NACHA’s 2021 rule: what does it mean for your business?

Companies that debit funds over the ACH network will soon be required to validate customer bank accounts. Find out how you can implement a solution.

Eric Morse is a product manager at Plaid. He is passionate about the future of payments in the US and around the world.

ACH is the backbone of the online payments system.

Americans sent or received more than $51 trillion in ACH payments in 2018, representing nearly 23 billion individual electronic transactions. That amounts to nearly 82% of the value of all US payments.

And with ACH transactions growing by double digits annually, there’s concern that these transactions could become a vector for fraud. That’s why NACHA, the organization that administers the Automated Clearing House (ACH) payment system, is pushing for stronger anti-fraud controls, including a new rule requiring account validation.

In this article, we’ll answer the following questions:

  • Are your payments compliant? 👮
  • How can you validate user bank accounts? 🔎
  • Which validation tool should you choose? 🛠️
  • Why is NACHA addressing this issue? 👪

Are your payments compliant?

Under the new rule, the way many firms have handled ACH payments in the past will no longer be compliant.

Beginning in March 2021, NACHA will implement a new rule requiring businesses that debit funds via ACH for online orders to implement enhanced fraud detection. Specifically, the organization will require such businesses to include, at a minimum, “account validation” as part of a “commercially reasonable fraudulent transaction detection system.”

The change will enhance NACHA’s anti-fraud efforts. In plain English, account validation means checking to make sure that the account submitted for a given ACH transaction is valid.

"While 2021 may seem far off, it’s important to get ahead of these changes before they become pain points."

More precisely, businesses that ask their customers to manually enter their account and routing numbers but don’t perform account validation will not be compliant. (Worth noting: the upcoming rule change doesn’t affect credit or debit card payments.)

The implementation deadline was originally set for January 2020, but NACHA pushed it back to March 2021 in order to give online merchants, financial institutions, and other businesses more time to get ready. All together, NACHA represents more than 10,000 financial institutions, so the impact will be broad and far-reaching.

While 2021 may seem far off, it’s important to get ahead of these changes before they become pain points. At larger firms, technology procurement and implementation frequently take 6-18 months. And even if you happen to be compliant today, you can use the upcoming milestones as a springboard to improve your payments experience. (article continues below)


How can you validate customer bank accounts?

Broadly speaking, there are five approaches to account validation that will be acceptable under the new rule. They vary widely in terms of time, user experience, and cost.

  • Manual validation 👋Here you obtain a customer’s voided check or contact their bank to verify the account and routing numbers. Requiring up to six days, manual validation is the most labor-intensive and friction-prone option.
  • Microdeposits 🔬These typically involve two steps. Businesses make one or two small deposits (usually just a few pennies) into a customer’s account. The customer then confirms the amounts deposited. It takes 2-3 days, and customers often fail to complete the process.
  • Pre-notes 📝Also known as pre-notification transactions, these are similar to microdeposits—but they don’t require confirmation from the customer. The counterparty sends a $0 transaction through the ACH network to verify that the account is valid. Pre-notes take 2-3 days, and be warned: customers can’t initiate payments using this type of account validation. Additionally, NACHA Rules don’t allow you to place the actual debit instruction to move funds until three business days after the pre-notification is sent.
  • Database verification 📊Here you cross-reference account and routing numbers against a database maintained by a consortium of banks. EWS is a good example. While this method proves that the bank account exists, it does not verify that the requesting person is the account owner. This opens your business up to not only fraud, but also costly errors that people make when they manually enter their bank account and routing numbers. On the positive side, database verification takes just seconds to complete.
  • Instant account verification ✅ This method utilizes application program interfaces (APIs) and secure digital connections to banks, with account and routing numbers retrieved directly from the accounts being authenticated. Customers simply select their bank from a list, enter their bank login and password, and their accounts are digitally connected in 7-11 seconds. In addition to linking accounts, some APIs can also be used to retrieve balance, identity, and transactions information. (article continues below)

Which tool for account validation should you choose?

Different account validation methods vary widely in terms of their speed, security, data quality, and customer experience.

