Fraud in the payments space is nothing new. In fact, it is fairly pervasive across the (now numerous) available payment systems. And despite the clear benefits of faster payments, the advent of faster, more easily accessible methods of payment has given rise to new opportunities for fraudsters.

From bill payment and payroll to the “behind the scenes” funds settlement mechanisms of various payment applications we use daily, one of the primary payment systems used by consumers and businesses alike is the ACH network. The National Automated Clearing House Association (“Nacha”) establishes the rules governing the ACH network (“Rules”). In March of 2024, Nacha voted on and approved 15 amendments to the Rules, including several revisions that are intended to strengthen the ACH network participants’ ability to detect potential fraud and to efficiently recover funds in the event that fraud does take place (collectively, the “Risk Management Topics”). Several of these Risk Management Topics go into effect on October 1, 2024, while others that may require more lead time from a technical perspective have staggered effective dates over the next few years. Understanding the requirements, and the opportunities, presented by these new Risk Management Topics is critical for financial institutions and corporations, alike. Below is a high-level summary of the new Risk Management Topics for your consideration.

1. Expanded Use Cases of the R17 and R06 Return Reason Codes. When a financial institution receives a debit or credit entry from another financial institution through the ACH network, the Rules permit the Receiving Depository Financial Institution (“RDFI”) to return that entry to the Originating Depository Financial Institution (“ODFI”). The RDFI must follow explicit parameters set forth in the Rules surrounding the return of these ACH entries, including that a Return Reason Code, identifying the reason for the return, be attached to the returned entry. The new revisions to the R06 and R17 Return Reason Codes provide both ODFIs and RDFIs with more discretion with respect to the return of entries they suspect to be fraudulent.

Prior to October 1, 2024, the R06 Return Reason Code was used by ODFIs to request that the RDFI return an entry that was either an “Erroneous Entry” (which is narrowly defined) or that was a credit entry initiated without the authorization of the Originator. The new revision allows ODFIs to use R06 to request a return from the RDFI for any reason.

The R17 Return Reason Code was previously used by RDFIs to return entries that: (a) it could not process; (b) contained an invalid account number and which the RDFI suspected was initiated under questionable circumstances; or (c) the RDFI or the account holder (“Receiver”) identified as being an improper reversal of an entry. As revised, RDFIs can use R17 to return entries they believe to be initiated under “questionable circumstances” without requiring that there also be an error with the account number. This include entries transmitted without an Originator’s authorization and entries that are originated under False Pretenses (as defined below).

Financial institutions should ensure their internal procedures reflect the new use cases of R06 and R17, and corporates should be educated in their additional avenues for requesting/ initiating returns through their financial institution.

2. Additional Funds Availability Exceptions. Previously, the Rules allowed an RDFI to delay funds availability of ACH credits to a Receiver if the RDFI reasonably believed it was an unauthorized credit entry (e.g. in the event of an account takeover of an Originator’s account). As revised, the Rules will now also allow an RDFI to delay funds availability if it reasonably believes that a credit was unlawful, suspicious, or otherwise sent under False Pretenses. The revised Rules define “False Pretenses” as “the inducement of a payment by a Person misrepresenting: (a) that Person’s identity, (b) that Person’s association with or authority to act on behalf of another Person, or (c) the ownership of an account to be credited.” This definition is intended to cover common fraud scenarios like business email compromise, vendor impersonation, and other payee impersonations where the Originator is induced by a third party to authorize an entry. Identifying what is, and what is not, an instance of False Pretenses is nuanced; for example, while a business email compromise or vendor impersonation that induces someone to make a payment to a fraudster would constitute False Pretenses, a corporate account takeover or a payment intentionally made to a legitimate Receiver who then uses the funds for something other than for the Originator’s intended purpose would not. RDFIs will need to review their internal policies and procedures with respect to monitoring potential unauthorized credits and credits initiated under False Pretenses.

