FTC Staff Comment to NACHA -- The National Electronic Payment System Concerning Network Enforcement Proposal

COMMENT TO NACHA – THE ELECTRONIC PAYMENTS ASSOCIATION
In Response to Request for Comment on Network Enforcement Proposal
Comments of the Staff of
the Bureau of Consumer Protection of the Federal Trade Commission
April 23, 2007
*These comments represent the views of the staff of the Bureau of Consumer Protection of
the Federal Trade Commission. They are not necessarily the views of the Federal Trade
Commission or any individual Commissioner. The Commission has, however, voted to
authorize the staff to submit these comments.

I. 	Introduction
NACHA - The Electronic Payments Association (“NACHA”) has published proposed
revisions to its Rules, as described in The Network Enforcement Proposal: A Component of the
Comprehensive Risk Management Strategy for the ACH Network (the “Network Enforcement
Rule proposal”). The proposal increases the fine levels in NACHA’s National System of Fines
to up to $500,000 per month; permits NACHA’s Rules Enforcement Panel to suspend financial
institutions’ privileges of originating ACH payments; and requires financial institutions that are
suspected of creating the greatest risk to comply with new reporting requirements, and ties those
requirements into the National System of Fines. NACHA has requested comments by interested
parties. The staff of the Bureau of Consumer Protection of the Federal Trade Commission (“the
FTC staff”) supports NACHA’s proposal and offers the following comments to assist NACHA.
The Federal Trade Commission is the primary federal consumer protection agency, with
wide-ranging responsibilities concerning nearly all segments of the economy, including
jurisdiction over most non-bank entities. As part of its consumer protection mandate, the
Commission enforces, among other laws, the Federal Trade Commission Act (“FTC Act”),
which prohibits unfair or deceptive acts or practices in or affecting commerce.1 As a result of the
Commission’s efforts to combat deceptive and unfair practices in the telemarketing industry, it
has become the nation’s leader in challenging telemarketing fraud and abuse. In addition to
enforcement responsibilities, the Commission also responds to many requests for information
about consumer protection issues from consumers, industry officials, state law enforcement
agencies, and the media. The FTC staff also has commented on numerous state and federal laws
relating to consumer financial services and other consumer protection issues.
In the payment processing area, the Commission’s enforcement work has targeted
deceptive and unfair acts and practices. An act or practice is deceptive if (1) there is a
representation or omission of information that is likely to mislead consumers acting reasonably
under the circumstances; and (2) that representation is material to consumers.2 An act or practice
is unfair if (1) it caused, or is likely to cause, substantial injury to consumers; (2) the injury is not
reasonably avoidable by consumers; and (3) the injury to consumers is not outweighed by
countervailing benefits to consumers or to competition.3 Also, the FTC may allege a violation of
the Telemarketing Sales Rule (“TSR”) for providing “substantial assistance and support” to
telemarketers while knowing or consciously avoiding knowing that the telemarketers are engaged
in Rule violations. In recent years, the Commission has pursued six enforcement actions against
payment processors that have committed unfair practices when processing payments for
fraudulent merchants and generated millions of dollars of unauthorized withdrawals from
1 See 15 U.S.C. § 45(a).
2 See generally Federal Trade Commission Policy Statement on Deception, appended to
Cliffdale Assocs., 103 F.T.C. 110, 174-83 (1984).
3 15 U.S.C. § 45(n).
1

