Hacker News Reader

Comment by woodruffw | Hacker News Reader

Settlement between banks in the United States is astoundingly complicated, for (fascinating, terrifying) historical reasons. FedNow is a huge step towards fixing holes that private companies have been papering over for over two decades.

Blatant self promotion: for anybody interested in learning more about the Automated Clearing House system (which FedNow will eventually supplement) and interbank settlement in general, I wrote a summary of much of it here: https://blog.yossarian.net/2019/12/25/A-shallow-dive-into-th...

View on HN

My first job out of university was working for a debt collection firm that made its own ACH engine in Perl. I remember all the 99999s and headers and stuff. I didn't work very much on the engine though (thankfully).

I was pretty shocked at just how far behind the American banking system was when I lived overseas for a bit. I wrote about it here:

https://battlepenguin.com/tech/the-american-banking-system-i...

It's even further behind. I still live overseas and use a US bank account for paying taxes, etc. I'm still shocked that it costs me, my family, or someone money to send money instantly. Here when we go out to dinner with friends, someone pays the bill and we settle it with bank transfers within moments.

It's worse than that if the amount is non-trivial. Wells Fargo won't allow you to send an amount over $10k instantly without physically entering a branch.

I think the first problem is you are talking about Wells Fargo. One of the worst banking options imaginable in the US.

While limits might not be much different from other banks, at the very least it's not Wells Fucking Fargo.

ive banked with wells forever and never had a problem. Practices like this are mostly designed for security reasons and will be similar across the big banks

Lucky you. Wells Fargo are terrible.

Seriously, do some research. I'd never use those fools.

This is typical around the world. This is probably because it's a very practical way to limit losses if someone did gain access to your online banking.

When I lived in Australia, which I believe has a very modern banking system, I couldn't instantly send more than $5k a day. The one time I needed to send more money, I was fine with going into a branch.

FWIW the app for my ING bank account in the Netherlands allowed me to move up the slider allows me to move up the slider for daily transfers up to 50k euros. A little scary, but thought it could be handy if I need to move money around one day. Probably a different regulatory context, though.

You can up the limits at any decent bank using some sort of MFA solution without physically going to a branch as if it's 1980.

The $10K limit is a federal regulatory requirement. You have to fill out paperwork and provide identification that is turned over to law enforcement for review.

As an added note: Don't try to get around this by breaking the transaction up into two $5k payments. That's also against the law.

It's called structuring!

Europe just got an instant payment system a year or so ago and not all countries have even implemented it yet.

Your blog article is startlingly incorrect pretty early on. Individuals can and do use ACH between each other all the time. It is literally how paper checks work in the US. And I’ve been able to use a routing number and account number to send money to someone else online via ACH for decades...

In the UK if I want to send someone money to anyone in the UK I open the mobile app and input their sort and account number, type in the amount of money and hit send. Done.

Similarly in the NL if I want to send someone money to anyone in the EuroZone I open my bank app type in their IBAN type in the amount of money and hit send. Done.

Back in 2017 when I lived in the US this just wasn't possible. If I wanted to send money to someone I had to use Paypal, TransferWise (or similar), Venmo, etc. Some banks had direct access to ACH but far from all, then if they do support it it takes two days to arrive. Some banks allowed easy instant payments between accounts within the same bank. Much of my family purposefully keep an account with a small west coast credit union to facilitate moving money amongst ourselves.

Maybe things have gotten massively better in the US in the last 3+ years, but it was light years behind the UK and NL. In terms of speed, ease of use, and adoption.

Those transactions always make me nervous - is there a reason they don't have a step of showing the account name when you input the number? Like, I type 31-45-76 0452768934 and it says "Mr & Mrs Y O Mama" or "Notafraud & Co. Ltd." or whatever, as a confirmation?

You’ll be pleased to know we do now have this in the United Kingdom. It’s called Confirmation of Payee.

That does exist now in the UK, I had it last time I sent money - I put in the name I expected and then it showed me the name on their account because they were a bit different.

For companies there are present lists so I don't need to know most company details to send say gas bill payments.