3. Timing of Written Statements of Unauthorized Debit (“WSUDs”) and Prompt Return of Unauthorized Debits. The existing Rules require that an RDFI receive a WSUD from consumers on or after the Settlement Date (as defined in the Rules) of an unauthorized debit in order to return it as unauthorized. However, technological developments have created an environment where a Receiver may become aware of a pending unauthorized debit before its actual Settlement Date. The new revisions to the Rules allow for more flexibility in the timing of a consumer completing a WSUD. The existing Rules were also silent as to exactly how quickly an RDFI was required to take action based on a WSUD it received from a consumer Receiver; it merely required that entries returned as unauthorized be transmitted to the ODFI within a certain timeframe. Now, there is a requirement that RDFIs return such unauthorized entries no later than the opening of business on the sixth (6^th) banking day following the completion of their review of the Receiver’s signed WSUD. The revisions related to consumer WSUDs and unauthorized debits are designed to allow Receivers and RDFIs to more quickly respond to potential unauthorized debits, thus mitigating risk of additional fraudulent transactions and helping make the affected parties whole more quickly. RDFIs will need to review their internal policies and procedures associated with the handling of WSUDs and returning entries as unauthorized.

4. Fraud Monitoring by Non-Consumer Originators, Third-Party Senders, Third-Party Service Providers, and ODFIs. The current Rules require non-consumer Originators to, among other things, use commercially reasonable fraudulent transaction detection systems when originating WEB debits and also when originating Micro-Entries. However, there was no corresponding requirement with respect to other SEC codes or to credits other than Micro-Entries. The revised Rules will require non-consumer Originators and ODFIs, as well as Third-Party Senders and Third-Party Service Providers (as each are defined in the Rules), to develop risk-based policies and procedures to identify fraudulent transactions more broadly. Importantly, a risk-based analysis cannot be used to conclude that no monitoring is needed on a going-forward basis. All non-consumer Originators, Third-Party Senders, Third-Party Service Providers and ODFIs should, at a minimum, conduct risk assessments to identify, qualify, and quantify the risks they face. All impacted parties should also evaluate their current policies and procedures, update them accordingly, and continue to review them on an annual basis and update as needed.

5. Credit Monitoring by RDFIs. Historically, the onus has been on Originators and ODFIs to safeguard against fraudulent credit entries entering the ACH network, with the RDFIs having been largely omitted from that responsibility. However, RDFIs are in the unique position of being able to recognize when a Receiver’s account is receiving atypical credit entries (for example, based on their typical account balance, or the age of the account). Thus, under the revised Rules, RDFIs will now be required to establish and implement processes and procedures to help identify and mitigate fraudulent credit entries. RDFIs should update their internal policies and procedures to include this new monitoring obligation, and should ensure staff is appropriately trained to perform whatever monitoring the RDFI decides to implement.

6. Standard Company Entry Descriptions: PAYROLL and PURCHASE. The Company Entry Description field of ACH files already exists under the Rules; it is a 10-character field and is used to identify batches containing certain types of entries, including for reversals (“REVERSAL”) and for reinitiated entries (“RETRY PYMT”). The new updates to the Rules will require that non-consumer Originators, ODFIs, Third-Party Senders and Third-Party Service Providers to also use two new Company Entry Descriptions: (a) PPD credits for the payment of wages or other similar compensation must include the Company Enty Description of “PAYROLL”; and (b) e-commerce purchases, which are debits authorized by a consumer online for the online purchase of goods, must include the Company Entry Description of “PURCHASE.” The goal in adding these qualifiers is to help all of the network participants more readily identify, and monitor, transaction types that are frequently associated with fraudulent transactions. Non-consumer Originators, ODFIs, Third-Party Senders and Third-Party Service Providers (as applicable) will need to ensure they are categorizing their payments and using these new Company Entry Descriptions in creating their files.

While the above Risk Management Topics may require substantial changes to the policies and procedures of the affected participants, the overarching result is expected to be a more secure network that is more readily able to stave off, combat, and ultimately remedy fraud.

Please contact us if you have any questions or concerns about how the Risk Management Topics will affect your institution.

For years, “FBO” has been one the payments industry’s favorite buzz words. The FBO account structure has been a common “best practice” by payments providers seeking to remove themselves from the flow of funds to reduce their risk of being regulated as a money transmitter. As a foundational matter, FBO accounts are merely custodial depository accounts maintained at financial institutions and established “for the benefit of” (FBO) intended beneficiaries of funds in the accounts. The structures of such accounts can vary. Typically, in the payments space, these accounts are structured to be bank-owned and held for the benefit of the payments provider’s customer (often a merchant or sub-merchant), rather than for the payments provider itself, to maximize the protections afforded by removing the payments provider from the flow of funds. Under this model, the payments provider can instruct the bank to move funds in and out of the FBO account as authorized by the payments provider’s customer, without ever taking actual possession or control over the funds.

