Complying with Nacha’s New WEB Debit Rule

In 2018, the National Automated Clearing House Association (Nacha) approved a new rule, which strengthens the requirements for originators of WEB debits. WEB debits are internet-initiated ACH transactions where money is pulled from a consumer bank account using authorization given via the internet or wireless network.

The rule was supposed to go into effect last year, but the Nacha Board of Directors approved an extension to March 19 to allow the industry time to get guidance on what changes need to be made to be in compliance.

About Nacha Rules

Nacha Operating Rules are meant to ensure every ACH payment moves smoothly through the network and to provide governance over sensitive customer information—how it’s stored, who can access it, and where and with whom it can be shared. Sensitive customer information can mean both financial and non-financial data, such as bank account numbers, routing numbers, social security numbers and addresses.

Everyone who uses the ACH network, from consumers to businesses to financial institutions, has a responsibility to comply with the Nacha Operating Rules. The rules are updated annually, so it’s important to be aware about any changes.

The Old WEB Debit Rule

The old rule was that originators of WEB debits would have to screen the payment with a “commercially reasonable fraudulent transaction detection system,” but did not specify account validation as part of the process. This means that businesses that required customers to manually enter account information for ACH payments did not have to ensure the account was open and able to accept ACH payments.

The New WEB Debit Rule

The new WEB Debit Account Validation Rule strengthened the requirement by explicitly stating that account validation be part of “commercially reasonable” fraud detection. This new obligation is meant to prevent fraudulent ACH payments and protect Receiving Depository Financial Institutions (RDFIs) from posting incorrect or unauthorized payments.

While businesses must now make sure accounts are valid, the new rule does not require verifying account ownership. It also does not apply to existing account numbers that have been previously used for WEB debits, only new account numbers. Though the rule took effect on March 19, 2021, Nacha will not enforce it against any company working toward compliance in good faith until March 19, 2022.

When it comes to ways companies can attempt account validation, Nacha is method agnostic, but you can consult their resource center for helpful information. If you use Modern Treasury, you have the option of verifying a customer account as a means of compliance, whether through instant verification via our Plaid integration, or through microdeposits and prenotes. Using one of these options can also help minimize failed payments. If you are curious about how to integrate account validation into your payment workflow to ensure compliance with the new rule, send us a note.