Regulation E vs. ACH Rules: Working Out Disputes Effectively September 13, 2018 Connie LaChance, AAP, NCP, APRP, VP, Education & Training

WesPay, as a Direct Member of NACHA – The Electronic Payments Association and through its affiliation with the Electronic Check Clearing House Organization (ECCHO) as an NCP Trusted Partner, is a specially recognized and licensed provider of ACH and Check education, publications and support. Regional Payments Associations are directly engaged in the ACH rulemaking process and support of the Accredited ACH Professional (AAP), Accredited Payments Risk Professional (APRP) and National Check Professional (NCP) programs.   This material may be derived from collaborative work product developed by NACHA, ECCHO and other member Regional Payments Associations. This material is not intended to provide any warranties or legal advice and is intended for educational purposes only. © 2018 Western Payments Alliance (WesPay). All rights reserved. NACHA owns the copyright for the NACHA Operating Rules & Guidelines. The Accredited ACH Professional (AAP) and Accredited Payments Risk Professional (APRP) are registered service marks of NACHA. The National Check Professional (NCP) is a registered service marks of ECCHO.

Session Overview Regulation E – ACH Rules Comparison Regulation E vs. ACH Coverage Definitions Document Requirements Regulation E vs. ACH Liability Dispute Timeframes Dispute Scenarios

Regulation E vs. ACH Rules Implements the Electronic Funds Transfer Act (1978) Governed by the CFPB (2011) Consumer rights, responsibilities and liabilities for EFTs Provides guidelines for reporting & resolving disputes regarding “unauthorized” transactions ACH Rules Contract law: Participants agree to be bound by the Rules Governed by NACHA (1974) Provides rules, warranties and liabilities of Participants Allows an Extended Return timeframe for unauthorized debit Entries In the mid 70’s there were around 22 states that had enacted some sort of EFT statues with some of them addressing consumer protection provisions. They were really concerned with the growing number of EFT related to ATM and ACH and some telephone transfers. It was suprising how they note that POS transaction were very low. Rulemaking authority under EFTA generally transferred from the Federal Reserve Board to the CFPB in July 2011 pursuant to the Dodd-Frank Wall Act. The CFPB restated Regulation E at 12 CFR Part 1005 in December 2011.

Coverage Regulation E ACH Rules Consumer accounts only Includes demand deposit (checking), savings, or other consumer asset account All ACH Standard Entry Class Codes (SEC) except RCK ACH Rules Consumer and Non-Consumer Accounts Includes checking, savings, and loan accounts All Standard Entry Class Codes (SEC), including RCK

Definitions Electronic Funds Transfer (EFT) (Reg. E): any transfer of funds that is initiated through an electronic terminal, telephone, computer, or magnetic tape for the purpose of ordering, instructing, or authorizing a financial institution to debit or credit a consumer's account Entry (ACH): an order or request for the transfer/withdrawal to/from a deposit or loan account of a Receiver, or a general ledger account of an RDFI EFTs cover those transaction where your account holder is sending out a credit. demand deposit (checking), savings, or other consumer asset account

Definitions Unauthorized EFT (Reg. E): an EFT from a consumer's account initiated by a person other than the consumer without actual authority to initiate the transfer and from which the consumer receives no benefit Unauthorized debit Entry (ACH): a debit Entry not authorized by the Receiver if: authorization requirements are not met debit Entry was initiated in an amount different than authorized debit Entry was initiated for settlement earlier than authorized

Documentation Requirements Regulation E FI may require consumer to provide written confirmation of dispute FI may not delay initiating or completing an investigation pending receipt of the written confirmation 2 year retention ACH Rules Written Statement of Unauthorized Debit (WSUD) required before RDFI returns Entry RDFI warrants they have a signed WSUD prior to return 1 year retention The ACH authorization should evidence the consumer’s identity and assent to the authorization.

Regulation E Consumer Liability Timely Notice: “Consumer must report an unauthorized electronic fund transfer that appears on a periodic statement within 60 days of the financial institution's transmittal of the statement to avoid liability for subsequent transfers” Timely Notice not Given: “If consumer fails to do so, consumer's liability shall not exceed the amount of the unauthorized transfers that occur after the close of the 60 days and before notice to the institution…” 1005.7 Initial disclosures. Timing of disclosures. A financial institution shall make the disclosures required by this section at the time a consumer contracts for an electronic fund transfer service or before the first electronic fund transfer is made involving the consumer's account. Part of the disclosure will include notice regarding error resolution. REQUEST FOR DOCUMENTATION OR CLARIFICATIONS.When a notice of error is based on documentation or clarification that the consumer requested under paragraph (a)(1)(vii) of this section, the consumer's notice of error is timely if received by the financial institution no later than 60 days after the institution sends the information requested

