ACH INFORMATION PACKAGE Updated 8/2017

Transcription

1 ACH INFORMATION PACKAGE Updated 8/2017

2 TABLE OF CONTENTS OVERVIEW ACH INFORMATION SHEET.5 SCHEDULE OF EVENTS 6 STANDARD ENTRY CLASS CODES 7-8 STANDARD ENTRY CLASS CODES WITH REQUIRMENTS...9 ACH RECORD INFORMATION ACH SECURITY QUESTIONAIRE SAMPLE FORMS AND AGREEMENTS P a g e

3 OVERVIEW The National Automated Clearing House Association (NACHA) regulates the use of the ACH system. The Rules related to originating (sending) ACH transactions can be complex. It s recommended that each client reviews this document annually as a reminder of key issues related to ACH processing. This document is not intended to act as a substitute for NACHA Rules nor eliminate the need for continuing education. Authorization: To originate (or send) transactions to a receiver, the originator must obtain the receiver s authorization. When requested to provide proof, copies of the authorization must be provided within ten (10) business days of the request. The original authorization or equivalent copy must be maintained for two (2) years from termination or revocation of authorization. In certain situations it is acceptable to originate a variable amount recurring debit entry. For example, utility bills frequently change in amount on a monthly basis, and an ACH debit entry can be used to collect these funds. However, when the amount varies, the originator must send a notice of the new payment amount at least ten (10) calendar days prior to the date the debit is sent. On recurring transactions (consistent or variable amount), if the scheduled date for the debit to be received changes, the originator must notify the receiver of the new schedule in writing at least seven (7) calendar days before the entry is received. Prenotes: Prenotes are frequently used to validate the financial information provided to the originator. Prenotes are zerodollar entries that are sent at least three (3) Banking days prior to initiating the first live (dollar) transaction. The receiving financial institution (Bank, credit union, or savings and loan) is responsible to provide a return notification if the financial information (routing number or account number) is incorrect. ACH will not provide a positive confirmation that transactions were processed successfully. i. ACH entries are posted to the receiver s account based on routing and account number information only. The receiving Bank is not required to verify the name, individual identification or other information provided in the entry. ii. It is the responsibility of the originator to verify that the individual authorizing the entry is in fact the owner of the account. The method to authenticate the identity of the receiver varies according to Standard Entry Code and is explained under each code. iii. When a prenote is returned, the originator is responsible to correct the reason for the return. Upon receipt of returns relating to prenotification indicating that the Receiving Depository Financial Institution (RDFI) cannot accept such entries, such entries cannot be initiated. Notification of Change: In some instances, the receiving Bank will process an entry that contains inaccurate information. When this happens, the receiving Bank will send a Notification of Change (NOC) to the originating Bank (Enterprise Bank). Enterprise Bank will provide a report to the originator that contains correct information -. The originator is required to make the correction prior to the initiation of the next entry. Failure to correct NOCs may result in fines as describe in the rules. 2 P a g e

4 Returns: When transactions are returned as R01 Insufficient Funds or R09 Uncollected Funds, the Originator can reoriginate up to two (2) additional times for a total of Three (3) attempts. After that, no additional attempts may be made. These items can be re-originated unless 180 days have passed from the original settlement date. If a transaction is returned with the following return codes a new authorization must be obtained and a new ACH file submitted. The Standard Entry Class Code must be corrected on an R05 return: R05 Unauthorized Debit to Consumer Account Using Corporate SEC Code R07 Authorization Revoked by Customer R08 Payment Stopped R29 Corporate Customer Advises Not Authorized R10 Customer Advises Not Authorized Reversals: If the originator recognizes that an error has been made on a file there are two options: i. If prior to 24 hours of effective day, please contact Enterprise Bank to determine if file can be deleted. A new file must be submitted by the originator. ii. If the file has been processed, a reversing file, batch or entry can be made to correct the error by the customer. a. If processing a file reversal, the complete ACH file that was originally submitted must be reversed and the word REVERSAL must be in the company Entry Description. b. If processing a reversal for an incorrect amount or account, a correcting entry must also be processed within 24 hours of the reversal file. c. The RDFI is under no obligation to post the reversing debit if it overdraws the payee s account or if the payee s account is closed. d. A payee must be notified if a reversing entry debits his or her account. However, a payee does not need to authorize the reversing debit. Same Day ACH: ACH Originators are able to submit Same Day ACH transactions up until our 1:30PM EST cutoff, as long as the Same Day ACH transactions meet all qualifications below: ACH transactions greater than $25, and International ACH transactions (IAT) are not eligible for same-day processing by the ACH network. (Any transaction exceeding $25, in a Same Day batch file will automatically be edited to settle on the next business day. All other transactions under $25, will be processed as Same Day items if they are received prior to the cutoff time state above.) In addition, the U.S. government will be participating in Same Day ACH but this will phased-in beginning September 15, If you would like to send Same Day items to a Federal Agency, please contact them to determine if they will accept Same Day items. OFAC (Office of Foreign Asset Control): OFAC enforces economic and trade sanctions based on US foreign policy and national security goals. OFAC publishes a list of individuals and companies owned or controlled by, or acting for or on behalf of, targeted countries. It also lists individuals, groups, and entities, such as terrorists and narcotics traffickers designated under programs that are not country-specific. Collectively, such individuals and companies are called "Specially Designated Nationals" or "SDNs." Their assets are blocked and U.S. persons are generally prohibited from dealing with them. The Bank must protect itself by informing every client that it is against the law to send debit 3 P a g e

