The Real-Time Lending Advantage

The Real-Time Lending Advantage

How Instant Payments Are Reshaping Borrower Expectations and Lender Strategies

We live in an economic era defined by immediacy. Consumers can order groceries with a tap, stream any movie on demand, and transfer funds between accounts in seconds. Against this backdrop, the traditional lending model (filled with processing windows, banking hours, and settlement delays) feels increasingly outdated. For many borrowers, the expectation of speed is no longer aspirational. It is assumed.

This expectation is particularly pressing in lending, where delays in access to funds can have real-life consequences. A borrower seeking emergency funds to avoid eviction, cover a medical expense, or fix a vehicle can’t wait until the next business day. For them, funding delays aren’t just an inconvenience …they’re a liability.

The advent of Real-Time Payments (RTP), including the RTP® network and the Federal Reserve’s FedNow℠ Service, offers a transformative solution. These payment rails allow funds to be delivered to a borrower’s bank account within seconds, 24/7, including nights, weekends, and federal holidays. And yet, adoption within the lending industry (especially among traditional lenders) remains patchy.

This article explores the gap between borrower expectations and lender capabilities, the strategic advantages of real-time funding, and why institutions that act now will define the next generation of consumer finance. From borrower loyalty and operational efficiency to fraud mitigation and competitive positioning, the case for real-time disbursement has never been stronger or more urgent.

Today’s borrowers do not compare lenders to each other, they compare them to every other modern digital experience they engage with. When ridesharing apps, food delivery services, and peer-to-peer payments all operate in real-time, any financial service that introduces friction or delay feels archaic.

This shift is particularly acute among:

  • Gig economy workers, who expect same-day access to earnings.
  • Freelancers and consultants, who often rely on immediate cash flow between contracts.
  • Low-to-moderate income borrowers, for whom a one-day delay could mean an overdraft or a missed bill.

A recent study by the Federal Reserve found that 78% of consumers prefer faster payment methods when available, with 82% valuing real-time confirmation of funds. Furthermore, 26% of consumers identified last-minute bill payment as one of the top use cases where real-time payments would provide the most benefit.

Notably, 25% of respondents cited slow speed of funds as one of their most frustrating pain points in payments, second only to fees. As one millennial respondent put it: “Some apps charge a significant fee to move money or take 2–3 days to transfer. Eliminate fees and speed up the transfers.”

Borrowers aren’t just reacting to delays, they’re building their financial behaviors around speed.

Borrower Takeaway: If the funds aren’t available instantly, the lender isn’t either.

Loan disbursement isn’t just a back-office function. It’s the moment of truth in the borrower journey. Delays at this critical stage diminish the borrower’s perception of the lender, even if the application and approval processes were seamless.

RTP changes that. With instant funding, a borrower can go from application to funds-in-hand in under a minute. That kind of performance creates what behavioral economists call a “gratification anchor” …a strong positive association that makes the borrower more likely to return, and more likely to recommend.

What this translates to in practice:

  • Higher reloan rates
  • Lower first-payment defaults (FPD)
  • Better Net Promoter Scores (NPS)
  • Reduced abandonment during application flow

According to the Fed’s 2024 Consumer Payments Study, consumers cited immediate notifications, the ability to use funds 24×7, and ease of sending as top motivators for choosing real-time payment methods.

Example:
A mid-sized lender using VIKExpress saw a 27% increase in same-month repeat borrowing after enabling real-time disbursement. Their marketing and acquisition costs didn’t change. Their retention strategy simply became faster.

Real-time payments are not just faster, they’re always on. That matters more than most lenders realize.

In today’s lending environment, loan applications peak during off-hours. Evening and weekend traffic accounts for over 40% of all digital applications across short-term and installment loan platforms. Traditional ACH infrastructure forces lenders to delay funding until the next business day, creating a disconnect between borrower action and lender response.

According to the Federal Reserve’s 2024 data, Gen Z and Millennials rank last-minute bill payment and digital wallet top-ups as top use cases for faster payments. Baby Boomers and Gen X prioritize loan disbursements and real estate or auto-related payouts, making RTP a cross-generational benefit.

With RTP or FedNow:

  • Applications at 10pm on Sunday can be funded at 10:01pm.
  • Loans approved on Thanksgiving can be delivered within 60 seconds.
  • Borrowers on the West Coast applying after East Coast banking hours aren’t left waiting until morning.

Use Case:
A tribal lender operating nationally found that enabling 24/7 funding helped them increase weekend originations by 46% year-over-year. The most common feedback in their borrower reviews? “I got my money right away.”

Beyond the borrower experience, real-time disbursement offers critical backend advantages.

1. Elimination of card funding risks:
Unlike push-to-debit solutions, RTP does not require lenders to collect or store card data. This minimizes exposure to fraud vectors like synthetic identity, card cycling, and prepaid reload scams.

2. Superior reconciliation:
Each RTP transaction posts individually and immediately, with detailed confirmation. This eliminates batch files, delayed returns, and uncertainty about when funds will settle.

3. Fewer failed disbursements:
Since RTP relies on DDA account data validated in advance, there’s less room for error. Combined with tools like VIKEdge (which verify account balances in prior to debit origination), lenders can create a tightly managed funding and repayment cycle with fewer break points.

4. Faster issue resolution:
When disbursement questions arise, RTP provides instant confirmation, something ACH systems often cannot do for 24–48 hours.

Bottom line: RTP reduces funding exceptions, improves cash management, and simplifies audit trails.

The assumption that RTP requires months of technical work or massive IT investment is outdated. Today’s platforms are built for flexibility.

With VIKExpress, for example:

  • Existing ACH clients can activate RTP with a simple addendum.
  • Clients can use the RTP-enabled virtual terminal while integrating APIs in parallel.
  • Production credentials and sandbox access are provisioned within 24–48 hours.

Some lenders go live in under a week.

Integration Approaches:

  • Direct API (ideal for scale lenders with dev resources)
  • LMS plug-ins (supported in platforms like Infinity, QFund, EPIC, and others)
  • Manual transactions via web-based portal (for low-volume or transitional use)

Whether you’re a high-frequency originator or a niche tribal lender, the barrier to entry is no longer technical.