ACH Rules – Prompt Recredit Subsection 3.11.1 – RDFI General Obligation to Recredit Consumer Account RDFI must promptly recredit the amount of a debit Entry to a Consumer Account of a Receiver, regardless of SEC Code, if it receives the WSUD in time and in a manner that reasonably allows RDFI to meet the deadline for transmitting an Extended Return Entry Subsection 3.13.1(b) – RDFI may transmit an Extended Return Entry so it is available to ODFI no later than the opening of business on the Banking Day following the 60th calendar day following Settlement Date of original Entry

Time Limits for Disputes Regulation E No statute of limitation Liability and error resolution requirements based on when consumer gives notice No obligation to investigate “alleged” errors beyond 60 calendar days from the statement date ACH Rules No statute of limitation on ODFI warranty that Entry is authorized 60-day Extended Return timeframe Late Returns allowed upon ODFI approval RDFI right to request copy of authorization Disclosure requirements

Reg E Error Resolution Timeline FI must accept oral or written notice of error from consumer FI may require consumer to give written confirmation of error within 10 business days of oral notification May withhold provisional credit if not received FI must promptly investigate error May not delay pending receipt of written confirmation Determine if error occurred within 10 business days Correct within one business day Report results within three business days WRITTEN CONFIRMATION.A financial institution may require the consumer to give written confirmation of an error within 10 business days of an oral notice. An institution that requires written confirmation shall inform the consumer of the requirement and provide the address where confirmation must be sent when the consumer gives the oral notification.

Reg E Error Resolution Timeline May take up to 45 days if investigation cannot be completed within initial 10 business days Provisionally credit amount of alleged error Not required if untimely or if written confirmation not received (when requested) within 10 business days of oral notice Inform consumer within two business days Amount and date of provisional credit Full use of funds during investigation If determined an error occurred Correct within one business day Report results within three business days

Reg E Error Resolution Timeline If investigation finds no error Provide written explanation of findings within three business days Debit provisional credit (if provided) Notify consumer of date of debit and amount Notify consumer that FI will honor certain items for five business days, or when account will be debited five business days from the transmittal of the notification specifying the calendar date on which the debiting will occur

Error Resolution Scenario 1 – Timely Notice Date* Event January 5 $100 - First unauthorized debit February 1 January Statement made available to customer February 5 $100 – unauthorized debit March 5 March 23 Customer notifies RDFI of unauthorized debits & signs WSUD RDFI Return Feb & March Entries totally $200 April 1 Deadline for consumer to give timely notice to FI April 6 Provisional credit for remaining Entry of $100 No consumer lability Based on Reg E…. Everything above the red line, the consumer will not be labile for. Because they failed to give timely notice, they may be liable for subsequent entries that are below the Red line. While Reg E doesn’t care about the FI taking a loss, we look to the ACH Rules to recoup our loss and possibly the customer’s losses as well. *Assume 30 days in each month

Here are the Facts Regulation E: Consumer will not be liable for any transactions prior to 60 day notice (Jan 5th, Feb 5th, March 5th) Consumer not liable/FI potential loss = $300.00 FI has 10 business day to investigate May take up to 45 days Provisional credit required due to timely notice & written confirmation received If unauthorized, provisional credit becomes final If authorized, written notice of no error and notification of when provisional credit will be reversed No Error: Notify consumer within 3 business days. Reverse provisional credit with 5 day grace period for overdrafts caused by the reversal. Supply the consumer, upon request, with documents used by the DFI to determine there was no error.

Here are the Facts ACH Rules: Allows for Extended Returns within 60 calendars days of Settlement Date ( Feb 5th & Mar 5th) Prompt recredit of $200.00 RDFI can request copy of authorization from ODFI ODFI warrants authorization is proper If unauthorized, ODFI should allow a late Return of the Jan 5th Entry = $100.00 If authorized, ODFI may refuse a late Return

Error Resolution Scenario 1 - Recap Event RDFI Loss GL Customer Account 3/23 – RDFI returns February and March Entries via ACH totaling $200.00 Credit customer account $200.00 4/6 – Provisional credit to customer for remainder of what they are not liable for Debit Loss GL $100.00 Credit customer account – notify within two business day and allow use of funds Current outstanding loss to RDFI as of 4/6 Current outstanding liability to customer as of 4/6 $0.00 4/25 – RDFI gets ODFI approval to return Jan Entry via ACH totaling $100.00 Credit Loss GL -$100.00 Notify customer of error resolution within 3 business days and that provisional credit is final Current outstanding loss to RDFI as of 4/25 Current outstanding liability to customer as of 4/25