5 or credit entries to OFAC blocked individuals or entities. Refer to the OFAC SDN list for questions or concerns. Security: Originators are responsible to ensure that they have sufficient security in place when sending ACH transactions. The Bank offers a variety of methods such as dual control, restricted online access, notifications and exposure limits. All initiated ACH transactions require the use of a security token provided by the Bank. Additional security recommendations are listed below to help assist with mitigating risk: Password Protection Use a strong password that specific in length and character type which is unique to each user Never use default passwords Do not share password with co-workers Require change of password after 30, 60 or 90 days Lockout a user after a certain amount of attempts Use password activated screensavers Safeguard passwords Blocking Potential Intruders Restrict use of computer for business purposes only Protect and update your IT system anti-virus/spyware software, firewalls Encrypt all data when moved and when stored Install software patches or upgrades as soon as they are available Log off computer or device when not in use Automatic log-outs after a certain amount of inactivity Limit or disable unnecessary workstation ports/services/devices Change all vendor supplied passwords (administrator account in particular) Restricting Access Limit the number of locations where Protected Information is stored Keep paper records in a secure locked location Take precaution when mailing Protected Information Limit employee access to Protected Information, including server rooms; if applicable Encrypt or mask electronic Protected Information Do not store Protected Information on portable devices such as USB drives, phones or CDs, Transmit Protected Information over the Internet in a secure session or secure Establish an Internet Acceptable Usage Policy Educating Staff Keep Protected Information safe and secure at all times Mask Protected Information in communications, such as phone calls, s and snail mails Make staff aware of security policy and procedures Make staff aware of all social engineering such as phishing scams via s or phone calls Discuss security processes of mobile devices, tablets and laptops when not in the office. Establish a Clean Desk policy 4 P a g e

6 ACH INFORMATION SHEET Delivery Address: Contacts: Enterprise Bank and Trust Company Electronic Servicing 222 Merrimack Street Lowell, MA Electronic Servicing: (978) Troubleshooting and Online Module Questions Cash Management Operations: (978) New Agreement Setups and Maintenance Legal Holidays: Requirements: File Format: Mondays: Martin Luther King Day; President's Day; Memorial Day; Labor Day; Columbus Day; Any Non-Monday holiday falling on a Sunday. Thursdays: Thanksgiving Other: Independence Day, July 4; Veterans Day, November 11; Christmas, December 25; New Year s Day, January 1. Signed ACH Agreement for all types of ACH origination Signed Authorization form from each ACH recipient (samples of these forms in this packet) Enrollment in EFTPS for origination of Federal tax payments ( Enrollment in MASSACHUSETTS DOR for MA state tax payments ( File format as specified under NACHA operating rules. See ACH Rules, A Complete Guide to Rules and Regulations Governing the ACH Network. File formats are detailed further within this information package. All files must be balanced whereby the total debit amount detailed in (5) Record (8) is equal to the total credit amount detailed in (6) Record (8). No unbalanced files will be accepted for processing by the Bank without prior authorization. Transaction Codes: Demand Credits - 21 Notice of Change, 22 Deposit, 23 Prenotification (Most commonly used) Demand Debits - 26 Notice of Change, 27 Payment, 28 Prenotification Savings Credit - 31 Notice of Change, 32 Deposit, 33 Prenotification Savings Debit - 36 Notice of Change, 37, Payment, 38 Prenotification Reversing Payments: Deadline for reversing a direct deposit is 12:01 pm, two business days after the settlement date. Reversals can only be initiated under limited circumstances. See ACH Rules, A Complete Guide to Rules and Regulations Governing the ACH Network. Reference: ACH Manager Quick Reference Guide 5 P a g e

