COMPLIANCE

NACHA Operating Rules

What you are responsible for when your business originates ACH entries.

As part of our commitment to keeping our customers informed of their responsibilities under the NACHA Operating Rules (the "Rules"), the following is a summary of your obligations as an originator of ACH entries. This summary does not address all ACH Rule requirements. It highlights key topics for businesses to consider when initiating ACH entries, and is not intended to replace the detailed analysis needed to determine the impact the Rules have on your specific organization.

If you have questions about these requirements, get in touch.

Key ACH rules

The Rules prescribe several requirements that originators of ACH entries must follow. This includes ACH entries submitted by businesses using third-party senders or third-party service providers.

Authorizations

Authorization for consumer credit entries or business-to-business entries can be obtained in any manner permitted by applicable legal requirements (Subsections 2.3.2.1 and 2.3.3.1 of the Rules). This means such entries can be authorized online, by phone, or in writing. However, the originator must ensure it obtains authorization from the intended receiver. It is a best practice to retain authorizations, and evidence of the receiver providing their account number, in the rare instance there is a dispute over the receiving account number established for the payment. ACH credit entries are a common target for fraud, as they can be used to steal money from your business.

Authorizations for consumer debit entries include the following information:

  • The number of entries authorized (one-time, recurring, and so on)
  • The dollar amount of entries, or how the dollar amount will be determined
  • The timing of entries, such as the date of the first entry and the frequency of future entries
  • Receiver's name
  • Account that will be debited
  • The date of the authorization
  • How the receiver can revoke the authorization with the originator

Notifications of Change (NOCs)

The Rules provide receiving institutions the opportunity to correct a received entry and transmit a corresponding NOC to the originating institution.

  • Originators are required to make the change prescribed in the NOC within six banking days of receiving the NOC, or before sending a subsequent entry, whichever is later.
  • Originators who receive an NOC in response to a one-time entry are not required to make changes to future entries.

Common return codes

CodeDescription
R01Insufficient Funds
R02Account Closed
R03No Account / Unable to Locate Account
R04Invalid Account Number
R05Unauthorized Debit to Consumer Account Using Corporate SEC Code
R06Returned Per ODFI Request
R07Authorization Revoked by Customer
R08Payment Stopped
R09Uncollected Funds
R10Customer Advises Originator is Not Known to Receiver and/or Originator is Not Authorized by Receiver to Debit Receiver's Account
R11Customer Advises Entry Not in Accordance with the Terms of the Authorization
R29Corporate Customer Advises Not Authorized

Acting on a return

Originators should consider taking action based on the type of return received.

Insufficient or uncollected funds (R01 and R09)
Originators can reinitiate entries that are returned for these reasons, but should be aware of restrictions when doing so (ACH Rule Subsection 2.12.4).
Incorrect entry (R11)
The receiver is claiming that the entry is incorrect (typically dollar amount or date errors). The Rules allow the originator to reinitiate the corrected entry when receiving an R11 return.
Administrative returns (R02, R03 and R04)
These return codes indicate an issue with the account number used. The originator should review the authorization and work with the receiver to determine the cause of the error and correct the account number for future entries.
Unauthorized returns (R05, R07, R10, R29)
Originators must stop future entries after receiving an unauthorized return and work with the receiver to determine why the entry was disputed. Originators can obtain a new authorization from the receiver but should take extra steps to ensure future entries are properly authorized and the receiver has the right to debit the account specified.
Stopped payment and revoked authorization (R08 and R07)
Originators should work with their receiver to determine if there was an error in the entry, such as a wrong amount, or if the receiver stopped the payment or claimed they revoked the authorization.

General originator requirements

In addition to the key Rules above, all originators, third-party senders and third-party service providers are required to comply with the general origination requirements of the Rules, including:

  • Retaining the original or copy of each written authorization of a receiver, or a readily and accurately reproducible record evidencing any other form of authorization, for at least two years from the termination or revocation of the authorization. (Subsection 2.3.2.5 - Retention and Provision of the Record of Authorization)
  • Providing proper and timely notice to receivers for changes to the amount or scheduled date of recurring debits. (Subsection 2.3.2.6 - Notices of Variable Debits to Consumer Accounts)
  • The proper way to initiate prenotification entries. (Section 2.6 - Prenotifications)
  • The proper way to reverse files or entries. (Section 2.8 - Reversing Files, and Section 2.9 - Reversing Entries)

Provisions by entry type

The originator should also be aware of the unique provisions for the specific types of entries it originates.

CodeEntry typeReference
ARCAccounts ReceivableSubsection 2.5.1
BOCBack Office ConversionSubsection 2.5.2
CCDCorporate Credit or DebitSubsection 2.5.3
POPPoint-of-PurchaseSubsection 2.5.10
PPDPrearranged Payment and DepositSubsection 2.5.12
RCKRe-presented CheckSubsection 2.5.13
TELTelephone-Initiated EntrySubsection 2.5.15
WEBInternet-Initiated/Mobile EntrySubsection 2.5.17