The longer a lender waits to adopt real-time payments, the more likely they are to fall behind.

Why?
Because RTP is not just a differentiator, it’s rapidly becoming table stakes.

PYMNTS and Fed data show that:

  • 89% of surveyed companies have used RTP for at least one type of payout
  • Gen Z and Millennials are 2x as likely to use real-time payments compared to older cohorts
  • Instant disbursement usage is growing across verticals including insurance, auto lending, and online marketplaces

The Federal Reserve’s study also found that consumers using real-time payments rated their satisfaction with their financial institution 8% higher than those who did not. This suggests that beyond borrower acquisition and retention, RTP can also boost your institutional brand.

What this means for lenders:

  • Affiliate marketers increasingly prioritize lenders who fund instantly
  • Licensing renewals and state reviews now evaluate speed and transparency
  • Borrower churn rises when competitors offer a faster experience

As borrower demands and partner expectations increase, lenders without RTP will not just lose deals… they’ll lose credibility.

The case for real-time disbursement is no longer theoretical. It’s here. It’s proven. And it’s what borrowers expect.

Lenders who embrace RTP now position themselves as forward-looking, borrower-first institutions. They also position themselves for operational scale, lower risk, and higher return.

Those who wait will find themselves explaining delays that borrowers (and the market) no longer tolerate.

Next Steps for Lenders:

  • Audit your disbursement timelines. How long do borrowers really wait?
  • Identify your weekend and off-hours volume. Are you missing revenue?
  • Talk to your payments partner. Can they activate RTP now? (If not, you may need a new partner.)

Real-time lending is not just the future. It’s the new baseline. Don’t fall behind.

December 19, 2025

About Adam Garrett

He has spent almost 20 years building successful merchant acquiring programs and is a proven sales leader who brings his expertise in team management, business development, and strategic planning to Viking Payments. He received his MBA from the University of Texas at Dallas, and his BS at Missouri State University.

Bigger Possibilities Await.

Contact Us


Read More

Nacha Fraud Monitoring Updates, Risk Management

Nacha Fraud Monitoring Updates

As 2025 comes to a close, attention is shifting to 2026 and the next wave of changes in the ACH Network. Nacha has announced several upcoming rule amendments that strengthen risk management expectations, clarify existing requirements, and introduce new monitoring obligations for ACH participants. This article outlines the key updates so businesses can understand what to expect as these Rules take effect throughout 2026.

Some of the changes are minor clarifications that will have limited impact on most participants. Others, particularly those related to fraud monitoring, represent more meaningful shifts in expectations. Not all changes will apply to every Originator, Third Party Sender, or ODFI, but all ACH participants should be aware of what is coming.

Use of Return Code R17 “Questionable”
This update clarifies the proper use of R17 rather than introducing a new return code. Under the revised definition, an RDFI may return an entry as “Questionable” when it believes the transaction or Receiver information is inaccurate, incomplete, or inconsistent with what it knows about the account. This change provides clearer guidance for RDFIs and creates earlier feedback for Originators when something about the entry appears suspicious.

Banking Day Definition Clarification
This is not a substantive change but a clarification. It confirms that a “Banking Day” is defined as a day on which the ACH Operator is open for business. The goal is to remove ambiguity and ensure uniform interpretation across the network.

RDFI Requirement to Provide Payment-Related Information
Several SEC Codes require RDFIs to provide Payment-Related Information to Receivers. These include CCD, CTX, CIE and IAT. The updated Rule clarifies that this requirement does not apply if these entries post to a consumer account. The expectation only applies when the Receiver is a non-consumer.

Company Entry Descriptions
These amendments take effect March 20, 2026 and apply to both credits and debits. Originators may adopt the new descriptions before the effective date. The changes support standardization and enhanced monitoring across the network.

ACH Credit Entry
The Company Entry Description for credits that represent wages or other compensation must contain the description PAYROLL.

ACH Debit Entry
For ACH WEB debits that represent the online purchase of goods, including recurring purchases first authorized online, the Company Entry Description must contain the description PURCHASE.

Risk Management Rule Updates
The most significant changes relate to fraud monitoring. Nacha is introducing new requirements for Originators, ODFIs, Third Party Service Providers, and Third Party Senders, along with a separate monitoring requirement for RDFIs. These Rules are being phased in during 2026.

These new expectations apply to ODFIs, non-consumer Originators, TPSPs, and TPSs. The requirements take effect in two phases.

Phase 1: March 20, 2026
Applies to participants with annual origination volume of 6 million or more in 2023.

Phase 2: June 19, 2026
Applies to all remaining non-consumer Originators, TPSPs, and TPSs not included in Phase 1.

The purpose of the amendment is to ensure participants establish and implement risk-based processes and procedures designed to identify potentially fraudulent entries. Routine monitoring is expected to reduce the likelihood of successful fraud attempts and strengthen the entire ACH ecosystem.

Today, Originators of WEB debits and users of Micro-Entries must utilize a “commercially reasonable fraudulent transaction detection system”. The updated Rule removes that terminology. The phrase “commercially reasonable” and the expectation of a “transaction detection system” are replaced with more practical language that focuses on processes and procedures.

This shift clarifies that Nacha is not prescribing specific technologies. Instead, entities must maintain documented processes that demonstrate how they reasonably identify and respond to fraud risks, based on the role they play in the ACH Network. The flexibility allows organizations of different sizes and risk profiles to implement approaches appropriate to their environments.

Nacha requires that these processes and procedures be reviewed at least annually, or sooner if material changes occur during the year.

This update adds new expectations for RDFIs related to monitoring of incoming ACH credits. The Rule does not impose new obligations on Viking Originators but is part of Nacha’s broader fraud prevention strategy.anges, reach out to your Viking representative today.

As these updates take effect in 2026, ACH participants should take time to review their current practices, confirm that documentation is up to date, and ensure fraud monitoring processes align with Nacha’s expectations. While some of the changes are minor clarifications, others require operational adjustments that strengthen risk management across the network. Viking will continue to monitor these developments and support our clients through each phase of implementation to ensure a smooth and compliant transition.