While this structure remains foundational to countless arrangements between banks and their fintech partners, the risks created by the misuse of this structure has led the Federal Deposit Insurance Corporation (FDIC) to issue a proposed rule which would impose extensive requirements on FDIC insured depository institutions (IDI) with respect to “custodial deposit accounts with transactional features” – FBO accounts included. This proposed rule comes amid heighted scrutiny of bank and fintech arrangements by the federal banking regulators. The requirements set forth in this proposed rule would not only impact the IDIs but would also have a substantial impact on payments providers whose business models and operations rely upon the availability of these types of account structures.

The proposed rule is complex and technical. So, we’ve boiled down the basics here in an FAQ format to demystify the implications this proposed rule would have on the payments industry.

Q:  What prompted the proposed rule?

A:   The proposed rule was ultimately prompted by consumer confusion about whether funds placed with IDIs through arrangements with non-bank payments providers qualify for FDIC protection and concern for their ability to access and recover such funds. In particular, the FDIC cites the bankruptcy of Synapse Financial Technologies, Inc. (Synapse), a technology company that worked with several IDIs and numerous fintechs. The Synapse bankruptcy affected consumers’ ability to access funds placed at IDIs in FBO and custodial accounts for a number of months. In some instances, it was advertised that the funds were FDIC insured. Following the bankruptcy, the IDIs that were holding customer funds had difficulty obtaining, reviewing, and reconciling Synapse’s records to determine the ownership of those funds. This caused detrimental harm to many customers who were unable to receive funds needed to cover daily expenses.

The Synapse bankruptcy was just one prime example provided by the FDIC. It highlighted that the use of “custodial accounts with transactional features” presents significant hurdles and corresponding delays in the FDIC’s ability to make deposit insurance determinations. In recent months, the FDIC has taken action against a number of IDIs seeking to address concerns related to bank/fintech partnerships and now seeks to address the issues it has identified consistently among all IDIs through the proposed rule.

Q: What are the FDIC’s objectives and intentions for the proposed rule?

A:   The FDIC seeks to:

• Strengthen IDI recordkeeping requirements for “custodial deposit accounts with transactional features” (which includes FBO accounts);
• Preserve beneficial owners’ and depositors’ entitlement to the protections afforded by federal deposit insurance;
• Promote the FDIC’s ability to promptly make deposit insurance determinations;
• Enable the FDIC to pay deposit insurance claims “as soon as possible” in the event of a failure of an IDI holding custodial accounts with transactional features; and
• Promote timely access to funds (even in the absence of an IDI failure).

Q: Who does the proposed rule apply to?

A: The proposed rule directly applies to all IDIs, regardless of size, who offer custodial accounts with transactional features (subject to exemptions for specific types of custodial accounts). The proposed rule would apply regardless of how many custodial accounts with transactional features are held at the IDI and regardless of how many beneficial owners funds’ are held within such accounts. The FDIC seeks comment on whether there should be a minimum threshold for applying the requirements of the proposed rule.

If made final, fintechs and other-non bank payments providers will be impacted through operational and contractual changes in their relationships with IDI partners that will be required as a result of the proposed rule. 

Q: What is a “custodial deposit account” under the proposed rule?

A: A “custodial deposit account” for purposes of the proposed rule is a relationship where one party is responsible for opening a deposit account at an IDI on behalf of others who may own the funds but do not have a direct relationship with the bank. 

Q: What are “custodial accounts with transactional features” under the proposed rule?

A: A deposit account that:

• Is established for the benefit of beneficial owner(s);
• Holds commingled deposits of multiple beneficial owners; and
• The beneficial owner(s) may authorize or direct a transfer from to a party other than the account holder or the beneficial owner(s) (e.g. to make a purchase or pay a bill).

