A.)   As long as the entry posts automatically to a valid account, the RDFI is not liable (except for payments that are later subject to reclamation). If an entry is deemed suspicious or fraudulent, your next steps should be to notify your BSA Compliance Officer and follow your BSA/AML procedures. Financial institutions don’t have to make the funds immediately available as defined by Regulation CC, which allows for the funds to be held while an investigation is being conducted. If you, as the RDFI (or together with the account holder), decide the entry is to be returned, you should use the ACH return reason code that best fits the situation. If the account holder notices it and claims it’s not theirs, return it R23. Another return code that sends the best message for some of these transactions is the R17; keeping in mind “QUESTIONABLE” must be listed in the addenda of the return. Don’t forget the 2-day return timeframe for the R17 (RDFIs need to react fast). Another option would be the R03 since the name on the account doesn’t match the name on the transaction. We have spoken to Nacha, and you are encouraged to be timely, so the R17 works within the 2 day timeframe only. Since R23 doesn’t have a timeframe tied to it, this can be used if you are outside your R17 opportunity, even if the transaction was not brought to your attention by your account holder. And the R03 is also an option. In this particular wave of fraud, the ODFIs are likely not accepting R06, since you would want a Letter of Indemnification from them. Focus on the best return reason code; the use of R23, R17 and R03 will be your best line of defense.

We will continue to communicate with our payments industry partners and provide additional details, when available, via the Payments Pulse newsletter and TCHPA home page.