December 9, 2025

About Megan Williams

She is a dedicated payments professional with a passion for operational processes, efficiencies and a love for the Rules. She has been in the financial services industry since 2016, strengthening her understanding of the space and obtaining her ACH Certification (AAP). She specializes in optimizing operations, enhancing payment processes and ensuring compliance in all matters of her job and this industry. 

Bigger Possibilities Await.

Contact Us


Read More

Understanding VISA VAMP

Understanding VISA VAMP

Visa’s Acquirer Monitoring Program, known as VAMP, is a global compliance and risk oversight framework designed to ensure that acquirers, payment processors, and merchants operate safely, consistently, and in alignment with Visa’s rules. VAMP helps protect the payments ecosystem by reducing fraud, monitoring unusual or high-risk activity, and confirming that underwriting and portfolio management practices remain strong.

VAMP is not a penalty program. It does not function the way Visa’s dispute monitoring programs work. Instead, it is a structured method for Visa to confirm that acquirers have appropriate controls, documentation, and oversight in place. When Visa detects elevated dispute activity, irregular transaction patterns, outdated merchant files, or missing documentation, it may request clarification or remediation. The goal is to improve stability across the network and prevent issues before they impact merchants.

VAMP was developed in response to increased fraud trends, evolving digital payment behaviors, and growing regulatory expectations worldwide. Visa is placing greater emphasis on the accuracy of merchant onboarding, the completeness of underwriting files, the use of correct MCCs, and the ongoing monitoring of merchant portfolios. By strengthening these areas, Visa helps acquirers prevent unauthorized activity, reduce misuse of merchant accounts, and ensure that high-risk behaviors are detected early.

For most merchants, VAMP requires little to no direct action. Visa’s inquiries flow to the acquirer and processor, not to individual merchants. Your processing continues without interruption. In some situations Viking may reach out for small updates such as a current business license, ownership verification, a website review, or a clarification about your products and services. These requests are simple, quick, and designed solely to maintain alignment with Visa’s guidelines.

Viking is approaching VAMP with a proactive, portfolio-wide strategy that protects merchants and strengthens long-term processing reliability. Our compliance, underwriting, and risk teams have expanded documentation standards, improved MCC accuracy, and upgraded identity, KYB, and bank-account verification tools. We have also enhanced transactional monitoring to identify early indicators of fraud or unusual behavior across the portfolio.

In partnership with our sponsor banks, Viking has increased transparency through improved reporting, updated merchant files, and ongoing communication around risk trends. This allows potential concerns to be addressed early and keeps merchant processing stable and uninterrupted.

  • Earlier fraud and dispute monitoring thresholds with automated pattern detection
  • Comprehensive audits of all merchant underwriting files to confirm Visa and bank compliance
  • Updated training for onboarding, underwriting, and compliance teams
  • Deployment of advanced KYB and KYC tools to reduce onboarding risk
  • Continuous policy updates to match Visa and sponsor-bank expectations
  • Strengthening of MCC classification and merchant data accuracy
  • Portfolio-wide merchant reviews to ensure proper business information and operational descriptions

A stronger compliance and monitoring environment reduces fraud, lowers dispute exposure, improves portfolio health, and helps preserve long-term access to card processing. Merchants benefit from:

  • Continued, uninterrupted processing
  • Faster identification of operational issues or fraud patterns
  • Fewer unexpected disputes and chargebacks from upstream problems
  • A more secure environment for accepting Visa cards
  • A more stable relationship between Viking, our sponsor banks, and the Visa network

For most merchants nothing will change. From time to time Viking may request updated documentation to ensure your file remains compliant. These requests are routine and typically take only a few minutes to complete. Payment processing continues as normal and real-time funding through VIKExpress is unaffected.

Viking is committed to making the VAMP process seamless and supportive. Every action taken under VAMP is designed to strengthen merchant protections, maintain high-quality bank relationships, and ensure long-term access to secure payment processing. If you have questions or need help with any compliance documentation, our team is ready to assist. reach out to your Viking representative today.

December 1, 2025

About Robert Hollifield

He is an accomplished director with 15 years of experience in underwriting, risk management, and compliance in the payments space. He specializes in high-risk merchant oversight, regulatory adherence, and improving end-to-end payment processes to ensure secure, reliable operations. He received his BS from the University of New Hampshire.

Bigger Possibilities Await.

Contact Us


Read More

New ACH Rules: What Originators and RDFIs Must Know in 2025

New ACH Rules
What Originators and
RDFIs Must Know in 2025

With ACH fraud risks rising, Nacha has introduced key updates, some in effect now and others phasing in through 2026. Here’s what you need to know and act on today.

Credit push fraud, such as Business Email Compromise(BEC) or vendor impersonation, is a growing threat,  and Nacha has reinforced roles and protocols to combat it. In a typical BEC scenario, fraudsters gain access to or spoof a legitimate business email account to trick someone into sending an ACH credit or wire transfer to a fraudulent destination. These attacks often involve fake invoices, altered payment instructions, or urgent requests that appear to come from a trusted internal or external source. As these scams become more sophisticated, financial institutions and businesses must adapt their defenses accordingly.

Receiving institutions must now monitor incoming credits and have risk-based procedures to identify and act on suspicious entries.

ODFIs and RDFIs are encouraged to communicate when suspected fraud is identified. A secure exchange portal is now available for handling return requests, particularly under R06.

Institutions should also educate business and consumer clients about common fraud tactics to increase vigilance before a transaction is initiated.

Nacha has introduced a new classification called False Pretenses (which is included in the R17 return code). This covers payments induced by misrepresentation of identity, authority, or account ownership. Examples include payroll impersonation and vendor fraud. It does not apply to scams involving fake products or services.

RDFIs can now use R17 to return entries they believe may be fraudulent, even if the receiving account is valid.

The word “QUESTIONABLE” must be included in the addenda record when this return reason is used.