If funds in the custodial account are only returned to either the beneficial owner or the account holder, and would not be transferred to third parties, the account would fall outside the scope of the types of accounts covered by the proposed rule. However, the FDIC questions whether it should apply the proposed rule’s recordkeeping requirements to all custodial deposit accounts, and not just those with “transactional features.”

Q: How does the proposed rule differentiate between a “beneficial owner” and an “account holder”?

A: A “beneficial owner” would be defined as “a person or entity that owns, under applicable law, the funds in a custodial account.” An “account holder” would be “the person or entity who opens or establishes a custodial account with transactional features with an insured depository institution.” So, in the case of a fintech or other non-bank payments provider that establishes an account at an IDI for the benefit of its customers, even if the account is titled in the name of the IDI itself for the benefit of the fintech’s customers, the fintech would be the “account holder” under the proposed rule because it contracted with the IDI to establish the account.

Q: What types of custodial deposit accounts are exempt from the rule?

A:   The proposed rule exempts certain custodial deposit accounts that already have stringent recordkeeping requirements under applicable law, including custodial deposit accounts which are:

• Only used to hold trust deposits;
• Established by government depositors, such as accounts maintained for the payment of government benefits;
• Established by brokers or dealers under the Securities and Exchange Act of 1934, and investment advisers under the Investment Advisers Act of 1940;
• Established by attorneys or law firms on behalf of clients, commonly known as interest on lawyers trust accounts (IOLTA accounts);
• Used in connection with employee benefit plans and retirement plans;
• Maintained by real estate brokers, real estate agents, title companies, and qualified intermediaries under the Internal Revenue Code;
• Maintained by mortgage servicers in a custodial or other fiduciary capacity;
• Protected by applicable federal or state law prohibiting the disclosure of the identities of the beneficial owners of the deposits;
• Maintained by virtue of agreements to allocate/distribute deposits among participating IDIs in a network for purposes other than payment transactions of customers of the IDI or participating IDIs; or
• Used to hold security deposits tied to property owners for a homeownership, condominium, or other similar housing association governed by state law, and accounts holding security deposits tied to residential or commercial leasehold interests.

The FDIC invites comments on whether there are other categories of custodial deposit accounts that should be exempt from the proposed rule.

Q: Can IDIs still contract with third parties to maintain the beneficial ownership records relating to the custodial account?

A: Yes, an IDI would still be able to contract with a third party (such as, for example, a vendor, processor, software or service provider or similar entity), provided that enhanced requirements are satisfied. These include:

• The IDI having direct, continuous and unrestricted access to the beneficial owner records maintained by the third party, including in the event of the business interruption, insolvency or bankruptcy of the third party;
• The IDI having a business continuity plan in place, including backup recordkeeping for the required beneficial ownership records and technical capabilities to ensure compliance with the proposal’s requirements;
• The IDI implementing appropriate internal controls to:

(a) accurately determine the respective beneficial ownership interests associated with the custodial deposit account with transactional features; and

(b) conduct reconciliations against the beneficial ownership records no less frequently than the close of business daily;

• Annually validating the third party’s records, where such validation is performed by persons or entities independent of the third party, in order to assess and verify that the third party is maintaining accurate and complete records consistent with the proposal’s provisions;
• The third party maintaining the records in a specific electronic file format (as must the IDI if it maintains the records itself); and
• The IDI having a direct contractual relationship with the third party that includes risk mitigation measures.

The additional requirements are intended to promote the integrity of the records and ensure that the IDI has continued access.

Q: What actions would IDIs need to take if the proposed rule is adopted?

A:   The proposed rule would require that IDIs holding custodial accounts with transactional features implement the following:

• Recordkeeping. Maintain records relating to the account using a specific file format. The records would need to identify:
  • The beneficial owners of the custodial account;
  • The balance attributable to each beneficial owner; and
  • The ownership category in which the beneficial owner holds the deposited funds.

Records would also need to be maintained in a specific electronic file format with required fields for records of beneficial owners and their interests in the deposited funds. The specific format is described in Appendix A of the proposed rule.

