What are the ramifications for us if we originate an ACH debit on behalf of our customer (say, to pay their loan payment) and we don't have proof of authorization. Are the fines associated with this? Or are we only subject to having to return the money to the customer's other account should they indicate that they did not provide authorization?

You mean you are debting your own customers for loan payments without an authorization?

We have authorization, but not recorded. So they call in, provide us with their info from another FI, we process the payment. Pushing toward recording authorization or obtaining written authorization (depending on one time or recurring), but am being asked for the risk of not having authorization as outlined in the NACHA rules.

if you have no proof of authorization, then you have no authorization. NACHA rules require you to furnish authorization within 10-days of the request from a RDFI; if you can't you could eat the item coming back. if a RDFI were to file a NACHA Rules Violation against you (lets say they have returned multiple items like this to you and are tired of dealing with it), then NACHA investigates, and depending on what you do/don't do, fines from them can get expensive. of course, then you have regulatory bodies, such as CFPB, which can levy astronomical amounts against a bank (go google CFPB enforcement actions). I could go on, but won't.

in short, you know you have a risk gap, go close it.

Tack on a violation of Reg E 1005.10(b) which requires written authorization which can carry class action lawsuits up to $500,000 plus non-compliance fines. While were at it, let's tack on UDAP for debiting customers without written consent.

Oh, and willful violation of NACHA rules can lead them to yank your authorization privileges on top of everything Happy already stated.

Would a one-time ACH be covered under 1005.10(b)? I thought preauthorized transfer only included recurring EFTs.

There is no re-occurring requirements. You cannot debit someone's account without authorization.

The requirement for written authorization though under Reg E is limited to Preauthorized EFTs though correct?

(b) Written authorization for preauthorized transfers from consumer's account. Preauthorized electronic fund transfers from a consumer's account may be authorized only by a writing signed or similarly authenticated by the consumer. The person that obtains the authorization shall provide a copy to the consumer.

(k) “Preauthorized electronic fund transfer” means an electronic fund transfer authorized in advance to recur at substantially regular intervals.

Yes - I guess that actually would be correct.

I can't remember, but what is the timeframe to obtain the preauthorization authorization from the customer for a reoccurring ACH payment, is it 3 business days or what?

Can you elaborate on your question a bit? What is the customer trying to do? There is a three business day before scheduled transfer requirement for the consumer to provide a stop payment order on a preauthorized (recurring) EFT from their account.

There is no stated timing for the first transaction. for subsequent recurring preauthorized variable amount transactions, if the amount is different that the preceding debit, it is 10 calendar days (OR8, 2.3.2.6(a)). if it is within a specified range or no different than preceding, no additional notice required (OR8, 2.3.2.6(b)).

Hmm I thought there was a timing for initial notification on recurring preauthorization, I guess not! Thanks!

Thanks John.. for some reason i thought there was timing requirement on set ups!