The recent changes related to Standing Authorizations and Oral Authorizations are specific to debit entries to Consumer Accounts.

However, additional changes to authorization language make clear that Originators of consumer credit entries, and Originators of any entries to non-consumer accounts, may obtain the Receiver’s authorization in any manner permitted by applicable legal requirements. This language is broad and does not preclude the potential use of standing and oral authorizations for consumer credit entries or entries between business trading partners where legal requirements permit.

A Single Entry is a credit or debit initiated by an Originator in accordance with the Receiver’s authorization for a one-time transfer of funds.

A Recurring Entry is an entry to a consumer account that recurs at substantially regular intervals, without further affirmative action by the Receiver to initiate the entries.

A Subsequent Entry is an entry to a consumer account that is initiated by a Receiver’s affirmative action in accordance with the terms of a Standing Authorization.

No. The decision to obtain consumers’ authorizations as Standing Authorizations, or to accept authorizations orally, is a business decision, at the discretion of the Originator.

Yes. As with any authorization obtained from the Receiver via an unsecured electronic network, the Originator must comply with the data security requirements defined by Article One, Section 1.7 (Secure Transmission of ACH Information via Unsecured Electronic Networks).

In general, the changes regarding Standing and Oral authorizations will have minimal impact on RDFIs. RDFIs will continue to receive and post entries, as normal.

However, since the requirement for an Originator to include a Payment Type Code for WEB and TEL entries has been relaxed (it will now be discretionary on the part of the ODFI to include any value within this field), RDFIs may lose some transparency as to whether an entry is a Single Entry, a Recurring Entry, or a Subsequent entry that is initiated as part of a Standing Authorization. RDFIs will no longer be able to rely on the presence of a specific value within the Payment Type Code Indicator field.

No. The rules for TEL entries – debits to consumer accounts authorized by the receiver orally via a telephone call – remain intact. However, since some of the specifications currently associated with TEL entries also now apply more broadly to all consumer debit authorizations, some aspects of the current TEL authorization requirements will be moved to the general authorization language within section 2.3 (Authorization and Notice of Entries) of the rules.

At its discretion (and except as noted below), an Originator may identify a Subsequent Entry using the Standard Entry Class Code appropriate either to (a) the manner in which the Standing Authorization was obtained from the Receiver, or (b) the manner in which the Receiver’s affirmative action to initiate the Subsequent Entry was communicated to the Originator.

Exception: An Originator that obtains the Receiver’s Standing Authorization as an Oral Authorization via a telephone call, or via the Internet or a Wireless Network, may not identify a Subsequent Entry using the PPD Standard Entry Class Code.

Example:

• An Originator obtains the Receiver’s Standing Authorization orally via a telephone call. The Standing Authorization specifies that the Receiver may affirmatively authorize a Subsequent Entry via an instruction provided via the Internet. In this case, the Originator may identify Subsequent Entries using either the TEL or WEB SEC Codes.

Recurring Entry Debits and Single Entry Debits

Where an Originator has obtained an oral authorization from a consumer via a telephone call for debit Recurring Entries or a debit Single Entry, the Originator must identify these debits using the TEL Standard Entry Class Code.

Subsequent Entries Initiated in Accordance with a Standing Authorization

Where an Originator has obtained a Standing Authorization from a consumer orally via a telephone call, the Originator has the option to identify Subsequent Entries as either TEL entries or, if the terms of the Standing Authorization permit the Receiver to initiate the Subsequent Entries via the Internet or Wireless Network, as WEB entries. (Note: An Originator may not identify these Subsequent Entries as PPD entries.)

Recurring Entry Debits and Single Entry Debits

Where a consumer’s oral authorization for a Recurring or Single Entry debit is communicated to the Originator via the Internet or Wireless Network, the Originator must identify these entries as WEB debit entries.

Subsequent Entries Initiated in Accordance with a Standing Authorization

Where an Originator has obtained a consumer’s Standing Authorization orally via the Internet or a Wireless Network (e.g., via a virtual assistant such as Alexa, Cortana, or Siri; or via a Skype or FaceTime session), the Originator has the option to identify Subsequent Entries as either WEB entries or, if the terms of the Standing Authorization permit the Receiver to initiate the Subsequent Entries via a telephone call, as TEL entries. (Note: An Originator may not identify these Subsequent Entries as PPD entries.)

A Subsequent Entry to a Consumer Account initiated at an “electronic terminal,” as that term is defined in Regulation E, must be identified using the POS or MTE SEC Code, as applicable, regardless of the manner in which the Standing Authorization was obtained.

Not necessarily. The Rules permit the Originator some flexibility in the choice of Standard Entry Class Code for the initiation of Subsequent Entries. In most cases, the choice to modify the SEC Code is optional, at the discretion of the Originator, except where Subsequent Entries are initiated at an electronic terminal (see Question #24, above).

An Originator may obtain a Consumer Receiver’s Oral Authorization for a debit Entry, provided that the Oral Authorization meets the minimum standards for a debit authorization in Subsections 2.3.2.2 (Debit Entries) and 2.3.2.3 (Form of Authorization), and (b) meets the additional requirements, including use of the appropriate Standard Entry Class Code and security requirements, for the communication channel used to obtain the Oral Authorization.

Oral Authorization of Single Entries

For a Single Entry authorized by the Receiver orally, the Originator must (a) make an audio recording of the Oral Authorization or provide the Receiver with written notice confirming the Oral Authorization prior to the settlement of the Entry; and (b) retain the original or a duplicate audio recording of the Oral Authorization, or the original or a copy of the written notice confirming the Oral Authorization, for two years from the date of the authorization.

