NACHA Extends Effective Dates of Data Security Rule

The National Automated Clearing House Association (NACHA) has extended the upcoming effective dates of the Rule on Supplementing Data Security Requirements (Supplementing Rule).  Phase I and Phase II of the Supplementing Rule will now become effective June 30, 2021, and June 30, 2022, respectively.

In 2018, NACHA had approved various changes to its data security rules, in particular requiring ACH originators and third-parties to encrypt data at rest.  Phase 1 and Phase 2 apply these requirements to ACH originators and third-parties with more than 6 million and 2 million ACH payments annually, respectively.

Other upcoming rules will become effective as scheduled.  The Differentiating Unauthorized Return Reasons Rule became effective on April 1, 2020, and the ACH Contact Registry Rule will become effective on October 30, 2020.