7 SCHEDULE OF EVENTS The following is a general schedule of the events involved in establishing ACH transmittal with Enterprise Bank and Trust Company (the Bank ): i. Sign ACH Agreement and return to the Bank Once the Bank receives the signed agreement from you, a credit review will be done and you will be notified we are ready to test. A security token will be mailed to you and any other employee at your company who has been granted ACH access. This token will be used to supply a one-time password for each Online Banking session as well as to release ACH transactions. ii. Test Transmission & Pre-notification - Once you have collected the required authorization forms from all participants, a file containing test data must be supplied to the Bank if you choose to use ACH origination software other than the Bank s. See specifications below, which detail the specific format that your file must follow. This documentation should be given to your data processing staff or your service bureau as soon as possible so they can make the necessary preparations to your system. The Bank will work with your data processing staff or your service bureau to answer any questions that arise. Upon successful completion of the required tests, the Bank will require a prenotification transaction for each participant. The pre-notification (pre-notes) transaction is a zero dollar transaction used to ensure the validity of the participants Bank account information. iii. Processing Schedule - The Bank processes ACH files three times per day (11:00 AM EST, 1:30 PM EST & 5:00 PM EST). Originators may use proprietary software or the Bank supplied ACH origination software available in Business Online Banking to submit ACH files. In order to submit Same Day ACH entries, the file must be successfully submitted through Business Online Banking no later than 1:30 PM EST. iv. For Tax Payments Only Upon successful completion and approval of an ACH Agreement for the purposes of paying either Federal or Massachusetts state tax payments or both, you are required to properly enroll yourself and indicate to each party that your payment status is electronic payment. You can enroll yourself in the Federal government s electronic fund transfer service by going to the following website and following its instructions for enrollment: You can enroll yourself in the Massachusetts electronic fund transfer service by going to the following website and following its instructions: 6 P a g e

8 MOST COMMON STANDARD ENTRY CLASS CODES NACHA uses Standard Entry Class (SEC) codes to designate the method by which an ACH entry is authorized. The rules regarding each SEC varies, and NACHA monitors various statistics by originator and SEC. Below is a list of some of the most commonly used Standard Entry Class codes. If your company is interested in originating multiple SEC codes, please discuss this with your Branch Relationship Manager or Cash Management Advisor. CONSUMER APPLICATIONS Each type of ACH transaction carries specific risk issues that are related to the purpose of the transaction, as well as how and who originates the transaction. However, in general, all consumer transactions carry the following risk concerns: i. Timing of returns: Most entries need to be returned by the Receiving Depository Financial Institution (RDFI) so that the return entry is available to the Originating Depository Financial Institution (ODFI) no later than the opening of business on the second business day following the original settlement date of the transaction. ii. Unauthorized returns may be returned up until the 60th day following the original settlement date of the transaction. The consumer is required to provide a Written Statement of Unauthorized Debit that identifies the item as being unauthorized. iii. As an ODFI, Enterprise Bank can be held liable under NACHA Rules for any breach of warranty. The majority of warranty issues tend to be regarding proper authorization. Breach of warranty is not limited to the return time frames discussed above but is limited only by the statute of limitations for breach of contract claims under the applicable state law. iv. The next section highlights the primary differences between SEC codes used for consumer entries. PPD PPD can be used for credit or debit transactions. Most PPD transactions are authorized in writing in advance of the transactions. PPD is normally used for recurring transactions (consistent or variable amounts) such as payroll or direct debit. However, NACHA Rules do not exclude the use of PPD for single-entry authorizations. PPD transactions can also be authorized under the standard of similarly authentication, which allows the use of electronic signatures, digital signatures and security codes. RISKS UNIQUE TO PPD Because NACHA Rules allow digital authentication, ACH transactions can be accepted by interactive voice response (IVR) and touch-tone systems and be processed under the PPD Standard Entry Class (SEC). This is frequently misunderstood by originators who may try to use the TEL SEC in error. 7 P a g e

