Payments Law Tool Kit

Venable / 42 41 / Venable One of the fastest-growing ways to make commercial and consumer payments is through the automated clearing house (ACH) network. The ACH system is a network through which participating depository institutions (e.g., banks) transmit batches of electronic credit and debit payments. An ACH payment is initiated through an originating depository financial institution (ODFI), which transmits credit and debit entries into the ACH network on behalf of customers (called “Originators”). In many cases, an ODFI may sponsored a payments intermediary, called a “third-party sender,” to initiate ACH payments on behalf of the third-party sender’s customers. While partnering with a third-party sender can expand an ODFI’s origination capabilities, it also increases the ODFI’s exposure to legal, compliance, credit, and reputational risks. The National Automated Clearing House Association (NACHA) is the nonprofit association that administers the rules for ACH payments. In terms of payments, an ODFI transmits Originator payment instructions (Entries) to the ACH system for purposes of transferring funds to the account of a consumer or business (Receiver). An Originator or ODFI may use the services of a third-party sender as an intermediary in transmitting Entries between the Originator and the ODFI. The third-party sender acts on behalf of the Originator when there is no agreement between the ODFI and the Originator for ACH services. A third-party sender must have an Origination agreement with the ODFI, as well as an agreement with each Originator for which it processes Entries. The Rules require ODFIs to register their third-party senders with NACHA. For example, an employer may contract with a payroll processing company to facilitate the company’s payment of payroll by ACH. In this example, the employer would be the Originator sending payments to employees, and the payroll processing company would be a third- party sender facilitating those payments through its relationship with an ODFI. As noted, the ODFI does not have a direct agreement with the employer/Originator in this setup. Accordingly, both the ODFI and the third-party sender are subject to a number of obligations and liabilities with respect to the transmission of ACH payments. Whenever a bank partners with a third party, the federal banking regulators expect the bank to practice effective risk management and oversight. With respect to ACH, partnering with a third-party sender can expose an ODFI to legal, compliance, reputational, and credit risk. As explained by NACHA, an ODFI that works with third-party senders “must fully understand the nature of the risks that are created by their payment intermediaries and should take action commensurate with the risks to mitigate resulting exposures, including the risk of failure of the intermediary.” Specific areas of legal and compliance risk include consumer protection, anti- money laundering, and compliance with the economic sanctions programs administered by the Office of Foreign Assets Control (OFAC). In terms of credit risk, an ODFI incurs risk when initiating credit payments until its customer funds the account. To address these risks, an ODFI should implement a compliance program that addresses (1) the nature of the risks associated with ACH activity (including third-party sender activity); (2) due diligence of third-party senders; (3) controls for third-party senders, including through vendor oversight and contractual arrangements; and (4) management, information, and reporting systems to monitor and mitigate risk. Third-Party ACH Senders