• Internal Controls. Implement and maintain internal controls to ensure that account balances are accurate. Such internal controls should be tailored to the individual IDI based on its unique circumstances, including its size and the scope of its risk appetite, but must include:
  • Maintaining accurate account balances, including the respective individual beneficial ownership interests associated with the custodial deposit account; and
  • Reconciling account balances against beneficial ownership records no less frequently than as of the close of business daily.
• Written Policies and Procedures. Establish written policies and procedures to achieve compliance with the proposed rule’s requirements.
• Annual Certification and Report. Annually complete and submit to the FDIC and to the IDI’s primary regulator:
  • A certification confirming the institution’s compliance with, and testing of, the proposed requirements
  • A report that:
    • Describes material changes to information technology systems relevant to compliance with the rule;
    • Lists account holders that maintain custodial deposit accounts with transactional features, total balance of the custodial deposit accounts and the total number of beneficial owners;
    • Sets forth the results of the institution testing of its recordkeeping requirements; and
    • Provides results of independent validation of any records maintained by third parties.

As a result of actions required by the proposed rule, the IDI would also need to review and update its contracts with its existing fintech partners.

Q: What happens if an IDI does not comply with the proposed rule, if adopted?

A: IDIs would be subject to examination by their primary federal regulator and enforcement actions for failures to comply that could result in cease-and-desist orders and civil money penalties. 

Q: What does the proposed rule mean for the IDIs’ non-bank partners?

A: Fintechs and other non-bank partners that contract with IDIs and assume the recordkeeping responsibilities of the IDI will need to provide the IDI with additional and continuous access to records and submit to review and verification by an outside, independent entity on an annual basis. IDIs will increase scrutiny on fintechs and other non-bank partners and make these types of accounts available to a fewer number of well-established fintech and non-bank partners. The costs associated with these account types will also likely increase.

Q: Would the rule apply retroactively to FBO accounts that were established before the proposed rule became effective?

A: Yes. The proposed rule would apply to custodial deposit accounts with transactional features regardless of when the account was established (before or after the proposed rule’s effective date). Thus, current agreements between IDIs and their fintech partners with respect to these types of accounts would need to be updated accordingly.

Q: What should IDIs do now in anticipation of the proposed rule becoming final?

A: IDIs can prepare by:

• Reviewing the nature of their relationships with non-bank companies to determine whether such non-bank companies have custodial deposit accounts at the IDIs that fall under the scope of the proposed rule;
• Analyzing the anticipated costs and benefits of accepting and maintaining custodial deposit account relationships with non-bank companies if the proposed rule is adopted;
• Investigating the technical requirements of having data transmitted from account holders in the format required by the proposed rule;
• Developing a recordkeeping system for maintaining required data;
• Assessing capabilities of existing platforms or core processing systems to satisfy the requirements of the proposed rule;
• Developing or procuring data interface systems, where necessary;
• Submitting comments to the proposed rule, if desired, before the deadline;
• Collecting agreements with third parties in anticipation of updating obligations and responsibilities if the proposed rule is adopted; and
• Identifying which existing policies and procedures may be impacted.

Q: What should IDI partners do now in anticipation of the proposed rule becoming final?

A: IDI partners relying on FBO accounts at IDIs should:

• Consider whether to submit a response to the proposed rule;
• Identify any gaps between current operations, processes, and technical capabilities against the requirements of the proposed rule;
• Evaluate existing internal systems, policies or procedures; and
• Review business arrangements with other partners and fintechs.

Q: What is the future of FBO Accounts?

A: Regardless of whether this proposed rule becomes final, we can anticipate that there will be changes to FBO and custodial account models given recent events that put a magnifying glass on risks that can arise. While there will certainly be more hoops to jump through for many of the FBO account structures in use today, if the rule becomes final, the use of FBO and custodial accounts in IDI and fintech relationships will still be viable. However, we can reasonably anticipate that as the regulators increase scrutiny of these account structures (and bank-fintech arrangements, generally), IDIs will follow suit and further limit the availability of these products and increase costs to fintech partners as part of their own risk mitigation.

Q: What does this proposed rule mean for you?

A: Whether you are an IDI, fintech, or non-bank payments provider that leverages an FBO or custodial account as part of your operations, this proposed rule will have significant impact on you if made final. If you would like to understand the impact to your specific operations or if you are looking for guidance on the comment letter process, please reach out to a member of Taft’s Paytech and Payment Systems Team directly.