AAP Authorization Requirements 1 — Questions and Answers
Question 1: For PPD debit entries, the written authorization obtained by an Originator must be:
- Clear, readily understandable, and contain the payment amount, schedule, and Receiver's account information (Correct answer)
- Any signed document from the Receiver, regardless of content
- Verbal authorization recorded and retained on file
- Authorization provided exclusively through an online portal
Correct answer: Clear, readily understandable, and contain the payment amount, schedule, and Receiver's account information
NACHA rules require that PPD debit authorizations be clear, readily understandable, and include key terms such as the payment amount, frequency, and start date.
Question 2: A consumer's written authorization for a recurring ACH debit must include which essential element?
- The Receiver's signature or electronic equivalent authorizing the debit (Correct answer)
- The Originator's bank routing number on the authorization form
- The ACH Operator's approval code for the transaction
- NACHA certification number for the Originator
Correct answer: The Receiver's signature or electronic equivalent authorizing the debit
An authorization for recurring ACH debits must be signed or agreed to by the consumer (Receiver) using a written signature or its electronic equivalent.
Question 3: For TEL entries, an Originator may initiate a one-time ACH debit only if:
- There is an existing relationship with the consumer OR the consumer initiated the call (Correct answer)
- The call was recorded regardless of who initiated it
- The consumer has a prior written agreement on file
- Any inbound or outbound call is made with the consumer
Correct answer: There is an existing relationship with the consumer OR the consumer initiated the call
TEL requires either an existing relationship between the Originator and consumer, or the consumer must have initiated the telephone call to the Originator.
Question 4: How long must an Originator retain authorization records for ACH entries?
- 2 years from the termination or revocation of the authorization (Correct answer)
- 7 years from the date the authorization was originally signed
- Until the Receiver's account is permanently closed
- 5 years from the date of the last transaction under the authorization
Correct answer: 2 years from the termination or revocation of the authorization
NACHA rules require Originators to retain the original or copy of each authorization for 2 years after the authorization is terminated or revoked.
Question 5: For WEB debit entries, what additional security requirement is imposed on Originators?
- An annual audit to validate the security of transmission and storage of Receiver banking information (Correct answer)
- Monthly reporting of WEB volume to NACHA
- Mandatory two-factor authentication for all WEB transactions
- Real-time fraud monitoring certification by a third party
Correct answer: An annual audit to validate the security of transmission and storage of Receiver banking information
NACHA rules require Originators of WEB entries to conduct an annual audit of their data security practices for transmitting and storing Receiver banking information.
Question 6: A consumer may revoke ACH debit authorization by:
- Notifying the Originator in the manner specified in the authorization agreement (Correct answer)
- Calling their RDFI only—the RDFI then notifies the Originator
- Filing a formal complaint with NACHA's consumer protection division
- Disputing the charge through their credit card issuer
Correct answer: Notifying the Originator in the manner specified in the authorization agreement
To revoke an ACH debit authorization, the consumer must notify the Originator in the method described in the authorization agreement itself.
AAP Authorization Requirements 1
For PPD debit entries, the written authorization obtained by an Originator must be: