The only penalties in the NACHA rules are the system of fines, which by the way, will be increasing in amounts. This concept is interesting because the reporting of violations is up to the users of the ACH system, so anyone can report someone for a violation. The idea is that the users will police themselves.
However, with the new interest in ACH from the regulators, I would imagine that before long there will also be some safety and soundness issues with a bank whose ACH area is not up to par.
--A bad day at sea is better than a good day at work.