consumer bank accounts.4
In the Commission’s experience, fraudulent operators commonly reach consumers
through telemarketing and frequently use the ACH network to debit their victims’ bank accounts.
Often those engaging in telemarketing fraud are highly sophisticated, using “boiler room” call
centers equipped with large numbers of phone lines to target consumers. In many cases, these
telemarketers deceive consumers into providing their bank account information by employing
false promises of varying types. Telemarketers often use the services of non-bank payment
processors that submit the debits to a financial institution, often for processing through the ACH
network.
For example, in December 2006, the Commission filed a Complaint in federal district
court, alleging that third-party payment processor Global Marketing Group, Inc. (“Global
Marketing”), its owner Ira Rubin, and six other entities that he controls committed unfair acts
and practices under the FTC Act and violated the TSR by processing unauthorized debits from
consumer bank accounts through the ACH network.5 In that action, the court granted a
temporary restraining order against the defendants and appointed a receiver to take over the
company. In January 2007, the court entered a stipulated preliminary injunction that prohibited
Rubin and his companies from engaging in payment processing.
The evidence presented to the court showed that Global Marketing and the other
defendants provided payment processing, customer service and complaint handling, order
fulfillment, and list brokering to numerous merchants, the bulk of whom were telemarketers.
Among the merchants, at least nine were Canadian entities that ran advance fee loan scams, a
practice explicitly prohibited by the TSR.6 Global Marketing processed ACH transactions for
outbound telemarketers and experienced extraordinarily high total return rates (the percentage of
attempted debit transactions that are returned out of the total number of attempted debits).
Depending on the client merchant, these were fourteen to several hundred times the average
overall return rates published by NACHA for the ACH network. In addition, Global Marketing
processed ACH payments for certain merchants who had 100-200 times the NACHA-published
average rates for unauthorized returns. (Although there are 68 different reasons why an ACH
4 FTC v. Interbill Ltd. et al., No. 2:06-CV-01644 (JCM) (D. Nev. 2007) (accounts
debited through remotely created checks); FTC v. Global Marketing Group, Inc., et al., No. 8:06
CV-02272 (JSM) (M.D. Fla. 2006) (ACH debits); FTC v. Universal Processing, Inc., et al., No.
CV-05-6054 (FMC) (C.D. Cal. 2005) (ACH debits); FTC v. First American Payment Processing,
Inc., et al., No. CV-04-0074 (PHX) (D. Az. 2004) (ACH debits); FTC v. Electronic Financial
Group, et al., No. W-03-CA-211 (W.D. Tex. 2003) (ACH debits); FTC v. Windward Marketing,
Ltd., et al., No. 1:06-CV-615 (FMH) (N.D. Ga. 1997) (remotely created checks).
5 FTC v. Global Marketing Group, Inc., et al., No. 8:06-CV-02272 (JSM) (M.D. Fla.
2006).
6 16 C.F.R. § 310.4(a)(4).
2

transaction can be returned, NACHA defines “unauthorized returns” to include just two specific
return reason codes.)
In the ACH payment area, the FTC continues to pursue law enforcement actions against
payment processors where it believes that the processors’ practices are unfair under the FTC Act
or violate the TSR.
II. 	The FTC Staff Supports NACHA’s Proposal.
Meaningful self-regulation provides an important complement to the Commission’s law
enforcement actions. Self-regulation can be prompt, flexible, and effective. The judgment and
experience of an industry in crafting rules also can be of great benefit, especially where, as here,
the business practices are complex and the government has not defined “bright-line” rules. The
FTC staff encourages self-regulatory efforts, such as the Network Enforcement Rule proposal,
that provide clear guidance to industry and create effective enforcement mechanisms to protect
consumer rights.
The monitoring of merchant return rates, an important part of the Network Enforcement
Rule proposal, is a well-established component of the NACHA Rules and general risk
management practices on the ACH Network. A large number of returned debit transactions
associated with a single merchant likely indicates a problem between the merchant and its
customers. Specifically, a return rate for a specific merchant that is significantly higher than
return rates experienced by the industry as a whole often indicates fraud, either where the
consumer never authorizes the debit, or where the consumer authorizes the debit, but the
authorization is based on deceptive misrepresentations or omissions that the consumer later
discovers.
It is our understanding that NACHA advises Originators7 and Originating Depository
Financial Institutions (“ODFIs”)8 to strive to ensure that their actual return rate for unauthorized
entries using telephone-initiated, one-time ACH entries (“TEL” transactions) remains at or below
the industry unauthorized return rate for other consumer debit entries, which is about 0.05
percent.9 Moreover, NACHA advises ACH participants that it is a good business practice to
question any client who is experiencing high unauthorized return rates as to their business
practices, and correct any violations of the NACHA Operating Rules or cease processing on
7 The Originator is the entity that agrees to initiate ACH entries into the payment system.
8 The ODFI is the institution that receives the payment instructions from the Originator
and forwards the entries to the ACH Operator.
9 Declaration of Elliot McIntee, President of NACHA, filed in FTC v. Global Marketing
Group, Inc., et al., No. 8:06-CV-02272 (JSM) (M.D. Fla. 2006), Docket No. 7.
3