Many companies currently validate accounts with unwieldy methods like microdeposits and voided checks. While they may be more affordable, these options have several distinct disadvantages:

  • Delays ⏳ Microdeposits require 2-3 days to complete. Pre-notifications (zero-dollar inquiries using ACH in anticipation of a dollar transaction) may also take several days, and manual validation requires customers to provide a voided check. In the meantime, they can’t pay and may seek an alternative.
  • High drop-off rates 💔In today’s competitive payments landscape, many people simply walk away from validation methods like those mentioned above. Even customers who intend to complete the process may get lost, get stuck, or simply forget.
  • Opacity ⛅ Most validation methods don’t include visibility into the customer’s bank account balance, increasing the risk for failed transactions, NSF/overdraft fees—even removal from the ACH network, if chargebacks become excessive.

Optimizing account validation by moving to instant account verification not only helps you convert more customers; it can help you retain them. Some providers also allow you to access other kinds of consumer-permissioned financial data: things like transactions and identity.

When you add it all up, it can lead to:

  • Higher conversion rates 📈After peer-to-peer lending platform SoLo switched to instant account verification, its conversion rate jumped from 45% to 77%.
  • Fewer NSF/overdraft fees 💸By verifying balances through account connections generated by instant account verification, Qapital has saved its users more than $2.7 million in overdraft fees.
  • Less fraud ⚠️Visibility into things like customer name, address, and age of account gives payments originators additional data points to consider during the onboarding and KYC processes. It can reduce fraud risk, investigations, and collections.

For example, Carvana, an online car-sales company, used to be forced to conduct three-way calls with customers and their banks to ensure that they had sufficient funds. Now they perform real-time balance checks through account connections established by instant account validation.

Another example: peer-to-peer payments company Metal Pay was experiencing significant fraud during a marketing push that included a referral bonus. By supplementing their account verification flow with identity data, they were able to prevent $75,000 of fraud in a single month. (article continues below)

Now that NACHA has given originators of online ACH debits extra time to comply, they should aspire to go beyond what is merely compliant and offer an exceptional payments experience. (article continues below)


Why is NACHA addressing this issue?

ACH fraud may be rare, but it can be devastating for those whom it affects. This new rule is designed to reduce ACH fraud and returns.

First it’s important to note that, although financial fraud is a serious problem, it’s not evenly distributed across payment types (e.g. cards vs. ACH), and its effects are not evenly felt.

According to the Nilson Report, losses due to credit and debit card fraud in the United States totaled $8.45 billion in 2016, the last year for which detailed numbers are available. Last year, the frequency of fraudulent card transactions increased to 0.11% of the value of all card transactions—up from 0.07% in 2017.

"When end-users experience ACH fraud, they don’t just lose money. They stop trusting the businesses with whom they are transacting."

By contrast, ACH fraud is relatively rare. In fact, according to the Federal Reserve, ACH payments have the lowest fraud rate of any US payment method, representing just .0008% of the value of all ACH transactions. That rate has remained essentially flat since 2015.

In light of these statistics, the problem may seem small and far away. But it hardly feels that way for those who have experienced it. A few recent examples:

  • One software consultant 👨saw his bank account drained in just three days by fraudulent ACH withdrawals.
  • A B2B publishing company 📚lost nearly $50,000 when thieves gained access to their bank account last year.
  • A construction company 🏗in Maine lost nearly $600,000 to ACH fraud. Of that amount, they recovered only $230,000.

In these cases, customers don’t just lose money; they stop trusting the businesses with whom they are transacting. These are precisely the kinds of scenarios that the new NACHA rule is designed to eliminate. (article continues below)


The road ahead.

While the new NACHA rule will require many originators to make changes, it shouldn’t be viewed as a burden.

Rather, it’s an opportunity to create a better payments experience and a more secure ACH ecosystem. If originators implement it effectively, they can augment their competitive advantage and generate more consistent touchpoints with consumers.

In fact, the initial response has been enthusiastic. Before announcing the rule changes, NACHA conducted a Request for Comment (RFC) among financial institutions and originators of WEB debits. Of those who participated, fully 80% said they supported addition account validation to WEB debit fraud screening.

Eric Morse is a product manager at Plaid. He is passionate about the future of payments in the US and around the world.

Related Articles

ACH payments cost less. Will online shoppers ever switch?

For merchants, ACH payments often cost significantly less than credit cards. But steering consumers toward this payment method requires creativity and care.

9 min read

A roadmap to frictionless cross-border payments

Trillions of dollars are sent internationally each year—but the process remains costly and slow. Find out how new technology can streamline these payments.

7 min read

Are you a platform or a marketplace?

As your business grows and evolves, your decision will have broad implications for brand identity, growth strategy, international expansion, and payments.

7 min read