Under the changes to Reg E commentary effective 1.1.07 on stop pays on recurring items, it states that an institution need not have the capability to block preauthorized debits, but may instead use a third party to do so.

Our merchant processing area is getting questions from other institutions for whom we process about what we're doing to address this. My question- as the other institutions' processor, are WE required to provide this service to them? I was under the impression that they can go to a third party for the service, but as their processor, we are not required to handle this for them, realizing that we could lose their business to someone who could do both. Doesn't the responsibility ultimately fall back to the institution who owns the customer's deposit account?

Yes, the responsibility falls back on the account-holding institution. And no, you are not required to provide the service to that institution. Competition may force you to do so, but the regulation doesn't.

The addition to the Interpretation was made to put the Fed's imprimatur on arrangements like those offered by MasterCard and Visa and others. It merely clarifies that the account-holding institution does not have to rely only on its own resources to get the job done.

Thanks, John. Glad to hear I'm understanding correctly.

I always count it a good day when I'm understanding things.

Gentlemen, our existing system can 'block' ACH if the ACH Company ID is made available. What this means is that when a consumer notifies us to stop recurring ACH debits, they would need to provide the payee-originator's ACH Company ID to us. Without this, basically our system would 'suspect' the debit -- but the debit would post to the account, we would then reverse it out once we confirmed it was the correct payee-originator the following morning. Here's my question... would we be treading on thin ground by not accepting the customer's request unless the consumer can provide the ACH Company ID? I've read the commentary and 205.10(c)2 states that 'Once a financial institution has been notified that the consumer's authorization is no longer valid...' it does not get into what constitues notification or that the consumer needs to provide sufficient information for the bank to block such transactions.

If it's reoccurring, why can't you look the Company ID up from the previous posting? You would have record of that ACH transaction. Name of company is sufficient information, in my opinion.

We look up the Company ID if a post has already been accepted for the company. However, there are occasions when a Clietn comes into our facility and just signed up for some service with a trial period and is having difficulty cancelling it before the trial period expires. What we do is get as much information we can: the company's name, the date that they expect the debit to occur, and the amount. We then track the account looking for this transaction. Most, if not all, of the debits are caught in exceptions and returned the day they arrive.

Something to remember is that some of these internet places that have you sign up and then cancel operate with various names under one corporation. We have a customer that is going through this right now and it is a pain. The biggest problem is telling the customer to quit giving her account number out to anybody and everybody.

If her account has been compromised, wouldn't it be best practice to close it and open a new one?

Our bank has decided that we are going to require the customer provide confirmation of a ACH revocation within 14 days in order to keep the stop in place. Is anyone else requiring this and if so, what document are you collecting from the customer for confirmation? Also, if we return the first ACH with a revocation reason code, would we return any subsequent one with the same code or do we then have to return it using the unauthorized reason code? As you can probably tell -- this is not my area of expertise so any insight shared would be appreciated.

Once you have documentation in hand that all future transfers from your customer's account to the Originator are unauthorized, you effectively have documentation of a permanent stop payment order on all items from that Originator. How you return items will be a choice you make, based on your system capabilities and customer relations.

The stop payment (R08) return reason can be used if you are able to block items from posting or identify them quickly enough to return them within the standard ACH return window (available to the ODFI by the opening of business on the second day after settlement of the original item). The advantage of this method is that you don't need a WSUPP from your customer.

If any of the items sneak through your system, you can use the R07 (Authorization Revoked by Customer) return reason code. However, you'll need to have a WSUPP from your customer in file to back this return up should the ODFI ask for it. The advantage to this backup method is that you get a longer return window. I'd suggest you get a couple of undated WSUPPs signed by your customer to have in file just in case you have to use this method (that's not an official recommendation, since it's not supported in the NACHA rules).

Thanks, John. Our interruptation of 205.10(c) 2, lead us down a path of having the customer sign a basic ACH Block Order and within the Order include verbiage that the customer must provide us with a copy of the revocation they submitted to the Payee-Originator for the block to remain after 14 days.

I'll admit that we went down this path because we don't want the burdon of monitoring future ACH debits for ever and ever on an account (put burdon back on customer to make sure they did notify the Payee-Originator). Of course, it seems reasonable that the customer may have done nothing more than verbally cancel the authorization or sent an email or letter to the Payee-Originator in which case all they can really do is state to us that they have taken steps to revoke the authorization.

I think you've taken a reasonable step. And most Originators will comply with a customer's written cancellation instructions. But we aware there are some less savory Originators who don't always follow the letter of regulations.