ODFIs can now request returns through the Letter of Indemnity (LOI) process using R06 for other reasons that are applicable to the scenario, such as suspected fraud.

RDFIs must respond to R06 requests within 10 Banking Days. That response can be either a return or a formal status update. A secure exchange portal is available to facilitate these requests and responses.

The Written Statement of Unauthorized Debit (WSUD) no longer needs to be signed by the settlement date. It may now be signed on or after the effective date of the debit, offering greater flexibility for account holders disputing unauthorized transactions.

Beginning in 2026, Nacha will require risk-based fraud detection processes for all Originators and ODFIs. The requirement will take effect in two phases.

Phase 1 begins in March 2026 and applies to Non-consumer Originators (and vendors) with 2023 ACH origination volume of 6 million or greater.

Phase 2 begins in June 2026 and applies to all others.

Processes must be reviewed annually. There is no requirement to review each individual transaction or to conduct manual review before file submission. Instead, participants must establish reasonable procedures to flag suspicious activity based on patterns, amounts, frequency, or account behavior.

Receiving institutions must implement a risk-based credit monitoring process and respond appropriately when suspicious activity is identified.

This process should be reviewed annually to ensure it remains effective. Monitoring does not require line-by-line transaction reviews, but should include logic to detect red flags such as:

  • SEC codes that do not match account types
  • Unusually large credit amounts
  • Multiple credits from different states
  • Update your fraud detection processes
  • Train your staff on new classifications like False Pretenses and changes to R17 and R06
  • Ensure your systems support the new entry descriptions PAYROLL and PURCHASE
  • Prepare for the phased rollout of the fraud monitoring requirements
  • Review WSUD policies to allow for signature on or after the effective date
  • Test your response time and documentation process for R06 return requests

These updates strengthen the ACH ecosystem and clarify roles and responsibilities across all parties. With deadlines extending into 2026, now is the time to make adjustments, train your staff, and ensure your ACH operations align with Nacha’s evolving standards.

At Viking, we build solutions like VIKEngage, VIKExpress, and VIKEdge with these compliance needs in mind. Whether you need real-time monitoring, simplified return processes, or tools to minimize fraud risk, we’re here to help.

If you have questions about your readiness or need support implementing these changes, reach out to your Viking representative today.

July 17, 2025

About Megan Williams

She is a dedicated payments professional with a passion for operational processes, efficiencies and a love for the Rules. She has been in the financial services industry since 2016, strengthening her understanding of the space and obtaining her ACH Certification (AAP). She specializes in optimizing operations, enhancing payment processes and ensuring compliance in all matters of her job and this industry. 

Bigger Possibilities Await.

Contact Us


Read More

Payment Processing FAQ

Payment Processing FAQ
What Every Merchant Should Know

Whether you’re new to payment processing or a seasoned operator, the landscape is constantly evolving. From faster ACH return options to the latest tools in transaction management, merchants need to stay current to reduce risk and operate efficiently. Below, we answer some of the most common questions we hear from clients.

Yes, and it can be a significant improvement for your operations.

Under Nacha and UMACHA guidelines, ACH returns can be processed using Same-Day ACH, even if the original transaction was not sent as a same-day item.

Here’s what you need to know:

  • No Same-Day Entry Fees for Returns – RDFIs are not charged fees for initiating returns using the Same-Day ACH window
  • Faster Return Resolution – Same-day returns reduce liquidity exposure, accelerate reconciliation, and minimize the risk of downstream errors
  • Improved Risk Management – Quicker returns help detect and respond to issues such as fraud or invalid accounts faster
  • Everyone Benefits – Faster return processing supports ODFIs, RDFIs, and Originators by reducing uncertainty and improving settlement timelines

If your return process still follows next-day timing by default, we recommend evaluating a same-day return process to improve overall performance and responsiveness.

Yes. Viking offers Viking VRM (Viking Relationship Manager), a secure online portal where you can manage card activity, monitor chargebacks, and review reporting, all in one place.

Key features include:

  • Real-time visibility into card transactions and funding activity
  • Chargeback management, including retrieval request tracking and resolution statuses
  • Batch and individual transaction lookup, with exportable reports for reconciliation
  • Detailed fee reporting, including interchange and processor-level assessments
  • User-level access controls, so teams can manage workflows without overexposing sensitive data

If you don’t already have access to Viking VRM, contact your Viking representative. We’ll get your user credentials set up and walk you through how to get the most from the platform. It’s a powerful resource for day-to-day card operations and dispute management.

Viking provides clients with access to VIKEngage, a powerful transaction insight platform designed to give real-time visibility into ACH activity and return rates.

With VIKEngage, you can:

  • Track ACH debits, credits, and returns by code and date in real time
  • Monitor your return ratios to ensure you stay below NACHA’s thresholds
  • Filter, review, and export transaction data for compliance reporting or internal audits
  • Identify operational trends or problem accounts that may need attention
  • Access intuitive dashboards that simplify ongoing compliance and risk oversight

VIKEngage is available via a user-friendly web portal and requires no additional integration or setup for existing clients. If you’re not already using it, reach out to your Viking representative and we’ll get you connected.

We’re investing heavily in the future of payments through our VIKEngine suite, a set of connected tools designed to bring speed, intelligence, and risk reduction to your operations.

Here’s a look at what’s currently available:

  • VIKExpress – Enables real-time disbursements through both the RTP and FedNow networks. Funds are delivered instantly, 24/7, improving borrower satisfaction and reducing operational delays
  • VIKEdge – Combines ACH processing with real-time bank balance verification, reducing NSF returns and giving you confidence before initiating debits
  • VIKEngage – A transaction insight platform that gives you real-time visibility into ACH activity, return codes, and performance trends to help you stay below NACHA thresholds and make informed decisions
  • VIKExclude – A pre-funding screening tool that checks routing and account numbers against a proprietary database of accounts with known fraud or return history, helping prevent losses before funds are sent

Each of these tools is available individually or as part of a broader VIKEngine integration, and all are designed to help merchants operate faster, smarter, and more securely.

At minimum, payment processing policies and procedures should be reviewed and updated annually.