9 CORPORATE APPLICATIONS CCD This is the most commonly used corporate entry. CCD can be used for either debit or credit transactions to distribute or collect funds between corporate entities. Tax payments also use this standard entry class for federal and state payments. CTX This is most commonly used to move funds and information related to the payments. A CTX transaction supports up to 9,999 addenda records to communicate ANSI ASC X 2 message sets or UN/EDIFACT information. RISKS UNIQUE TO CASH CONCENTRATION In general, corporate transactions carry additional risk issues when used for cash concentration. Cash concentration is the consolidation of funds from multiple financial institutions, where the accounts at each financial institution are all owned by the corporate entity. Since deposited funds are available to the corporate entity on the effective date of the transaction, it is possible for the corporate entity to withdraw funds and then declare Bankruptcy. If this sequence of events should occur, the ACH debit entries presented to the receiving financial institution are likely to be returned, and Enterprise Bank would have unsecured credit exposure. TIMING OF RETURNS: i. Most entries will need to be returned by the RDFI so that the return entry is available to the ODFI no later than the opening of business on the second business day following the original settlement date of the transaction. ii. iii. For the receiver of CCD or CTX truncations, this shorter return time frame requires daily reconciliation to recognize and return unauthorized or other ACH debits in a timely manner. Originators are held liable under the Enterprise Bank ACH Agreement for any breach of warranty (which includes, but is not limited to, any breach of warranty regarding proper authorization). Such breach of warranty is not limited to the return time frames discussed above but is limited only by the statute of limitations for breach of contract claims under the applicable state law. 8 P a g e

10 STANDARD ENTRY CLASS CODES WITH REQUIREMENTS TEL This Standard Entry Class Code is used for the origination of a Single Entry debit transaction to a consumer s account pursuant to an oral authorization obtained from the consumer via the telephone. This type of transaction may only be originated when there is either (1) an existing relationship between the originator and the receiver, or (2) no existing relationship between the originator and the receiver, but the receiver has initiated the telephone call. This SEC Code facilitates access to the ACH Network by providing an alternative authorization method, oral authorization via the telephone, for certain types of consumer debit entries. Before initiating a TEL transaction, please call Enterprise Bank at so we may have a further discussion about the requirements surrounding this type of SEC code and refer to the NACHA Operating Rules and Guidelines Book. WEB This Standard Entry Class Code is used for the origination of debit entries (either Single or Recurring Entry) to a consumer s account pursuant to an authorization that is obtained from the Receiver via the Internet. This SEC Code helps to address unique risk issues inherent to the Internet payment environment through requirements for added security procedures and obligations. Before initiating a WEB transaction, please call Enterprise Bank at so we may have a further discussion about the requirements surrounding this type of SEC code and refer to the NACHA Operating Rules and Guidelines Book. 9 P a g e

11 ACH RECORD INFORMATION Please reference the information below as it relates to the various parameters throughout this document: Inclusion Requirements Mandatory (M): A Mandatory field is necessary to ensure the proper routing and/or posting of an ACH entry. Any Mandatory field not included in an ACH record will cause that entry, batch, or file to be rejected by the ACH Operator. ACH Operator rejected entries will be returned to Enterprise Bank and Trust Company. ACH Operator rejected batches and rejected files will also be reported to Enterprise Bank and Trust Company. Required (R): The omission of a Required field will not cause an entry to reject at the ACH Operator, but may cause a reject at the Receiving Depository Financial Institution (RDFI). An example is the Depository Financial Institution (DFI) account number field in the Entry Detail Record (6). If the Originating Depository Financial Institution (ODFI) omits the field, the RDFI may return the entry as unable to post. You, the Originator should include data classified as Required, to avoid processing and control problems at the RDFI. Optional (O): The inclusion or omission of an Optional data field is at the discretion of the Originator and the ODFI. Numeric and Alphanumeric Requirements Right Justify all numeric fields using zeros to fill the remainder of the field unless indicated otherwise. Left Justify all alphanumeric fields using blank spaces to fill the remainder of the field unless indicated otherwise. 10 P a g e

12 File Header Record (1) (for all entries) No. Position Length Name File Contents Required Comments Record Type Code 1 M Fill field using value indicated under File Contents column Priority Code 01 R Fill field using value indicated under File Contents column Immediate Destination b M b represents a blank space Immediate Origin b M b represents a blank space File Creation Date YYMMDD M Fill field using the YYMMDD format File Creation Time HHMM O Fill field using HHMM format File ID Modifier Alphanumeric M Must be UPPERCASE A_Z or Record Size 094 M Fill field using value indicated under File Contents column Blocking Factor 10 M Fill field using value indicated under File Contents column Format Code 1 M Fill field using value indicated under File Contents column Immediate Destination Name Enterprise Bank R Fill field using value indicated under File Contents column Immediate Origin Company R Fill field using your company name. Name Name Reference Code Leave Blank O Fill field with blank spaces. 11 P a g e

