According to Nacha, two Rules will become effective September 30, 2022, with a 6-month grace period for certain aspects of each rule.

What are the new rules? 

• Nested Third-Party Senders. This rule defines nested Third-Party Senders and requires their relationships be addressed in ACH Origination Agreements. Originating Depository Financial Institutions (ODFIs) must identify in Nacha’s Risk Management Portal all Third-Party Senders allowing Nested Third-Party Sender relationships.
• Third-Party Sender Risk Assessments. This rule explicitly states that a Third-Party Sender—whether Nested or not—must conduct a Risk Assessment of its ACH activities.

Why are these new rules going into effect? 

The Rules are going into effect to provide clarity and remove confusion surrounding the roles and responsibilities of parties to a Nested Third-Party Sender relationship and to promote a culture of risk management and compliance by Third-Party Senders using the ACH Network.

When will these rules become effective? 

While the Rules are effective as of September30, 2022, changes would apply to ACH Origination Agreements entered on or after that date. For updating Risk Management Portal registrations and completing Risk Assessments there is a six-month grace period until March 31, 2023.

For more detailed information, visit Nacha’s webpage.