Doing so helps ensure:

  • Compliance with NACHA, PCI DSS, and card brand requirements
  • Internal controls remain aligned with evolving risk
  • Documentation accurately reflects current systems and staff responsibilities
  • You’re prepared for audits or external reviews

Reviews should also be triggered after any major operational changes, system upgrades, or security incidents. An annual review is a simple but critical part of keeping your business compliant and audit-ready.

We’re always here to help. Whether you’re looking to streamline your return process, access Viking VRM, or explore the VIKEngine platform, your Viking representative is just a call or email away.

Let us know what you’d like to see covered in a future FAQ. We’re always listening.

July 9, 2025

About Adam Garrett

He has spent almost 20 years building successful merchant acquiring programs and is a proven sales leader who brings his expertise in team management, business development, and strategic planning to Viking Payments. He received his MBA from the University of Texas at Dallas, and his BS at Missouri State University.

Bigger Possibilities Await.

Contact Us


Read More

Common ACH Audit Findings

Common ACH Audit Findings
and How to Stay Compliant

Every year, businesses that originate ACH transactions are subject to an ACH audit, as required by the NACHA Operating Rules. While many audits go smoothly, there are a handful of recurring issues that pop up year after year. Some are simple, others potentially serious. Whether you’re preparing for an upcoming audit or looking to tighten up your existing ACH practices, understanding these common findings is a smart place to start.

Below are some of the most frequent ACH audit findings, along with insights and recommendations for how to avoid them:

Chapter 56 of the NACHA Rules covers the audit requirements that every ACH Originator and Third-Party Sender must follow. It requires an annual audit to ensure compliance with the NACHA Operating Rules and recommends documentation for each key function. Failure to perform this audit or maintain documentation can result in non-compliance findings.

Tip: Make sure your audit is performed annually by a qualified party and that you retain clear documentation of the audit scope, findings, and corrective actions taken.

NACHA requires that each company maintain and annually review its contact information in NACHA’s database. This ensures that your organization can be contacted in the event of a network or transaction issue.  [When working with Viking, this information is located on Schedule E of your ACH Origination Agreement]

Tip: Set a calendar reminder to review and update your NACHA contact list every 12 months.

The Risk Assessment is more than a formality. NACHA expects a formal risk assessment document that includes risk ratings for each threat and control in your ACH process.

Tip: Document not only risks, but also the impact, likelihood, and controls in place. Assign risk levels to each category, such as Low, Medium, or High.

Improper use of Standard Entry Class (SEC) Codes, such as using PPD instead of WEB for internet-authorized transactions, is a frequent finding.

Tip: Confirm that every transaction is being coded appropriately. For example:
• PPD: Prearranged payment and deposit (consumer, pre-authorized)
• WEB: Consumer-initiated internet or mobile transactions
• TEL: Telephone-initiated

Originators are required to have signed agreements with all parties involved in ACH transactions, including clear authorization language and responsibilities.

Tip: Review your agreements annually and ensure all parties are documented and acknowledged in writing.

When a financial institution issues a Notice of Change, you’re required to update your records before the next transaction or within six banking days, whichever comes first.

Tip: Assign ownership of NOC monitoring and include this step in your daily ACH processing checklist.

ACH returns must be processed quickly and accurately. A delay in responding to unauthorized debits or incorrect return coding is a compliance risk.

If a payment is reinitiated due to insufficient funds, NACHA rules require the word “RETRY PYMT” in the Company Entry Description field. Without it, the transaction could be flagged as unauthorized.

Tip: Automate the insertion of “RETRY PYMT” into all reinitiated NSF entries to ensure compliance.

Many businesses fail to create or test a formal Business Continuity Plan for ACH operations, which is a NACHA expectation.

Tip: Draft a documented plan outlining how ACH processing will continue in the event of a disruption. Test it annually and keep logs of those tests.

The Electronic Funds Transfer Act (Regulation E) requires specific consumer disclosures, such as dispute rights and liability limits. These must appear on account statements or statement backers.

Tip: Review your Reg E disclosures annually and confirm that consumers receive them through appropriate channels.

Many merchant agreements and consumer-facing Terms and Conditions lack clear language about ACH authorization, dispute procedures, and usage of recurring entries.

Tip: Add a section to your Terms and Conditions that explains how ACH transactions are authorized and handled. Include clear consent language.

Being prepared for your next ACH audit starts with awareness. These common findings don’t just reflect compliance oversights, they point to real operational risks that could lead to fines, returns, or customer dissatisfaction.

Want help tightening up your ACH processes? Reach out to your Viking representative today.

June 22, 2025

About Tracey Gibson

She is an accomplished compliance executive with extensive experience in overseeing and managing compliance functions and initiatives of an organization. She has expertise in ensuring organizations comply with regulatory requirements and brings a strong background in ethical business practice, risk management, privacy, employee management and customer service.

Bigger Possibilities Await.

Contact Us


Read More

PCI DSS 4.0 in 2025

What Merchants Need to Know
About PCI DSS 4.0 in 2025

If your business accepts credit or debit cards, PCI compliance is essential. The latest version of the Payment Card Industry Data Security Standard, PCI DSS 4.0, is now fully in effect. It introduces major changes designed to strengthen cardholder data protection and adapt to today’s complex digital payment landscape.

This version replaces the older 3.2.1 standard and includes critical enhancements for fraud prevention, authentication, and risk management. Here’s what you need to know and how to stay current in 2025.

PCI DSS 4.0 is the global security standard for any organization that stores, processes, or transmits cardholder data. It was officially released in March 2022 and became the mandatory standard as of March 31, 2024. A clarification update, version 4.0.1, was published in mid-2024 to refine language and improve implementation guidance without changing the core requirements.

The real shift came in April 2025, when many of the formerly “best practice” or future-dated requirements became enforceable. Merchants must now fully align with PCI DSS 4.0 and address all applicable requirements, including those phased in over the past year.

April 1, 2025, marked the date when PCI DSS 4.0 enforcement began in full. Businesses that have not transitioned from 3.2.1 risk fines, higher merchant fees, breach liability, and potential disruption of card processing services.