13 Batch Header Record (5) (for CCD, CTX and PPD entries) No. Position Length Name File Contents Required Comments Record Type Code 5 M Fill field using value indicated Service Class Code 200 M Fill field using value indicated Company Name Company Name M Fill field using your company name Company Leave Blank O/R Fill field with blank spaces. Discretionary Date Company ######### M Fill field with your tax id number Identification Standard Class Entry Alpha M Use either a CCD, CTX or PPD Company Entry Alphanumeric M Example: Payroll Description Company Descriptive Alphanumeric O Example: Jan 03 Date Effective Entry Date YYMMDD R Fill field using the YYMMDD format Settlement Date Julian Date R This field can be left blank. If so, then Enterprise Bank will fill the field Originator Status Code 1 M Fill field using value indicated Originating DFI Identification M Fill field using value indicated Batch Number Numeric M Example: Start with and increment by 1 for each next batch. 12 P a g e

14 Entry Detail Record (6) (for CCD and PPD entries) No. Position Length Name File Contents Required Comments Record Type Code 6 M Fill field using value indicated Transaction Code Numeric M Use the following: 22 Demand Auto Deposit 23 Demand Prenotice Credit 27 Demand Auto Payment 28 Demand Prenotice Debit 32 Savings Auto Deposit 33 Savings Prenotice Credit 37 Savings Auto Payment Receiving DFI Identification 38 Savings Prenotice Debit Numeric M Fill field using the first 8 digits of the Routing and transit number Check Digit Numeric M Fill field using the last digit of the Routing and Transit number DFI Account Number Alphanumeric R Fill field using the account number, left justified and blank space filled Dollar Amount $$$$$$$$ M Fill field using the dollar amount, left justified and blank space filled Identification Number Alphanumeric O Left justified and blank spaces filled Individual Name Alphanumeric R Fill field using the recipient s name, left justified and blank spaces filled Discretionary Data Leave Blank O Fill field with blank spaces Addenda Record Indicator 0-1 M 0 if no addenda record; Max Trace Number M Fill field using value indicated 13 P a g e

15 Entry Detail Record (6) (for CTX entries) No. Position Length Name File Contents Required Comments Record Type Code 6 M Fill field using value indicated Transaction Code Numeric M Use the following: 22 Demand Auto Deposit 23 Demand Prenotice Credit 27 Demand Auto Payment 28 Demand Prenotice Debit 32 Savings Auto Deposit 33 Savings Prenotice Credit 37 Savings Auto Payment Receiving DFI Identification 38 Savings Prenotice Debit Numeric M Fill field using the first 8 digits of the Routing and transit number Check Digit Numeric M Fill field using the last digit of the Routing and Transit number DFI Account Number Alphanumeric R Fill field using the account number, left justified and blank space filled Dollar Amount $$$$$$$$ M Fill field using the dollar amount, left justified and blank space filled Identification Number Alphanumeric O Left justified and blank spaces filled Number of Addenda Numeric M 0000 if no addenda; Max 9999 Records Receiving Company Name Alphanumeric R Left justified and blank spaces filled Reserved Leave Blank N/A Fill field with blank spaces Discretionary Data Leave Blank O Fill field with blank spaces Addenda Record Indicator M 0 if no addenda record; Max Trace Number M Fill field using value indicated 14 P a g e

16 Addenda Record (7) (for CCD, CTX and PPD entries) No. Position Length Name File Contents Required Comments Record Type Code 7 M Fill field using value indicated Addenda Type Code 05 M Fill field using value indicated Payment Related Information Addenda Sequence Number Entry Detail Sequence Number Alphanumeric O Information that the recipient would either need to reconcile the payment or could use to identify the sender/reason for the credit or debit M This number indicates the number of addenda records being sent with the associates Entry Detail Record for CCD and PPD for CTX Numeric M Seven-digit incremental counter. 15 P a g e

17 Company/Batch Control Record (8) No. Position Length Name File Contents Required Comments Record Type Code 8 M Fill field using value indicated Service Class Code 200 M Fill field using value indicated Entry/Addenda Count Numeric M Fill field with the total number of detail and addenda records in the file Entry Hash Numeric M The hash is an arithmetic sum of the 8-digit routing numbers, with overflow out of the high order (leftmost) position ignored Total Debit Entry Dollar Amount Total Credit Entry Dollar Amount Company Identification Message Authentication Code $$$$$$$$$$ M Fill field using the dollar amount, left justified and blank space filled. $$$$$$$$$$ M Fill field using the dollar amount, left justified and blank space filled. ######### R Fill field with your tax id number Alphanumeric O The Message Authentication Code is an eight character code left justified and blank spaces filled that is derived from a special key used in conjunction with the DES algorithm Reserved Leave Blank O Fill with blank spaces Originating DFI Identification M Fill field using value indicated Batch Number Numeric M Should equal value in field 13 record P a g e