behalf of those Originators.10 The FTC staff has seen evidence, however, that not all third-party
processors, and not all ODFIs, are following NACHA’s guidelines.
The Network Enforcement Rule proposal is a critical portion of NACHA’s risk
management strategy. The FTC staff supports both major elements of the proposal: (A) the new
structure for enforcement and fines, and (B) the proposal to authorize the NACHA Board of
Directors (the “Board”) to set the threshold for excessive unauthorized returns for all transaction
types.
A. 	The FTC Staff Supports the Proposal to Adopt a New Structure for
Enforcement and Fines Related to Unauthorized Transactions.
The FTC staff supports NACHA’s proposals to strengthen its risk management
procedures by establishing stronger enforcement mechanisms and greater incentives for ODFIs to
ensure that all payments submitted are authorized. The Network Enforcement Rule proposal
provides important tools for NACHA to ensure that ODFIs comply with the NACHA rules. For
example, if an ODFI fails to reduce an Originator’s or Third Party Sender’s return rate to a rate
below the designated threshold within 30 days of receipt of NACHA’s written request, the ODFI
would be considered to be in willful disregard of the Rules. At that point, NACHA would
initiate a rules enforcement proceeding. Giving NACHA staff the authority to initiate the
proceeding is a critical step toward improving compliance with NACHA rules.
The proposal increases fines for rule violations, a critical element in deterring originating
banks from initiating unauthorized debits. The proposal also provides that the NACHA’s Rules
Enforcement Panel has authority to determine that a particular Originator or Third-Party Sender
that has engaged in repeated infractions should be temporarily suspended from the ACH
Network. The FTC staff encourages NACHA to implement this portion of the proposal as well.
B. 	The FTC Staff Encourages NACHA to Adopt the Proposal to Authorize the
Board to Set a Trigger Rate for Unauthorized Charges.
The FTC staff supports the proposal to authorize the NACHA Board to set the threshold
for excessive unauthorized returns for all transaction types.
Authorizing the Board to set a threshold for enforcement action that applies to all
transactions would be a useful step, because it would result in scrutiny of unauthorized returns on
all types of transactions. In contrast, under current rules that only look to unauthorized return
rates on transactions coded as “TEL,” ODFIs may focus such scrutiny only on those transactions,
ignoring other types of transactions and telephone-initiated transactions that are not coded as
“TEL” in the system (possibly for the very purpose of avoiding such scrutiny).
10 See id.; see also NACHA Operating Guidelines, Section IV, Chapter XV(E)(3) (“It
is...good business practice for all ODFIs to monitor their return rates in order to be proactive in
identifying problem areas in their ACH origination.”).
4

Setting an appropriate trigger for excessive unauthorized returns is critical to the success
of the risk management program, and the proposal to grant the NACHA Board authority to set
the trigger provides the flexibility to adapt the trigger to changing conditions in the future in a
timely and efficient way. The FTC staff recommends that NACHA emphasize that the trigger is
the baseline for sanctioning authority and should not be construed as an acceptable baseline for
unauthorized return rates.11 Instead, the industry return rates that NACHA publishes in its
quarterly newsletters should provide guidance to industry on acceptable return rates.
Moreover, the FTC staff suggests that returns that are not technically “unauthorized
returns” also may indicate problematic originations. For example, if an Originator purchases a
list of consumer bank account numbers and submits a debit to each account without
authorization, many of the returns may be coded “invalid account” or “account closed” rather
than “unauthorized.” Thus, NACHA should encourage its member financial institutions to
consider all returns instead of only “unauthorized” returns when monitoring an ACH
participant’s account. Furthermore, NACHA should consider identifying other return categories
that can indicate problematic originations in future self-regulatory efforts.
Finally, the FTC staff understands that the Network Enforcement Proposal is one piece of
NACHA’s risk management strategy; we look forward to NACHA’s continuing efforts to
improve its risk management practices.
III. 	Conclusion
The FTC staff appreciates the opportunity to comment on the NACHA Network
Enforcement Rule and encourages NACHA to adopt the proposed rules.
11 NACHA previously has provided such guidance when it issued its rule regarding TEL
Entry Reporting Requirements: “[N]either the ODFI nor its Originators should consider such a
return rate an acceptable one for normal business purposes.” NACHA Operating Guidelines,
Section IV, Chapter XV(E)(3).
5