The update reflects the growing complexity of modern payments, where merchants may process card data across physical points of sale, mobile apps, e-commerce platforms, and cloud environments. PCI DSS 4.0 provides a more flexible framework while raising the bar for security, accountability, and risk management.

  1. Scope Definition and Maintenance
    Merchants must define and document their PCI scope annually. For service providers, this must be done every six months. This includes identifying all systems and components involved in storing, processing, or transmitting cardholder data.
  2. Multi-Factor Authentication (MFA)
    MFA is now required for all access to the cardholder data environment, both internal and external. This eliminates prior exemptions and greatly improves protection against unauthorized access.
  3. Stronger Password Controls
    User passwords must now be at least 12 characters long unless a system limitation exists. This aligns PCI DSS with modern password standards for increased security.
  4. Web Application Security
    Public-facing payment pages must use a web application firewall or equivalent controls. Merchants must also monitor the integrity of all scripts loaded into these pages to prevent tampering or injection attacks.
  5. Automated Logging and Monitoring
    Merchants must implement automated logging systems to detect and alert on failures in critical security controls. Manual log reviews are no longer sufficient.
  6. Vulnerability Management and Software Inventory
    All internal vulnerability scans must be authenticated. Merchants must also maintain an inventory of software components using a Software Bill of Materials (SBOM) to quickly address known vulnerabilities.
  7. Phishing Defense and Awareness
    Anti-phishing technologies and employee training are required. This includes protecting users from fraudulent emails that could lead to credential theft or unauthorized access.
  8. Incident Response and Data Discovery
    Incident response plans must now include procedures for detecting unauthorized storage of cardholder data, not just responding to breaches.

While the 4.0 standard is stable, version 4.0.1 introduced clarification on several areas including encryption expectations, hashing, and vendor responsibilities. The PCI Council emphasized the importance of maintaining SBOMs and reinforced that organizations should now be implementing customized approaches only when clearly documented and reviewed.

Key reminders from recent updates include:

  • Use of keyed hashing algorithms
  • Proper encryption key lifecycle management
  • Annual scope validation
  • Documented roles for shared responsibility with third-party vendors

If your business is still catching up with PCI DSS 4.0 requirements, here are key action items to prioritize:

  • Perform a gap analysis against current operations and 4.0 requirements
  • Implement MFA for all users accessing systems in scope
  • Deploy or validate use of web application firewalls
  • Set up automated logging and alerting tools
  • Complete an SBOM for all software in your cardholder environment
  • Train staff annually on security awareness, phishing, and incident response
  • Confirm your third-party service providers are PCI compliant and responsibilities are clearly defined

Compliance is not just a technical checklist. PCI DSS 4.0 is about protecting your customers, your reputation, and your financial stability. Data breaches can be devastating, both in terms of brand damage and regulatory penalties. By staying compliant, you reduce risk, maintain trust, and avoid potential disruptions to your ability to process payments.

At Viking, we offer platforms and services built with compliance in mind. Whether you’re using VIKExpress for card-not-present transactions, VIKEdge for ACH with bank balance verification, or VIKEngage for transaction monitoring, we make sure your payments are processed securely and responsibly.

We can also help with:

  • PCI compliance assessments
  • Policy and documentation support
  • Vendor responsibility checklists
  • Technical integrations for MFA, logging, and scanning
  • Ongoing training and incident response planning

If you’re unsure whether you’re ready for PCI DSS 4.0.1 or need help getting your systems in line with the new standards, reach out to your Viking representative today.

Let’s make sure your payment security is not just compliant, but resilient.

June 7, 2025

About Thomas Stephens

He is a skilled professional in payment operations and technical support, with deep expertise in payment technologies, enhanced workflows, and leading end-to-end system and platform integrations. He brings over 10 years of experience ensuring reliable, secure payment solutions while driving process improvements and delivering high-level support across fast-paced environments. 

Bigger Possibilities Await.

Contact Us


Read More

Understanding ACH Reversals: When and How to Use Them

Understanding ACH Reversals
When and How to Use Them

The Automated Clearing House (ACH) network facilitates millions of financial transactions daily, making it an essential component of the U.S. payment system. However, errors can occur, necessitating the use of ACH reversals. Understanding the Rules and appropriate use of ACH Reversals is crucial for Originators to ensure compliance and maintain transaction integrity.

What is an ACH Reversal?

An ACH Reversal is the process of correcting a previously processed ACH transaction by withdrawing the funds from the recipient’s account and returning them to the Originator. This process is governed by specific rules outlined by Nacha (National Automated Clearing House Association) to prevent misuse and ensure that Reversals are only used in legitimate circumstances.

When Can ACH Reversals Be Used?

ACH Reversals can only be initiated under specific conditions, as defined by the Nacha Operating Rules and Guidelines. According to Nacha, these conditions include:

  1. Duplicate Transactions: When a single transaction is processed more than once.
  2. Incorrect Amount: When the amount of the transaction is incorrect.
  3. Incorrect Account: When the transaction is credited to the wrong account.
  4. Payment Originator Error: Any error that is attributable to the originator of the transaction, such as entering incorrect transaction information.

It is important to note that ACH Reversals are time-sensitive. Nacha rules stipulate that reversals must be initiated within five banking days from the settlement date of the original transaction.

Differences Between ACH Reversals and ACH Returns

While ACH Reversals are initiated by the Originator to correct errors, ACH returns are typically initiated by the receiving financial institution (RDFI). ACH returns occur when the recipient’s bank is unable to process the transaction due to reasons such as insufficient funds, closed accounts, authorization concerns or fraud.

Process of Initiating an ACH Reversal

The process of initiating an ACH Reversal involves several steps:

  1. Identify the Error: Determine the nature of the error that necessitates a Reversal.
  2. Notify the Receiving Party: Inform the recipient of the erroneous transaction and the forthcoming Reversal.
  3. Initiate the Reversal Entry: The Originator’s financial institution (ODFI) will create a reversing file entry using the appropriate ACH information.
  4. Include “REVERSAL” in Description: It is mandatory to include the word “REVERSAL” in the Company Entry Description field of the Reversal entry.
  5. Compliance Check: Ensure that the Reversal complies with Nacha Rules, including the five-day timeframe and the specific conditions under which Reversals are allowed.

