Nacha Rule Changes
Available Beginning Q1 2021 – Q2 2022

Nacha has approved rule changes to enhance Same Day ACH functionality and improve risk management. As a result, J.P. Morgan will be making changes to US ACH origination service and US ACH eLockbox/Receiver Services reporting.

New Third Same-Day ACH Processing Window — Effective March 19, 2021

  • A third Same-Day ACH processing window is being created, expanding Same-Day ACH availability by 2 hours to provide greater access for all Originators and their customers.
  • The timing of this new processing window is intended to balance the desire to expand access to Same-Day ACH through extended hours with the need to minimize impacts on financial institutions’ end of day operations and the re-opening of the next banking day.
  • Specific cut-off times for J.P. Morgan U.S. Same Day ACH origination will be determined.
  • eLockbox Same-Day report delivery will be extended by approximately two hours, to 8 p.m. ET instead of 6 p.m. ET.
  • Non-consumer receivers subscribing to eLockbox will be required to post same day entries received by J.P. Morgan by 5:30 p.m. ET with same-day value during their normal posting schedule.

Supplementing Fraud Detection Standards for WEB Debits — Effective March 19, 2021

  • As a supplement to existing requirements, Originators of WEB Debits will be required to use a commercially reasonable fraudulent transaction detection system to ensure new and changed customer receiving accounts are able to successfully receive transactions prior to origination of WEB Debits. 
  • U.S. ACH Originators of WEB Debits may need to make changes to their account validation processes.
  • J.P. Morgan offers tools and services to complete this validation, but you can use any commercially reasonable fraud detection system.
  • Please reach out to your Relationship Management team if you have questions.

Differentiating Unauthorized Return Reasons – Phase 2— Effective April 1, 2021

  • Re-purposed return reason code R11 will now be covered by the existing Unauthorized Entry Fee.
  • Clients will be billed on their monthly statement of charges.

Supplementing Data Security Requirements – Phase 1 — Effective June 30, 2021

  • The existing ACH Security Framework including its data protection requirements will be supplemented to explicitly require large, non-FI Originators, Third-Party Service Providers (TPSPs) and Third-Party Senders (TPSs) to protect account numbers collected for or used in ACH transactions by rendering them unreadable when they are stored electronically.
  • Implementation begins with the largest Originators and TPSPs (including TPSs) and initially applies to those with ACH volume of 6 million transactions or greater annually.

Increase of Same Day ACH Transaction Limits — Effective March 18, 2022

  • This rule expands the capabilities of Same Day ACH. Increasing the Same Day ACH dollar limit is expected to improve Same Day ACH use cases, and contribute to additional adoption.
    • Increases the Same Day ACH limit for both eligible debit and credit entries from $100,000 to $1 million USD.
  • Increasing the dollar limit has been a frequently asked for change by ACH end-users. Most recently, a summer 2020 survey of corporate ACH end-users resulted in recommendations for Same Day ACH:
    • Increase or remove dollar limits
    • Expand processing hours and days

For more information on this rule, please refer to the formal press release on the Nacha website, here.

Supplementing Data Security Requirements – Phase 2 - Effective June 30, 2022

  • The existing ACH Security Framework including its data protection requirements is supplemented to explicitly require large, non-FI Originators, Third-Party Service Providers (TPSPs) and Third-Party Senders (TPSs) to protect deposit account information by rendering it unreadable when it is stored electronically.
    • June 30, 2021 - Implementation began with the largest Originators an TPSPs (including TPSs) and initially applies to those with ACH volume of 6 million transactions or greater annually.
    • June 30, 2022 - A second phase becomes effective for those originators with ACH volume of 2 million transactions or greater annually
  • The Rules are neutral as to the methods/technologies that may be used to render data unreadable while stored at rest electronically.
    • Encryption, truncation, tokenization, destruction, or having the financial institution store, host, or tokenize the account numbers, are among options for Originators and Third-Parties to consider

For more information on this rule, please refer to the formal press release on the Nacha website, here.

Use of Micro-Entries — Effective September 16, 2022

  • This Rule will define and standardize practices and formatting of Micro-Entries, which are used by some ACH Originators as a method of account validation
  • This Rule will become effective in two phases:
    • Phase 1 – September 16, 2022
      • The term Micro-Entry will be defined, and Originators will be required to use the standard Company Entry Description and follow other origination practices
    • Phase 2 - March 17, 2023
      • Originators of Micro-Entries will be required to use commercially reasonable fraud detection, including the monitoring of Micro-Entry forward and return volume

For more information on this rule, please refer to the formal press release on the Nacha website, here.

Third-Party Sender Roles and Responsibilities — Effective September 30, 2022

  • The overarching purpose of these Rules is to further clarify the roles and responsibilities of Third-Party Senders (TPS) in the ACH Network by
    • Addressing the existing practice of Nested Third-Party Sender relationships, and
    • Making explicit and clarifying the requirement that a TPS conduct a Risk Assessment
  • These two rules will become effective September 30th, 2022, with a 6-month grace period for certain aspects of each rule (March 31, 2023) if any of the below are met:
    • ODFIs to update TPS registrations to denote whether or not a TPS has Nested TPSs
    • TPSs that have not conducted a Risk Assessment to do so
    • A TPS need not wait for passage of this rule, or its effective date, to conduct a Risk Assessment

For more information on this rule, please refer to the formal press release on the Nacha website, here.