Appendix 8.2K of NACHA operating rules state to "review internal procedures and customer agreements to ensure compliance with UCC4A with respect to ACH transactions. Can anyone shed any light on what this audit step is asking audit to check for?? I have the NACHA book and UCC in front of me and I am really confused

One of the UCC4A requirements is that you notify your customer when you receive an ACH credit transaction not subject to Regulation E, unless your contract with the customer waives the requirement.

John,

What if there is no contract with the customer. Are we suppose to have a contract with every single customer that receives ACH?

Also,
Why is the credit referred to as provisional credit? We credit the customer's account the same way as any ACH transaction?

Ah, but you do have a contract! It's your deposit contract, and you can use it to include the 4A language, just in case a wire or ACH comes in.

As you undoubtedly figured, this won't apply to consumer accounts, generally.

What about the security procedures under 4A? We recently performed an ACH audit and cited them for lack of proper security procedures. I just want to make sure that I understand this completely. Article 4A states, “A ‘security procedure’ means a procedure established by agreement of a customer and a receiving bank for the purpose of (i) verifying that a payment order or communication amending or canceling a payment order is that of the customer, or (ii) detecting error in the transmission or the content of the payment order or communication. A security procedure may require the use of algorithms or other codes, identifying words or numbers, encryption, callback procedures, or similar security devices. Comparison of a signature on a payment order or communication with an authorized specimen signature of the customer is not by itself a security procedure.” We specifically cited that a review of the controls in initiating and processing of wires revealed the bank only relies on the signature from the payment order. As specifically stated in the Article, comparison of a signature is not deemed to be a ‘security procedure’. We recommended at a minimum that call back procedures be implemented at least for a specific minimum dollar amount. Has anyone had any dealings with this part of Article 4A?