Best Practices for Managing ACH Reversals

To effectively manage ACH Reversals and minimize potential disputes or compliance issues, Originators should adopt the following best practices:

  • Accurate Data Entry: Ensure that all transaction data is accurate before initiating ACH transactions.
  • Timely Action: Act promptly to identify errors and initiate Reversals within the permissible timeframe.
  • Clear Communication: Maintain transparent communication with all parties involved in the transaction, especially when an error occurs.
  • Regular Audits: Conduct regular audits of ACH transactions to quickly identify and rectify any discrepancies.
  • Minimize Use: Only allow authorized staff to initiate.

By understanding and adhering to Nacha’s rules on ACH Reversals, Originators can efficiently correct transaction errors while maintaining compliance and minimizing the risk of disputes. For further details on the rules and best practices related to ACH Reversals.

May 27, 2025

About Megan Williams

She is a dedicated payments professional with a passion for operational processes, efficiencies and a love for the Rules. She has been in the financial services industry since 2016, strengthening her understanding of the space and obtaining her ACH Certification (AAP). She specializes in optimizing operations, enhancing payment processes and ensuring compliance in all matters of her job and this industry. 

Bigger Possibilities Await.

Contact Us


Read More

Real-Time Payments: Two New Payment Rails

Real Time Payments

Two New Payment Rails

In the rapidly evolving landscape of financial transactions, the need for speed, efficiency, and security is paramount. Two new real-time payment rails—RTP (Real-Time Payments) and FedNow—are revolutionizing the way money moves, offering unparalleled advantages to businesses and consumers alike. This article delves into the features and benefits of these innovative payment systems and introduces VIKExpress, a new application by Viking that seamlessly integrates both networks.

RTP Network

The RTP network, launched by The Clearing House in 2017, is designed to enable instant payments across the U.S. financial system. Here are some of its key features and benefits:

1. Real-Time Processing:

  • Transactions are completed in real-time, typically within seconds, 24/7/365. This constant availability ensures that payments can be made and received at any time, eliminating delays associated with traditional banking hours.

2. Enhanced Data Capabilities:

  • RTP supports rich data exchanges, allowing for more detailed payment information to accompany transactions. This feature aids in efficient reconciliation and reduces errors and disputes.

3. Immediate Funds Availability:

  • Recipients have immediate access to funds, which enhances cash flow management for businesses and provides consumers with quicker access to their money.

4. Improved Security:

  • The RTP network incorporates robust security measures, including end-to-end encryption and fraud prevention protocols, ensuring secure transaction processing.

FedNow Network

FedNow, launched by the Federal Reserve in 2023, is another significant player in the real-time payments arena. Here are its standout features and benefits:

1. Instant Settlement:

  • Similar to RTP, FedNow provides instant settlement of transactions, operating 24/7/365. This feature allows for immediate payment confirmation and access to funds.

2. Broad Accessibility:

  • FedNow aims to include a wide range of financial institutions, from large banks to smaller community banks and credit unions, promoting greater financial inclusion and access to real-time payments across diverse communities.

3. Versatile Payment Options:

  • FedNow supports various payment types, including person-to-person (P2P), business-to-business (B2B), and government-to-consumer (G2C) transactions, enhancing its versatility and applicability across different sectors.

4. Strong Fraud Prevention:

  • The network includes advanced fraud detection and mitigation tools to ensure the security and integrity of transactions, providing peace of mind to users.

VIKExpress: Bridging the Gap

To leverage the capabilities of these real-time payment networks, Viking has introduced VIKExpress, a cutting-edge application that provides users with seamless access to both RTP and FedNow networks at competitive rates. VIKExpress is designed to meet the needs of businesses and consumers by offering two primary functionalities:

1. Virtual Terminal:

  • The Virtual Terminal feature allows businesses to process payments in real-time directly from their browser, providing a convenient and user-friendly interface for managing transactions.

2. API Integration:

  • For businesses looking to integrate real-time payment capabilities into their existing systems, VIKExpress offers robust API integration. This feature enables seamless, automated payment processing, enhancing operational efficiency and customer experience.

By combining the speed and security of RTP and FedNow with the innovative features of VIKExpress, Viking is setting a new standard in real-time payment solutions. Whether through the Virtual Terminal or API integration, users can enjoy the benefits of instant payments, improved cash flow, and enhanced transaction security.

In conclusion, the advent of RTP and FedNow networks marks a significant milestone in the evolution of payment systems. These real-time payment rails offer unprecedented speed, efficiency, and security, transforming how money moves in the digital age. With VIKExpress, Viking provides a powerful tool to access these networks, enabling businesses and consumers to fully capitalize on the advantages of real-time payments.

To learn more about VIKExpress, click here.

July 1, 2024

About John O’Shea

He is a former founder and owner of Triad Financial Services and has served in similar roles at GMAC/Residential Funding, AllianceOne and ICT Group (now Sykes). He has performed for 28 years as a senior executive in the ARM, Customer Contact and BPO markets. He is a graduate of St. Olaf College.

Bigger Possibilities Await.

Contact Us


Read More

Upcoming NACHA Rules Changes: Implications for Originators and Merchants

Upcoming NACHA Rules Changes

Implications for Originators and Merchants

As a payment compliance specialist, it is critical to stay abreast of the latest NACHA (National Automated Clearing House Association) rule changes. Two sets of amendments are set to take effect this year—on June 21 and October 1, 2024. Some of these changes will impact originators and merchants significantly, emphasizing the need for proactive adjustments to compliance and operational strategies.

June 21, 2024: Minor Rules Topics

The first wave of changes focuses on minor rule topics. Minor changes to the Rule have little to no impact on ACH participants and no significant processing financial impact.