18 File Control Record (9) No. Position Length Name File Contents Required Comments Record Type Code 9 M Fill field using value indicated Batch Count Numeric M Fill field with the total number of Company/Batch Header Records in the file Block Count Numeric M Fill field with the total number of physical blocks (a block is 940 characters) in the file Entry/Addenda Count Numeric M Fill field with the total number of addenda record (7) s in the file Entry Hash Numeric M Fill field with the sum of the corresponding fields in the Company/Batch Control Records on the file Total Debit Entry Dollar Amount $$$$$$$$$$ M Fill field using the dollar amount, left justified and blank space filled Total Credit Entry $$$$$$$$$$ M Fill field using the dollar amount, Dollar Amount left justified and blank space filled Reserved Leave Blank O Fill with blank spaces 17 P a g e

19 ACH SECURITY QUESTIONAIRRE Attached please find a self-assessment questionnaire designed to help your business comply with the ACH Framework Amendment. The questions are intended to assist you in determining what your security practices are. Please take the time to answer the questions to help determine if your security practices meet the obligations of the ACH Security Framework Guidance. 1. What types of ACH related information does your company store? (Mark all that apply) Authorization forms Checks used as part of authorizations (including voided checks) s or other electronic correspondence with entry information Electronic NACHA formatted files sent to the Enterprise Bank for processing Paper files or entries sent to Enterprise Bank for processing Other reports containing entry information from accounting software or other programs 2. Where is information related to ACH entries stored? (Mark all that apply) Home office of employees Removable media sources (i.e. Flash drives, CDs, Backup tapes/drives) Company website Outsourced technology service provider location/server File cabinets Desk drawers Binders Work PC/laptop Mobile device 3. Who at your company has access to ACH related information? (Mark all that apply) All employees, including any temporary workers Only those with ACH related job duties Managers/principals of the company Outside parties (cleaning companies, contractors, etc.) 4. Which of the following controls do you have in place for the physical security of data? (Mark all that apply) Locked storage space (file cabinet, drawer) Locked storage for backup drives or other removable media Key inventory to ensure limited staff access to sensitive information Clean desk policy Office security systems or alarms 5. Which of the following controls do you have in place for the digital security of data? (Mark all that apply) Unique User IDs for each employee Password controls: Strong password requirements (length, character requirements, etc.) Secure storage of passwords, including ensuring they are not posted at workstation Required changes of passwords after days (insert number) 18 P a g e

20 Lockout of user account after invalid attempts (insert number) Timeout or automatic locking of workstation after minutes (insert number) Restricted access to files on network by job duties Designated PC for any internet banking or funds transfer services, such as ACH Updated anti-virus and anti-malware programs Automatic software patches or upgrades, including operating system updates Restrictions on types of internet sites that can be used or usage of company Firewall for office network Secure for communications with customers/employees when sensitive information is being transmitted Encrypted or secured customer websites if used for accepting payment requests Encryption for laptops or other mobile devices Self-destruct or remote clean ability for lost or stolen mobile devices Controls for remote connections to and from the company (e.g. Virtual Private Network [VPN] connection) 6. Are your company s employees provided training on information security? Yes No If yes, are the following topics included? (Mark all that apply) Password security Social engineering (e.g. phishing via or phone) Acceptable use policies for internet and Security of mobile devices/laptops when traveling 7. Do you work with outside service providers to help you with your technology and data security efforts? Yes No If yes, are the following topics considered before start a new relationship with a service provider? (Mark all that apply) Research of potential new companies (financial history, references, internet search) Contract review regarding data security practices and confidentiality How a service provider would notify you of a possible breach and action plan Other steps taken to review potential service providers: 8. How do you keep track of when documents can or should be destroyed? How do you destroy physical information? How do you destroy digital media sources that contain ACH information? (e.g. hard drives from computers and/or copiers, flash drives, copiers, CDs, backup tapes, etc.) 19 P a g e

21 9. Do you have a plan of how to respond if there is a data breach at your company (physical or digital)? Yes No If yes, have you included steps to contact the following parties as needed? Yes No Enterprise Bank Legal counsel Law enforcement Your customers/employees affected Service providers to help clean or repair affected devices Completed By: Title: Signature: Date: Additional Security Resources: Better Business Bureau (Data Security Made Simple) List of Additional Resources for Securing Sensitive Data NACHA joins Better Business Bureau (BBB) in Data Security- Made Simple National Education General Computer & Security Tips Understand & Reporting Phishing / Scams Federal Trade Commission Practical tips for business on creating and implementing a plan for safeguarding personal information Federal Communications Commission Ten Cybersecurity Strategies for Small Business 20 P a g e