Oral Authorization of Recurring Entries

For a recurring Entry authorized by the Receiver orally, the Originator must (a) comply with the requirements of Regulation E for the authorization of preauthorized transfers, including the requirement to send a copy of the authorization to the Receiver, and (b) retain for two years from the termination or revocation of the authorization (i) the original or a duplicate audio recording of the Oral Authorization, and (ii) evidence that a copy of the authorization was provided to the Receiver in compliance with Regulation E.

Standing Authorizations Obtained Orally

For a Standing Authorization that is an Oral Authorization, the Originator must (a) make an audio recording of the Oral Authorization or provide the Receiver with written notice confirming the Oral Authorization prior to the settlement of the first Subsequent Entry; and (b) retain the original or duplicate audio recording of the Oral Authorization, or the original or copy of the written notice confirming the Oral Authorization, for two years from the termination or revocation of the Standing Authorization

Yes.

No. However, the new rules clarify the existing data security requirements as they apply to Oral Authorizations and Standing Authorizations when these authorizations are communicated via the Internet or other unsecured electronic network.

Yes. In any situation where a consumer Receiver’s Oral Authorization is conveyed to the Originator via the Internet or other unsecured electronic network (e.g., as a conversation with Alexa or Siri, or via Skype, FaceTime, etc.), the Originator must ensure that the banking information is encrypted or transmitted via a secure session, as required by Article One, Section 1.7 (Secure Transmission of ACH Information via Unsecured Electronic Networks).

No. Once set up, Recurring Entries require no additional action to be taken by the Receiver in order for the payments to be initiated. Subsequent Entries initiated in accordance with the terms of a Standing Authorization require an affirmative action to be taken by the Receiver for the initiation of each individual payment.

Yes.

No.

An RDFI that requests proof of authorization should be prepared to receive different types of responses to these requests from ODFIs. For example, an ODFI may provide an RDFI with copies of authorizations in a variety of media (e.g., in hard copy format, as an electronic format, as an audio file, etc.) In some cases, rather than providing a copy of the Receiver’s authorization, the ODFI may agree to accept the return of the entry in lieu of providing the requested proof of authorization. RDFIs should be prepared to accommodate these returns, with written documentation from the ODFI, by returning the entries using Return Reason Code R06 (ODFI Request for Return).

Where the ODFI has agreed to accept a return in lieu of providing the requested proof of authorization, and the RDFI still has need for a copy of the authorization, the RDFI will need to issue a subsequent written request to the ODFI. The ODFI must then provide proof of authorization within ten banking days.

Yes. An RDFI that has a need for a proof of authorization can still request the ODFI to provide it, even if the ODFI has accepted (or agreed to accept) the return entry. An RDFI will need to re-confirm its request to the ODFI.

No.

Yes.

For entries not expressly identifiable as a Single Entry, an Originator will be expected to make each change requested via an NOC unless the authorization for the entry in question clearly identifies the entry as a one-time payment.

No. The new rules simply reinforce existing rule language, which already permits any written record to be obtained or retained in electronic form, and permits documents required to be signed or similarly authenticated to be signed with an electronic signature in conformance with the requires of the E-Sign Act. The changes to language are intended to make clear that Written Statements of Unauthorized Debit may be obtained via electronic means, including via oral communication. RDFIs are encouraged to adopt electronic options for obtaining these documents as a customer service and to improve process efficiency.

Yes. An RDFI that obtains WSUDs electronically (including orally) must retain the electronic records in a form that accurately reflects the information in the record and that can be accurately reproduced. The RDFI must provide copies to the ODFI upon request.

An electronic version of a Written Statement of Unauthorized Debit must satisfy all minimum criteria defined within Article Three, subsection 3.12 (Written Statements of Unauthorized Debit), and must be capable of being stored and accurately reproduced for later reference.

No. Existing authorizations are not impacted by the new changes. However, as of the effective date of these changes, whenever a new authorization is executed or an existing authorization is updated, it must conform to the revised minimum standards for consumer debit authorizations.

Yes. All changes related to authorization share the same implementation date of September 17, 2021.

It depends…  Although all ACH Network participants are required to comply with the Nacha Operating Rules, including the changes included within the Meaningful Modernization ballots, many of the new changes will impact Originators, ODFIs, and RDFIs on a discretionary basis.

To the extent that an Originator chooses to offer consumer Receivers the option to authorize ACH payments orally, or to the extent that an Originator chooses to establish Standing Authorizations with its consumer Receivers, the Originator must comply with the new rules governing Oral Authorizations and Standing Authorizations. However, the Rules do not require an Originator to offer these authorization options to its customers, and whether it does so is at the discretion of the Originator. Nevertheless, Originators will be required to meet the new minimum data standards for all authorizations for consumer debit entries, regardless of the channels or methods used to obtain them.

To the extent that an ODFI wants the flexibility to choose to accept a late return in lieu of providing the RDFI with a copy of the Receiver’s authorization, the ODFI must comply with the new rules. An ODFI need not agree to accept a late return, but it must continue to provide all requested proofs of authorization to the RDFI in a timely manner.

RDFIs may choose (but are not required) to obtain Written Statements of Unauthorized Debit in an electronic form and should consider their business needs and the customer service experience when determining whether to offer electronic options to obtain these documents. With respect to RDFI requests for proof of authorization, RDFIs should prepare for the possibility that some ODFIs will grant permission for a late return instead of providing copies of authorizations. In cases where the RDFI still has need for proof of authorization after the ODFI’s agreement to accept a return, the RDFI will need to establish procedures to issue a subsequent request for a copy of the authorization.