline & call center staff ______

PARTICIPANT GUIDE

ODFI Considerations

ODFI Implementation Checklist

______

PARTICIPANT GUIDE

Origination Agreement Effective Entry Date Continues to Be an Issue ▶▶ Debits settled prior to the agreed-upon debit date could be returned: ▷▷ NSF ▷▷ Unauthorized ▶▶ Return rates could increase ▷▷ Overall ▷▷ Unauthorized

______

PARTICIPANT GUIDE

This certificate is awarded to: on In completion of: 2017 Payment 2017 PAYMENT Systems Update SYSTEMS UPDATE This course is worth 7.5 AAP continuing education credits.

Wendy Wishon, AAP, NCP Senior Vice President, EPCOR