6.2 E-SIGN Act Compliance, Electronic Signatures & Oral Authorizations

6.2 E-SIGN Act Compliance, Electronic Signatures & Oral Authorizations

Core Principle: In modern electronic commerce, authorizations are rarely executed on paper. The Electronic Signatures in Global and National Commerce Act (E-SIGN Act) and the Uniform Electronic Transactions Act (UETA) establish that electronic records and signatures cannot be denied legal validity solely because they are in electronic format. However, both federal statutory law and the Nacha Operating Rules impose rigorous procedural safeguards—spanning affirmative consumer consent, retainable copy provision, detailed TEL script disclosures, and verifiable attribution—to ensure electronic and oral authorizations remain legally enforceable.

---

1. Statutory Foundations: The E-SIGN Act & UETA

Electronic ACH authorizations (such as WEB debits originated via web browsers, mobile applications, or digital document platforms) derive their legal enforceability from two foundational statutory frameworks:

1. The E-SIGN Act (15 U.S.C. § 7001 et seq.):
   • A federal statute enacted in 2000 establishing national uniformity for electronic records and signatures in interstate commerce.
   • General Rule of Validity (§ 7001(a)): A signature, contract, or other record relating to a transaction may not be denied legal effect, validity, or enforceability solely because it is in electronic form.
   • Consumer Protection Provisions (§ 7001(c)): Imposes specific consumer consent requirements that must be satisfied before electronic disclosures and electronic records can legally substitute for required paper writings (such as Regulation E preauthorized debit disclosures).
2. The Uniform Electronic Transactions Act (UETA):
   • A model state act adopted by 49 states, the District of Columbia, and U.S. territories (with New York maintaining its comparable Electronic Signatures and Records Act / ESRA).
   • E-SIGN preempts state laws governing electronic records unless the state has adopted standard UETA without non-conforming modifications.
3. Nacha Rules Harmonization:
   • Nacha Operating Rules explicitly incorporate the standards of E-SIGN and UETA. An electronic authorization that meets E-SIGN / UETA requirements satisfies the "written, signed, or similarly authenticated" standard of the Nacha Rules.

---

2. Core Pillars of Valid Electronic Authorizations (WEB)

To withstand legal challenge and ensure compliance with Nacha Rules and Regulation E § 1005.10(b), an electronic authorization workflow must satisfy five structural pillars:

+---------------------------------------------------------------------------------------------------------+
|                           THE FIVE PILLARS OF VALID E-SIGN ACH AUTHORIZATION                             |
+---------------------------------------------------------------------------------------------------------+
| Pillar 1: Affirmative Consent   | Consumer explicitly consents to receive disclosures & authorize       |
|                                 | transactions electronically (e.g., checkbox, opt-in prompt).          |
| Pillar 2: Hardware/Software OK  | Consumer demonstrates technical capability to access, view, and       |
|                                 | retain electronic documents in the designated format (e.g., PDF/HTML).|
| Pillar 3: Clear Disclosures     | Mandatory authorization terms displayed clearly and conspicuously     |
|                                 | prior to obtaining the consumer's electronic assent.                   |
| Pillar 4: Retainable Record     | Consumer is provided an immediate retainable copy (downloadable PDF,   |
|                                 | printable webpage, or immediate confirmation email/receipt).          |
| Pillar 5: Attribution & Audit   | Originator captures metadata linking the signature to the specific    |
|                                 | individual (IP address, timestamp, device ID, biometric/token).       |
+---------------------------------------------------------------------------------------------------------+

Detailed Breakdown of E-SIGN Requirements

• Affirmative Consent & Clear Notice (§ 7001(c)(1)(B)):
  • The consumer must be provided a clear and conspicuous statement informing them of:
    • Their right to receive the record on paper;
    • Their right to withdraw consent and the consequences/fees of withdrawal;
    • The scope of the consent (whether it applies to a single transaction or ongoing recurring debits);
    • The hardware and software requirements needed to access and retain the electronic record.
• Reasonable Demonstration of Capability (§ 7001(c)(1)(C)(ii)):
  • The consumer must consent electronically in a manner that "reasonably demonstrates that the consumer can access information in the electronic form that will be used to provide the information."
• Retainable Copy Rule:
  • Nacha Rules and Reg E require that the consumer receive a copy of the authorization. In an electronic environment, this means the authorization terms must be readily printable, downloadable, or automatically emailed to the consumer immediately upon completion.
• Attribution and Identity Authentication:
  • Under E-SIGN § 7006(5) and Nacha Rules, an electronic signature is an electronic sound, symbol, or process attached to or logically associated with an agreement and executed or adopted by a person with the intent to sign.
  • The Originator must retain evidence sufficient to reproduce and prove the authorization. Depending on the channel and risk, useful attribution evidence may include timestamps, session identifiers, network or device data, and authentication logs; the Rules do not prescribe that exact technical checklist.

