9.7 ACH Data Security: Article One, Sections 1.6 and 1.7 & the ACH Security Framework

9.7 ACH Data Security: Article One, Sections 1.6 and 1.7 & the ACH Security Framework

Quick Reference: Data security in the Nacha Rules lives in Article One, Section 1.6 (Security Requirements) and Article One, Section 1.7 (Secure Transmission of ACH Information via Unsecured Electronic Networks). Section 1.6 alone carries two distinct obligations that candidates constantly merge into one: a universal framework duty that applies to everybody, and a threshold-based storage duty that applies only to large non-financial-institution parties. Encryption in transit is the third, and it is Section 1.7.

---

1. The Universal Duty — The ACH Security Framework

Every Participating DFI, Originator, Third-Party Service Provider and Third-Party Sender must establish, implement and, as appropriate, update security policies, procedures and systems related to the initiation, processing and storage of Entries. Those policies, procedures and systems must be designed to:

• protect the confidentiality and integrity of Protected Information until its destruction;
• protect against anticipated threats or hazards to the security or integrity of Protected Information;
• protect against unauthorized use of Protected Information that could result in substantial harm to a natural person.

Two vocabulary points the exam tests:

• Protected Information is the non-public personal information — including financial information — of a natural person used to create, or contained within, an Entry and any related Addenda Record.
• The framework is scalable. Nacha does not dictate a control set; a $200 million community bank and a national processor are held to the same standard of design but not to the same architecture.

Transmission Over Unsecured Networks

Section 1.7 (Secure Transmission of ACH Information via Unsecured Electronic Networks) — a separate section from 1.6 — requires that banking information transmitted over an unsecured electronic network be encrypted using a commercially reasonable security technology. In audit practice this means:

• TLS 1.2 or higher for web and API channels;
• SFTP with SSH key authentication for batch file exchange;
• AS2 with encrypted payloads for EDI-style corporate transmissions.

"Unsecured electronic network" is the operative trigger. A file moved across a private leased line between an ODFI and its ACH Operator is not the target of this provision; an ACH file emailed as an attachment is.

---

2. The Threshold Duty — Rendering Stored Account Numbers Unreadable

The Supplementing Data Security Requirements rule amended Article One, Section 1.6 to require certain parties to render DFI Account Numbers unreadable when stored electronically.

+---------------------------------------------------------------------------------------------+
|              SUPPLEMENTING DATA SECURITY REQUIREMENTS — WHO IS COVERED                       |
+------------------------------------------------+--------------------------------------------+
| COVERED                                        | NOT COVERED                                |
+------------------------------------------------+--------------------------------------------+
| Each non-Consumer Originator that is NOT a     | Participating DFIs — already bound by       |
| Participating DFI                              | prudential regulators (GLBA Interagency     |
| Each Third-Party Service Provider              | Guidelines Establishing Information         |
| Each Third-Party Sender                        | Security Standards)                         |
|                                                 |                                            |
| ...whose ACH Origination or Transmission       | Consumer Originators                       |
| volume exceeds 2,000,000 Entries annually      | Parties under the 2 million Entry threshold |
+------------------------------------------------+--------------------------------------------+

Effective dates and the grace period:

Nacha extended both original dates by one year in response to industry requests, which is why the dates land mid-year rather than on a March or September rule window.

Technology neutrality. Nacha names no required method. Acceptable approaches include encryption, truncation, tokenization, destruction, or having the financial institution store, host or tokenize the account numbers on the covered party's behalf. Nacha has noted that protecting ACH account numbers to the PCI DSS standard for rendering primary account numbers unreadable would satisfy the commercially reasonable requirement.

Scope limit. Only ACH Entries are covered. Card, wire and check data are outside this rule, and only the DFI Account Number must be rendered unreadable — the rule does not reach every data element in the file.

---

3. How the Two Duties Differ

Worked Applicability Scenario

Cascade Utilities originated 2.4 million PPD debits last year and stores customer account numbers in a billing database. Its ODFI, Harborline Bank, holds the same account numbers in its core.

• Cascade is a non-Consumer Originator that is not a Participating DFI and exceeds 2 million Entries: it must render the stored account numbers unreadable.
• Harborline Bank is a Participating DFI and is excluded from the 2-million rule — but it remains bound by the general Section 1.6 framework and by GLBA information-security standards enforced by its prudential regulator.
• Both must encrypt banking information transmitted over unsecured networks.

ODFI obligation you should not miss: Nacha expects ODFIs to work out which of their customers are newly covered and to tell them. The rule imposes a direct obligation on the Originator, but the ODFI owns the customer relationship and the communication.

---

4. Where Data Security Shows Up in the Annual Audit

The annual Rules compliance audit under Article One, Subsection 1.2.2 tests data security alongside everything else. Expect an auditor to look for:

• written, board-approved information security policies mapped to Sections 1.6 and 1.7;
• evidence of encryption over unsecured channels (cipher configuration, key management, transmission logs);
• for covered non-FI parties, proof that stored DFI Account Numbers are rendered unreadable;
• physical and logical access controls over origination software, transmission servers and key stores;
• documented, compliant data destruction procedures for source documents and ACH media.