Bank Account Verification Requirements

​

What is Nacha?

Nacha was originally NACHA, an acronym for National Automated Clearing House Association. Though the acronym is no longer in official use, it shows where the organization came from and the role they fill in the ACH ecosystem. Back in the early 1970s, regional banking associations across the US joined forces to standardize processes around the development of “automated” clearing house solutions—the digital replacements for physical clearinghouses where paper checks were once exchanged. By 1974, the American Bankers Association had centralized all of those regional groups under a national sub-division that they named NACHA. An independent organization since 1985, Nacha is effectively a non-profit consortium tasked with:

• Translating federal legislation and executive rules into clear guidance for member banks and ACH network participants
• Enforcing those rules for all 10,000+ member banks and network participants
• Driving development and adoption of the ACH system
• Acting as a trade organization (education, advocacy, roundtables, etc.)

​

Online ACH volume is growing fast

The volume of online ACH payments is quite large and growing fast. ACH has long been a staple for larger, more regular payments—such as Direct Deposit wages and Direct Payment of utility bills—but its prevalence in other, smaller transactions is on the rise. Much of this growth has come from internet-initiated ACH transactions, also referred to as WEB debits. There are many types of ACH transfers that happen online—mainly payments for bills such as mortgages, credit cards, and utilities, but also some high-ticket retail goods. As transaction volumes rise, Nacha has implemented a new rule, known as the Web Debit Account Validation Rule, that affects those who accept internet-initiated ACH payments. This rule adds to the existing screening requirements that account validation should be included as part of a reasonable fraudulent detection system.

​

What is Nacha’s 2021 rule change?

Nacha’s 2021 rule change is specific to WEB debits (internet-initiated transactions) and increases the standards for detecting fraud. Specifically, ACH originators of WEB debits now must use a “commercially reasonable fraudulent detection system” that includes “account validation” for the first time use of an account number or for any change to previous account numbers.

​

Key requirements

At a minimum, businesses must validate that new accounts are:

• Legitimate
• Open
• Able to receive an ACH transfer before their first use

Nacha does not recommend any specific method for validating account information, but there are several ways to achieve this, including microdeposits, manual validation, database verification, and instant verification via API.

​

Implementation timeline

Originally the rule was going to take effect on January 1, 2020, but was pushed back to March 19, 2021, to give more time for guidance and education.

​

Why did Nacha change the rules?

This rule change is part of a larger, ongoing effort to address fraud attempts and data quality. It aims to ensure accounts are valid and eliminate data entry errors related to account numbers, bringing to the forefront a requirement that has been in the Nacha guidelines for many years.

​

ACH fraud statistics

ACH fraud is relatively rare. In fact, it has the lowest fraud rate by value among all payment types, at 0.08 basis points ($0.08 of fraud per$10,000 in payments), according to a Federal Reserve study that measured fraud rates from 2012-2015. By comparison, ATM and card payments fraud increased from 7.99 to 10.80 basis points during the same time period. However, the proliferation of ACH in fast-growing services—such as digital wallets and neobanks—underscores the industry’s need to use commercially reasonable practices to ensure the continued safety of the ACH Network.

​

Are your payments compliant?

With the new rule in effect, the way that many businesses had accepted ACH payments in the past will no longer be possible. This includes businesses that simply ask customers to manually enter their account and routing numbers, but don’t validate those accounts. The new rule does not affect existing customers that pay by ACH. It is only for new accounts or for those that have changed their bank account information via an online/mobile means.

​

Account validation methods

There are five different approaches to validating accounts under the new rule. These different approaches have a wide range in terms of speed, accuracy, and user experience.

​

1. Manual validation

Manual validation requires obtaining a customer’s voided check to manually validate account and routing information. Businesses can also directly contact their customer’s bank to validate this information. Timeline: Up to 6 days
Experience: Most labor-intensive and high-friction method

​

2. Microdeposits

Microdeposits involve two steps:

1. After a customer provides their account and routing numbers, businesses make one or two very small deposits (typically less than $0.05) into a customer’s account
2. The customer confirms the exact amount deposited to validate their account

Timeline: A few hours up to 2-3 days
Experience: Creates friction that can lead to customer drop-off

​

3. Pre-notes

Pre-notification transactions are essentially the same as microdeposits, but they don’t require the customer to confirm the amount deposited. Instead of sending a microdeposit, the business sends a $0 ACH transaction to validate the account information. Timeline: 2-3 days
Limitation: Customers can’t initiate payments during this time

​

4. Data API solutions

Automated verification systems can verify account status for approximately 90% of domestic consumer accounts without requiring end-user interaction. Timeline: Seconds
Experience: No customer interaction needed

​

5. Open-banking APIs

Open-banking APIs use application program interfaces (APIs) and secure bank connections to retrieve account and routing numbers directly from the accounts being validated. Users select their financial institutions from a list, enter their username and password, and are quickly connected. Timeline: Often just a few seconds
Advantage: Only verification method that uses bank account username and password rather than account and routing numbers

​

Comparison of validation methods

Method	Response Time	Customer Experience	Ownership Verification	Status Validation	Balance Info	Customer Interaction	Cost
Data API	Seconds	Excellent	Yes (80%+)	Yes	No	Not needed	Moderate
Open Banking	Seconds	Very good	Yes	Yes	Yes	Required	High
Micro-Deposits	2-3 Days	Poor	Account Control Only	Yes	No	Required	Moderate
ACH Pre-note	2-3 Days	Poor	No	Yes	No	Not needed	Low
Manual	Variable	Poor	No	No	No	Required	High

​

The future of online account-to-account payments

In 2020, there was tremendous growth in the volume of internet-initiated ACH transfers, as well as ACH transfers overall. Nacha’s new rule may require many businesses to implement changes to their onboarding flows, but those changes represent an opportunity for growth.

​

Benefits of compliance

With the uptick in ACH use, businesses that use this rule change as a chance to implement better customer onboarding and payments experiences should expect to see:

• More paying customers
• Faster onboarding
• Enhanced fraud mitigation
• Better conversion rates
• More funded accounts

​