  1. General Rule /Definition of WEB Entries– The updated NACHA rule clarifies the use of WEB entries, which are transactions initiated by a consumer over the internet or a wireless network. The new definition eliminates confusion by specifying that all consumer-to-consumer credits must use the WEB SEC code, regardless of the internet or wireless network being the method of initiation.
  2. Definition of Originator– The updated rule provides a clearer definition of an Originator, stating that it is the party authorized by the Receiver to credit or debit the Receiver’s account at the RDFI (Receiving Depository Financial Institution). This clarification helps in precisely identifying the responsible entity in a transaction, thus reducing ambiguities and potential disputes between parties involved in ACH transactions
  3. Originator Action on Notice of Change– This rule requires Originators to take prompt action upon receiving a Notice of Change (NOC) from the RDFI. The NOC indicates necessary corrections to the information within an ACH entry. Originators must make the specified changes within six banking days or before the next entry, whichever is later.
  4. Data Security Requirements– The updated rule extends the data security requirements to all non-consumer Originators, Third-Party Service Providers, and Third-Party Senders.
  5. Use of Prenotification Entries– The revised rule on prenotification entries provides clarity on their use and the handling of responses from RDFIs. Prenotification entries are optional but recommended for verifying account information before initiating live transactions. Originators can use these entries to ensure that account details are correct, reducing the risk of errors and rejected transactions. If an RDFI responds to a prenotification with a NOC, the Originator must address the indicated issues promptly
  6. Clarification of Terminology – Subsequent Entries– The rule clarifies the term “Subsequent Entries,” referring to entries that follow an initial authorization. These can be initiated by the consumer through actions such as phone calls or online requests. The updated rule allows greater flexibility in the use of Standard Entry Class (SEC) codes for these subsequent entries, accommodating various methods of initiation and ensuring that authorization requirements are met appropriately

October 1, 2024: Risk Management Topics

The second set of changes, effective October 1, centers around risk management, reflecting NACHA’s ongoing efforts to enhance the security and reliability of the ACH Network:

  1. Codifying Expanded Use of Return Reason Code R17– The updated rule codifies the expanded use of Return Reason Code R17 to enhance the identification and management of fraudulent activities. This rule includes the following specifics:
    • R17 + “QUESTIONABLE”: The addition of the word “QUESTIONABLE” in the return addenda record signifies a potential fraud alert on the receiving bank account. This helps financial institutions quickly identify transactions that may require further scrutiny for fraud
    • Impact on Unauthorized Return Rates: These returns will not be counted in unauthorized return rates, thus not affecting the metrics used to evaluate the frequency of unauthorized transactions
    • This new Rule also includes references to a newly defined term, False Pretenses: The inducement of a payment by a Person misrepresenting (a) that Person’s identity, (b) that Person’s association with or authority to act on behalf of another Person, or (c) the ownership of an account to be credited.”
      This definition covers common fraud scenarios such as Business Email Compromise (BEC), vendor impersonation, payroll impersonation, and other payee impersonations, and complements language on “unauthorized credits” (account takeover scenario). It does not cover scams involving fake, non-existent or poor-quality goods or services.
    • Expanded Use of ODFI Request for Return/R06–This rule expands the circumstances under which an Originating Depository Financial Institution (ODFI) can request a return of an entry using Return Reason Code R06 (Return per ODFI’s Request). This expansion aims to provide more flexibility and tools for ODFIs to manage erroneous or problematic entries, ensuring better correction of mistakes and reducing potential risks associated with such entries
    • Ensure your loan management and payment processing systems are updated for NACHA’s new R17 rule. This rule allows RDFIs to use Return Reason Code R17 with the descriptor “QUESTIONABLE” in the Addenda Information field to flag transactions that may be suspicious or fraudulent. Updating your systems will help differentiate these returns from routine account errors and maintain compliance with NACHA’s standards.
  2. Additional Funds Availability Exceptions– The rule introduces new exceptions to the funds availability requirements, allowing RDFIs more time to investigate suspicious transactions before making funds available to the account holder. This extension is critical in scenarios where there is a high likelihood of fraud, enabling RDFIs to ensure that the transaction is legitimate before releasing the funds. This change aims to reduce the risk of fraudulent withdrawals and losses for both the financial institution and the account holder
  3. Timing of Written Statement of Unauthorized Debit (WSUD)– The rule modification allows for greater flexibility in the timing of signing a WSUD. Specifically, it permits the WSUD to be signed and dated by the Receiver on or after the date the unauthorized debit entry is presented, even if the debit has not yet posted to the account. This change simplifies the process for receivers to dispute unauthorized debits and facilitates quicker resolution of such issues​
  4. RDFI Must Promptly Return Unauthorized Debit– This rule mandates that Receiving Depository Financial Institutions (RDFIs) must promptly return any unauthorized debit entries once they are identified. This requirement ensures that unauthorized debits are addressed quickly, minimizing the impact on the account holder and reducing the potential for further fraudulent activity. It emphasizes the responsibility of RDFIs to act swiftly in protecting their customers’ accounts from unauthorized transactions

For further details on these rule changes, visit NACHA’s official website on minor rules topics and risk management topics.

Preparing for Compliance

For originators and merchants, preparation is key to ensuring compliance with these new rules:

  • Review and Update Systems: Ensure that all payment processing systems are updated to align with the new data specifications and validation requirements.
  • Train Staff: Conduct comprehensive training sessions for relevant staff to familiarize them with the new rules and their implications.
  • Enhance Fraud Detection: Invest in advanced fraud detection and prevention technologies to meet the updated standards.
  • Audit Third-Party Relationships: Conduct thorough audits of third-party sender relationships to ensure compliance with the new risk management requirements.

By proactively addressing these changes, originators and merchants can mitigate risks, ensure compliance, and continue to facilitate secure and efficient ACH transactions.

June 4, 2024

About Adam Garrett

He has spent almost 20 years building successful merchant acquiring programs and is a proven sales leader who brings his expertise in team management, business development, and strategic planning to Viking Payments. He received his MBA from the University of Texas at Dallas, and his BS at Missouri State University.

Bigger Possibilities Await.

Contact Us


Read More