Good afternoon. An auditor asked me to point them to the rule in the NACHA Rules that specifically identifies the fact that information cannot be changed in an ACH file prior to it posting. For example: Can a member of the IT department change the dollar amount or account number? I have looked in the file format sections but am not seeing anything that specifically addresses that question. Can someone point me in the right direction? Thanks!

A member of your IT department has access and edit capability to ACH files??

No, not to my knowledge. We are being asked to provide the NACHA siting that indicates this is not possible and I am not able to find anything in the rules that addresses this specifically.

Are you talking about incoming ACH files as a RDFI. What in the world would they be altering? Sounds like a significant risk to me. They could redirect incoming ACHs to an account that they control and be gone with the funds before anyone was the wiser. The same goes for ODFI outgoing files. I just cannot imagine a reason for someone in IT to be or allowed to altering these files.

I'm a little confused on why your auditor wants you to 'prove' this statement. Is this an internal or external auditor?

External. We are a Fintech and governed by FINRA. They are not accustomed to ACH processing. This is the first I have ever been asked this question also. But, I need to prove this to them.

Here is the exact verbiage from their email:

determine the specific NACHA rule(s) which state that forward settling ACH transactions can’t be altered, cancelled, delayed, etc. once they’ve been originated.

I don't believe you will find such wording. reversal entries are allowed, and nacha specifically addresses delays such as a banks being closed on settlement day and actions that should be taken, as well as excused delays.

you could contact your local nacha affiliate for further guidance

I am really confused by their request. I would be getting back with the auditor and asking for a full explanation as to what this is about and exactly why are they asking for this information.

We are considering providing ACH payroll credits to our members on the date received versus on the settlement date. They want to be sure that if we post $500 to our member today, that we will definitely receive $500 on the settlement date.

That's a different question. There's a credit union in my state that has advertised for years that their members can get access to their payroll deposits two days before payday. This may be the way they accomplish that.

However, there's no absolute guarantee that settlement will occur. For example, the sending bank could fail and its payments could be suspended. Highly unlikely, bot a possibility. There could be a payroll error resulting in a reversing entry that hits on the settlement date for the credit sent in error.

I agree John, but they are also looking for proof that the originator cannot change the dollar amount. I have indicated that the RDFI must post what is received and settlement will occur on the date indicated (with minimal exception) but they want to see where NACHA has mandated that.

while the dollar amount can't be changed once the file is processed, they can put through a reversal of the entire amount if it meets the requirements set by nacha for reversing erroneous payments.

provide them a copy of the nacha rules and point them to the sections on settlement found in the index...

Why would anyone change a dollar amount on a file received by an RDFI? The settlement amount that the RDFI will receive will be based on the amount in the original ACH file. Someone is going to be out of balance if the RDFI does that. I don't think you need a rule to figure that one out.

No dollar entry can be changed once the ODFI has transmitted it to its ACH Operator. Once submitted an entry must be posted or returned by the RDFI. The ODFI can submit a Request for Return or a Reversing Entry, but only for the full amount of the entry.

For citations, see:Nacha operating rules sections 2.7, 2.8 and 2.9 on pages OR25 - OR27 in the 2020 Nacha Operating Rules & Guidelines.