Understanding SEC Codes

Overview

When processing ACH (Automated Clearing House) payments in the United States, each transaction must include a Standard Entry Class (SEC) Code. SEC Codes are defined by NACHA and identify how an ACH transaction was authorized and the circumstances under which it was initiated. Using the correct SEC Code is important for NACHA compliance, proper transaction processing, risk management, and dispute resolution.

An SEC Code provides additional information about the transaction, including: 

• How the transaction was authorized, such as online, by telephone, in writing, or through an eligible check. 
• Whether the transaction involves a consumer or business account. 
• The authorization and processing requirements that apply. 
• The rules that may apply to returns and dispute. 

Each ACH transaction must use an SEC Code that accurately reflects the actual authorization method and transaction circumstances. The system or channel used to submit the transaction does not, by itself, determine the correct SEC Code.

Using the appropriate SEC Code help:

• Meet applicable Nacha requirement.
• Maintain an accurate record of how the transaction was authorize.
• Apply the appropriate authorization and processing requirement.
• Support proper risk classification. 
• Protect the organization when responding to returns or dispute.

Using an incorrect SEC Code may result in compliance issues, transaction declines, or losses during disputes.   

The SEC Code should be selected based on the transaction and how authorization was obtained. The following should be considered when selecting an SEC Code:

• Whether the bank account is a consumer or business account. 
• How the customer authorized the payment. 
• Whether the authorization was obtained online, by telephone, in writing, or through a check. 
• Whether the transaction is a debit or credit. 
• If a check was used, how the check was received and processed. 
• Whether the transaction involves a financial institution outside the United States.

A merchant may use more than one SEC Code when different authorization methods or transaction types are supported. Each individual transaction must use the code that corresponds to its actual authorization method and circumstances. 

"WEB" applies to consumer debit transactions authorized through the internet or a wireless network. WEB transactions are also subject to specific security requirements for protecting consumer financial information. Applicable Originators of Web Debit transactions must meet the separate Web Debit Security Audit (WDSA) requirements. The two requirements are related but separate:

• The WEB SEC Code identifies how the ACH transaction was authorized.
• The WDSA evaluates the security controls maintained for consumer financial information.

Correcting a WEB SEC Code does not resolve a WDSA compliance issue, and completing the WDSA does not correct an inaccurate SEC Code. 

If an SEC Code is not provided in the transaction message, CSG Forte may assign a default SEC Code based on the integration method. Certain integrations may generally default to PPD or WEB.

Secure Web Pay (SWP) uses WEB for eCheck transactions because the payment is initiated by the consumer through an online payment form. 

A default SEC Code does not replace the merchant's responsibility to ensure that the code accurately represents how the transaction was authorized.

Integrated partners supporting multiple authorization methods should ensure that the appropriate SEC Code is submitted for each transaction when the integration supports this functionality.

The SEC Code should correspond to the actual authorization method and transaction circumstances rather than the system or channel used to submit the transaction. 

Each SEC Code has specific requirements for obtaining and maintaining evidence of authorization. Depending on the transaction, these requirements may include written or similarly authenticated authorization, telephone records, notices, receipts, or other evidence showing how the customer authorized the payment. Merchants should maintain applicable authorization records according to the requirements for the SEC Code being used. For additional information, refer to the Proof of Authorization (POA) and Nacha Requirements guidance available in the CSG Forte Knowledge Base or contact the CSG Forte Customer Service team. 

If an SEC Code is disabled because it does not match the merchant's processing activity, future transactions submitted with that code may decline with response code U78.

If a U78 response is received:

• Confirm how the customer authorized the transaction.
• Verify that the SEC Code being submitted accurately represents that authorization method.
• Contact CSG Forte Customer Service if assistance is needed to determine the appropriate SEC Code or configuration.

For additional information about U78, refer to the Transaction Decline Codes resource. 

method and transaction circumstances rather than the system or channel used to submit the transaction.

Merchants that require assistance determining the appropriate SEC Code for ACH transactions can contact CSG Forte Customer Service at customerservice@forte.net or 866-290-5400, Option 1. 

When contacting CSG Forte, the following information should be available:

• Merchant ID.
• Whether the bank account is a consumer or business account.
• How the customer provided authorization.
• Whether the payment is one-time or recurring.
• The SEC Code currently being submitted, if known.
• The CSG Forte product or integration being used.