ACH Rules, Regulations, and Compliance
Four overlapping rulebooks
- Nacha Operating Rules - binding contractually, through the ODFI's agreement, not by statute.
- Regulation E - federal consumer protection: error resolution, stop payments, disclosures, remittance transfers. Consumer accounts only.
- UCC Article 4A - governs commercial (non-consumer) funds transfers and may be varied by agreement.
- Regulation J, Reg CC, OFAC, and state law - the Fed's ACH provisions, funds availability, sanctions screening, licensing.
Where federal law and the Rules conflict, the law prevails; the Rules routinely defer to it.
Compliance obligations
Every participating DFI, Third-Party Sender, and participating service provider must complete an annual Rules compliance audit by December 31 and maintain a periodic risk assessment. Authorization records must be retained for two years after termination or revocation.
Traps
- A corporate Receiver cannot invoke Reg E error resolution.
- Reg E's 60-day consumer notice window (measured from the statement showing the problem) is not the same as the RDFI's 60-calendar-day return right for unauthorized consumer debits.
- The Rules are a private contract, not a statute.
- A consumer stop payment must be honored if received at least three business days before the debit is scheduled.
Rule of thumb: Reg E for consumers, UCC 4A for companies, the Rules as the operating manual, OFAC above everything. Worked example: a consumer disputes a WEB debit 45 days after the statement containing it was sent - timely under Reg E, so the RDFI must investigate and generally provide provisional credit.