Error Resolution Scenario 2 – Untimely Notice Date* Event January 5 $1,000 - First unauthorized debit February 1 January Statement made available to consumer February 5 $1,000 – unauthorized debit March 5 April 1 Deadline for consumer to give timely notice to FI April 5 May 5 June 5 June 29 Customer notifies RDFI of unauthorized debits & signs WSUD No consumer lability Based on Reg E…. Everything above the red line, the consumer will not be labile for. Because they failed to give timely notice, they may be liable for subsequent entries that are below the Red line. While Reg E doesn’t care about the FI taking a loss, we look to the ACH Rules to recoup our loss and possibly the customer’s losses as well. Consumer may be labile *Assume there are 30 days in each month

Here are the Facts Regulation E: Consumer will not be liable for any transactions prior to 60 day notice (Jan, Feb, & March) Consumer not liable/FI potential loss = $3,000.00 Consumer potential liability (April, May, & June) = $3,000.00 FI has 10 business day to investigate May take up to 45 days Provisional credit not required due to timely notice not given If unauthorized, credit becomes final If authorized, written notice of no error required

Here are the Facts ACH Rules: Allows for Extended Returns within 60 calendars days of Settlement Date (May & June) Prompt recredit of $2,000.00 RDFI can request copy of authorization from ODFI ODFI warrants authorization is proper If unauthorized, ODFI should allow a late Returns for Jan, Feb, Mar, & April Entries = $4,000.00 If authorized, ODFI may refuse a late Return

Error Resolution Scenario 2 - Recap Event RDFI Loss GL Customer Account 6/29 – RDFI returns May and June Entries via ACH totaling $2,000.00 Credit customer account $2,000.00 7/13 – Provisional credit to customer for what they are not liable for Debit Loss GL $1,000.00 Credit customer account – notify within two business day and allow use of funds Current outstanding loss to RDFI as of 7/13 Current outstanding liability to customer as of 7/13 $3,000.00 7/15 – RDFI gets ODFI approval to return Jan, Feb, Mar, & April Entries via ACH totaling $4,000.00 Credit Loss GL Credit customer’s account Current outstanding loss to RDFI as of 7/15 $0.00 Current outstanding liability to customer as of 7/15 If ODFI does not allow late returns, you have the option to file Rules Violation or take them to arbitration.

Error Resolution Scenario 3 – External Account Transfers Date* Event January 5 $2,000 – Transfer out to another FI February 1 January Statement made available to consumer February 5 $1,000 – Transfer out to another FI February 9 April 1 Deadline for consumer to give timely notice to FI May 1 May 4 Customer notifies FI of unauthorized OLB transfers & confirms in writing. States he has OLB username and password taped to his PC. No consumer lability Consumer may be labile Based on Reg E…. Everything above the red line, the consumer will not be labile for. Because they failed to give timely notice, they may be liable for subsequent entries that are below the Red line. While Reg E doesn’t care about the FI taking a loss, we look to the ACH Rules to recoup our loss and possibly the customer’s losses as well. *Assume there are 30 days in each month

Here are the Facts Regulation E: Consumer will not be liable for any transactions prior to 60 day notice (Jan 5th, Feb 5th & Feb 9th) Consumer not liable/FI potential loss = $4,000.00 Consumer potential liability (May 1st) = $2,000.00 FI has 10 business day to investigate May take up to 45 days Provisional credit not required due to timely notice not given If unauthorized, credit becomes final If authorized, written notice of no error required Consumer negligence CONSUMER NEGLIGENCE. Supplement I Negligence by the consumer cannot be used as the basis for imposing greater liability than is permissible under Regulation E. Thus, consumer behavior that may constitute negligence under state law, such as writing the PIN on a debit card or on a piece of paper kept with the card, does not affect the consumer's liability for unauthorized transfers. 

Here are the Facts ACH Rules: ODFI may initiate a Reversal Entry for an Erroneous Entry Must be transmitted within 5 Banking Days following the original Settlement Date and within 24 hours of discovery ODFI may request an RDFI to return as R06 RDFI not obligated to comply RDFI may request a Letter of Indemnity ODFI indemnifies RDFI from any claims, demands, losses, liabilities & expenses “R06 – Return per ODFI Request”

Error Resolution Scenario 3 - Recap Event RDFI Loss GL Customer Account 5/4 – ODFI give provisional credit for unauthorized transfers Debit Loss GL $4,000.00 Credit customer account – notify within two business day and allow use of funds Current outstanding loss to RDFI as of 5/4 Current outstanding liability to customer as of 4/2 $2,000.00 5/4 – ODFI request RDFI to Return Entries from Jan, Feb & May totaling $6,000 5/7 – ODFI receives 2 incoming returns totaling $3,000 (2/9 & 5/1 Entries) Credit Loss GL $3000.00 Current outstanding loss to RDFI as of 5/7 $1,000.00 Current outstanding liability to customer as of 5/7

Adjustments Part Two February 24, 2010 Thank You