22 AUTHORIZATION AGREEMENT DIRECT DEPOSIT (ACH CREDITS) Company Name I (we) hereby authorize, hereinafter called COMPANY, to initiate credit entries and to initiate, if necessary, debit entries and adjustments for any credit entries in error to my (our) account indicated below and the depository named below, hereinafter called DEPOSITORY, to credit and / or debit the same to such account. DEPOSITORY NAME: BRANCH: CITY: STATE: ZIP: TRANSIT/ ABA NUMBER: ACCOUNT TYPE (check one): ( ) Checking* ( ) Savings ACCOUNT NUMBER: *PLEASE ATTACH A VOIDED CHECK This authority is to remain in full force and effect until COMPANY has received written notification from me (or either of us) of its termination in such time and manner as to afford COMPANY and DEPOSITORY, a reasonable opportunity to act on it. NAME(S): Please Print SIGNATURES: DATE: ***PLEASE ATTACH A VOIDED CHECK TO THIS FORM*** 21 P a g e

23 AUTHORIZATION AGREEMENT DIRECT PAYMENTS (ACH DEBITS) Company Name I (we) hereby authorize, hereinafter called COMPANY, to debit entries to my (our) account indicated below and the financial institution named below, hereinafter call FINANCIAL INSTITUTION, to debit the same to such account. (Financial Institution Name) (Branch) (Address) (City/ State) (Zip) Type of Acct.: Checking Savings (Routing Number) (Account Number) The authority is to remain in full force and effect until COMPANY has received written notification from me (or either of us) of its termination in such time and manner as to afford Company and FINANCIAL INSTITUTION a reasonable opportunity to act on it. (Print Individual Name) (Print Individual ID Number) (Signature) (Date) ***PLEASE ATTACH A VOIDED CHECK TO THIS FORM! *** 22 P a g e

24 AUTHORIZATION AGREEMENT FOR PRE-AUTHORIZED DEBIT ORGANIZATION TO ORGANIZATION The below authorization has been provided by Enterprise Bank and Trust Company to its client company as a recommended format. Enterprise Bank and Trust Company recommends that the company review this authorization with its counsel. Company Name: Customer Name: Customer s Account No. with Company: Customer s Bank Account to be charged: Name of Bank: (For Company Use: Bank No: - - ) Location (City, State, & Zipcode): Account #: The CUSTOMER listed below authorizes and requests the COMPANY named above to effect payment for amounts owing by the CUSTOMER to the COMPANY as such amounts become due by initiating debit entries to the CUSTOMER S BANK ACCOUNT at the Bank indicated above. The CUSTOMER authorizes and requests the BANK to accept any debit entries initiated by the COMPANY to the CUSTOMER S BANK ACCOUNT and to apply those entries to the CUSTOMER S BANK ACCOUNT without responsibility for the correctness of the entries. If the CUSTOMER is a natural person, CUSTOMER represents to COMPANY that the CUSTOMER S BANK ACCOUNT is, and during the term of this agreement will be, maintained primarily for business, and not for personal, family or household purposes. It is understood that his agreement may be terminated at any time by written notification from the CUSTOMER to the COMPANY or the BANK. Any such notification to the COMPANY shall be effective only with respect to entries indicated by the COMPANY after receipt of such notification and a reasonable opportunity to act on it. Any such notification to the BANK shall be effective only with respect to entries received for the CUSTOMER S BANK ACCOUNT at the BANK after receipt of such notification and reasonable time to act on it. Date: Signature(s): 23 P a g e