---

3. Oral Authorizations: The TEL SEC Code Framework

When an ACH debit is authorized by a consumer orally over the telephone, the transaction must be originated under the Telephone-Initiated Entry (TEL) SEC code. Because oral authorizations present elevated fraud and misunderstanding risks, Nacha Operating Rules establish strict boundaries on when and how TEL entries may be originated.

+---------------------------------------------------------------------------------------------------------+
|                                      TEL SEC CODE ELIGIBILITY MATRIX                                     |
+---------------------------------------------------------------------------------------------------------+
| Scenario                    | Permitted Under TEL? | Specific Legal Condition / Requirement         |
+-----------------------------+----------------------+-------------------------------------------------+
| Inbound Call from Consumer  | YES                  | Consumer initiates call to Originator.          |
| Outbound Call with EBR      | YES                  | Originator has Existing Business Relationship   |
|                             |                      | with consumer (active account, recent contract).|
| Outbound Cold Call (No EBR) | NO (NOT PERMITTED)   | Originator has no prior business relationship;  |
|                             |                      | ACH debit cannot be authorized orally!          |
+---------------------------------------------------------------------------------------------------------+

Existing Business Relationship (EBR) Definition

Under Nacha Rules, an Existing Business Relationship (EBR) is defined as a prior or existing relationship formed by a voluntary two-way communication between a person and an Originator with or without an exchange of consideration, based on:

1. A written agreement in place for the provision of goods or services; or
2. The Receiver purchased goods or services from the Originator within the preceding two years.

Exam Trap: An Originator cannot cold-call a prospective consumer and originate a TEL debit based on an oral authorization obtained during that outbound call. Outbound TEL origination requires an Existing Relationship. If no Existing Relationship exists, the Receiver must initiate the telephone call for TEL eligibility; a separately written or electronically signed authorization may support another appropriate SEC code but does not itself create TEL eligibility for the outbound call.

---

4. Mandatory TEL Script Disclosures & Verification Requirements

During the telephone call, the Originator must execute two mandatory compliance steps: (1) verify the caller's identity, and (2) read the complete oral authorization script containing all mandatory disclosures.

A. Identity Verification Requirement

Prior to obtaining authorization, the Originator must use commercially reasonable procedures to verify the consumer's identity and the routing number used for the Entry. The Rules do not prescribe a fixed data-element checklist. Depending on risk, controls may use customer contact information, account details, shared-secret or token checks, device or behavioral signals, and other evidence appropriate to the channel; collecting an SSN is not a universal Nacha requirement.

B. Mandatory Verbal Disclosures (The TEL Script)

Under Nacha Operating Rules, the oral script must disclose all of the following elements in a clear, audible, and unambiguous manner before obtaining verbal assent:

1. Explicit ACH Statement: Clear statement that the transaction is an electronic funds transfer (ACH debit) against the consumer's account.
2. Date of Debit: The specific date on or after which the ACH debit entry will settle.
3. Amount: The precise dollar amount of the debit (or calculation method for variable debits).
4. Receiver Name: The name of the consumer whose account will be debited.
5. Account Details: The specific account to be debited (RDFI name/routing number and account number).
6. Originator Identity: The clear commercial name of the Originator.
7. Customer Inquiry Telephone Number: A toll-free or local telephone number for customer inquiries that is answered during normal business hours.
8. Date of Authorization: The date the oral authorization is granted.
9. For Recurring TEL Debits:
   • The timing and frequency of the recurring entries;
   • Clear instructions on the procedure and timeframe for the consumer to revoke authorization.

---

5. Oral Authorization Evidence: Single, Standing, and Recurring Rules

For a Single Entry authorized orally, the Originator uses one of two evidence methods. The same alternatives apply to an Oral Standing Authorization, with confirmation due before the first Subsequent Entry. A recurring Oral Authorization has a different, cumulative requirement.

+---------------------------------------------------------------------------------------------------------+
|                            TEL RECORDING VS. WRITTEN CONFIRMATION TIMELINE                              |
+---------------------------------------------------------------------------------------------------------+
| Option A (Recording):                                                                                   |
|  [ Oral Call + Audio Recording ] =====> [ Transmit ACH Batch ] =====> [ Settlement Date ]               |
|   (Mandatory Disclosures Captured)                                                                      |
|                                                                                                         |
| Option B (Written Confirmation):                                                                        |
|  [ Oral Call ] ===> [ Send Written Confirmation ] ===> [ Transmit Batch ] ===> [ Settlement Date ]       |
|                      (Must be sent BEFORE Settlement Date)                                              |
+---------------------------------------------------------------------------------------------------------+

Single, Standing, and Recurring Oral Authorization Rules

• Single Entry: Record the Oral Authorization or provide written confirmation before settlement; retain the record for two years from the authorization date.
• Oral Standing Authorization: Record it or provide written confirmation before the first Subsequent Entry; retain the record for two years from termination or revocation.
• Recurring Oral Authorization: Record the Oral Authorization and provide the Receiver the copy required by Regulation E before the first debit. Retain the recording and evidence of copy delivery for two years from termination or revocation.