25 ACH AUTHORIZATION AGREEMENT Corporate Trade Exchanges" This Agreement, dated as of, 20, is between ("Originator") and ("Receiver"). RECITALS A. Receiver wishes to have Originator initiate [Credit] [Debit] Entries to its account specified below (the "Account") in payment of obligations owed by [Originator to Receiver] [Receiver to Originator] pursuant to the terms of this Agreement and the Rules relating to Corporate Trade Exchange (the "Rules") of the National Automated Clearing House Association [and the Automated Clearing House Association], and Originator is willing to initiate such Entries on the terms set forth below. B. Unless otherwise defined herein, capitalized terms shall have the meanings provided in the Rules. AGREEMENT NOW, THEREFORE, in consideration of the mutual promises contained herein, Originator and Receiver agree as follows: 1. Authorization. Subject to the terms set forth below, Receiver authorizes Originator to initiate [Credit] [Debit] Entries to the Account in accordance with the Rules for obligations owing from time to time by [Originator to Receiver] [Receiver to Originator] resulting from [specify type(s) of services or obligations for which Entries may be initiated]. 2. Authorization Limitations; Procedures. No Entry shall be initiated under this Agreement except in conformity with the authorization provided above. [Specify other limitations, e.g., on the number of Entries that may be initiated in a given period, on the time of the month at which Entries may be initiated, on the dollar amount of any Entry that may be initiated, and/or on the aggregate dollar amount of all Entries that may be initiated in a given period.] [If applicable, specify procedures for Receiver to inform Originator of the dollar amount of Entries to be initiated.] [Debit Entries] [No single Entry initiated under this Agreement shall be in excess of $. Such maximum amount may be changed by Receiver from time to time on day s prior written notice by Originator.] 3. Originator's Failure to Originate. [Debit Entries] Receiver shall not be deemed to default on any obligation or suffer any loss of discount or other penalty by reason of the failure of Originator to initiate any Debit Entry in accordance with the terms of this Agreement, or by reason of any delay in receipt by Receiver's financial institution, or the nonreceipt by such institution of any Debit Entry initiated by Originator. 4. Compliance with Rules. Receiver shall comply with and be bound by the Rules as in effect from time to time. 5. Acceptance and Return of Entries. Nothing contained herein shall be deemed to require Receiver or its financial institution to accept any Entry initiated under this Agreement, and any such Entry may be returned in accordance with the Rules. Receiver shall not be deemed to have accepted any Entry that is returned in accordance with the Rules. [Credit Entries] Originator shall not be deemed in default on any obligation or suffer any loss of discount or other 24 P a g e

26 penalty be reason of the return of any Entry, provided such Entry was initiated in accordance with the terms of this Agreement. Notwithstanding any statement contained in any Entry or any data transmitted with any Entry, and notwithstanding the failure to return any Entry in accordance with the Rules, Receiver shall not be deemed to have accepted any Entry as being in the correct amount if, within days after receipt of the Entry by its financial institution, Receiver provides written notice to Originator of a discrepancy. 6. Credit for Entries. [Credit Entries] Unless such Entry is returned in accordance with the Rules, Receiver shall, as of the date the amount of such Entry is credited to the Account, credit Originator with the Amount of each Entry received and interest or other charges payable with respect to the amount of such Entry shall cease of the time. [Debit Entries] Unless such Entry is returned in accordance with the Rules, Originator shall, as of the date of such Entry is credit to its Account with its financial institution, credit Receiver with the amount of each Entry received. 7. Entry Information. Each Entry initiated under this Agreement shall be accompanied by the following information: [describe information]. [Describe monthly or other periodic information to be furnished Receiver.] 8. Receiver's Account. The Account is the following deposit Account maintained by Receiver: Financial Institution: Account No. Bank of Location: Telephone No. If Receiver is a natural person, Receiver represents to Originator that the Account is, and during the term of this Agreement, will be, maintained primarily for business, and not for personal, family, or household purposes. 9. Questions and Errors. In the event of any questions or error relating to Entries initiated pursuant to this Agreement, Receiver should contact, and Originator should contact. 1. Liabilities of Parties. Neither Originator nor Receiver shall be liable for the act or omission of any Automated Clearing House, financial institution, or other person. [Add any desired additional provision relating to liability and/or damages. 2. Notice. Any written notice or other written communication required or permitted to be given under this Agreement shall be delivered, or sent by United States registered mail, postage prepaid, and, if to Originator, addressed to: and, if to Receiver, addressed to: Attn: 25 P a g e

27 Unless another address is substituted by notice delivered or sent as provided herein. Any such notice shall be deemed given when [so delivered or sent] [received]. 12. Termination. This Agreement may be terminated by Originator or Receiver at any time by giving day s prior written notice to the other party. Notwithstanding such termination, this Agreement shall remain in force and effect as to all transactions that have occurred prior to the date of the termination. 13. Headings. Headings are used for reference purposes only, and shall be deemed a part of this Agreement. 14. Law Governing. This Agreement shall be construed in accordance with and governed by the laws of the State of. 15. Entire Agreement. This Agreement embodies the entire agreement of the parties with respect to the subject matter hereof, and supersedes all previous negotiations, representations, and agreements with respect hereto, and shall be binding upon the parties hereto, and their respective successors and assigns. This Agreement may be amended only by a writing signed by both parties. Receiver (Company) Name Signature Date Originating (Company) Name Signature Date 26 P a g e