We have this for IBAN payments within the NL, I can't speak for the rest of the EuroZone.

The name check isn't universally supported, so it is better to say that it is strictly optional.

In the interm there's been unfortunately little progress. Zelle is supported 'natively' by all major banks, although it has horrible UX (starting with "each bank is different"), and allows for pseudo-instant transfers of small amounts (up to $x,000) between individuals in the US. (It is instant for the user, but on the subject of replacing ACH, it's more correct to say that it's pseudo-instant, same as credit cards - it seems instant to users, but until ACH is replaced, settlement will still happen in nightly (possibly half-day-ly) settlement batch files.)

It's mostly functional, the problem is that it doesn't work for anything more than trivial amounts, for various reasons, so the choices are either to wait 2 days, or physically walk to a bank location, authenticate, get them to give you a magical piece of paper, and then walk to the other location. (And then sometimes you still have to wait a few days more if it's not something you normally do "while the check clears".)

It's a byzantine system, but at least it doesn't (as a customer - it still does in places on the backend) involve me having to find a fax machine to send a fax, or send a picture of a check through a sketchy "free" online service.

> In the UK if I want to send someone money to anyone in the UK I open the mobile app and input their sort and account number, type in the amount of money and hit send. Done.

Apple / Google Pay? this isn’t as complicated as you’re trying to make it out to be. get a number, find out if they’re google or apple, use the appropriate app. This has been possible for years now.

Your quote and your response seem to be rather disconnected.

I guess my point is: in Europe sending money from one person to another is easy and easily done with no third parties. All I need to know is the other person's account info, access to my own account either by app or website, and done. Almost instant transfers between people.

In the US a third party is required. Be that Paypal, Apple/Google Pay (I didn't know they had launched this as a thing for person-to-person), square, facebook, etc. Not only does it require a third party it requires two people to be using the same third party.

My mother-in-law is fairly technophobic. She doesn't do online banking, doesn't use apps, etc etc. Yet despite that I can still send her money without an issue, because the infrastructure is basically universal. Unless they are doing something very strange anyone who has an account can receive money. Plumber comes over to fix a pipe, send him some money digitally, buying a car, send some money, etc etc.

Thanks for the feedback! I’m aware that checks (and “instant” payments like PayPal, Venmo, Zelle) are settled via ACH; as other commenters have pointed out for me, the claim was that individuals can’t make “raw” ACH transactions.

As for sending money via routing and account number: I’ve received conflicting information from different banks on how acceptable this is. The university I went to allowed it as a way to pay tuition (you could give them your account number and they would debit you), but every bank that I’ve privately banked with has told me that I need to own or be responsible for both accounts in order to do a “direct” (i.e. non-cheque) transfer. But I don’t know whether that’s just a policy thing among financial institutions.

I think the distinction being made there is that, while individuals can request that banks or businesses perform an ACH on our behalf, as in your funds transfer example or to pay a bill without incurring payment card fee overhead, we can't generate and submit our own batches directly to any clearinghouse.

Which is just as well! In that circumstance, there would be nothing structurally to stop anyone who knows your routing and account number from performing ACH debits against your account. That's actually an already extant attack vector - and the reason why I never pay bills via ACH; I don't trust most payment processors to be very secure and fraudulent payment card transactions are easier to claw back - but without the barrier to entry inherent in the attacker having to subvert or convince some third party to act on their behalf, I think it'd be a much more common occurrence.

> I think the distinction being made there is that, while individuals can request that banks or businesses perform an ACH on our behalf, as in your funds transfer example or to pay a bill without incurring payment card fee overhead, we can't generate and submit our own batches directly to any clearinghouse.

Is that possible in any country? I've never heard of a banking system where ordinary people directly submit a transaction to the national clearing house. They always tell their bank to send their funds, right?

As far as I know, yes, and UPI/"FedNow"/Cashapp-and-friends don't change that.

That being so, if I'm honest I'm not really sure where the prior commenter's objection originates. Maybe they know about some directly accessible clearinghouse that I don't? I'd be surprised for several reasons to learn such a thing exists, but I've been surprised plenty of times before.

Unless this is actually possible in some country, I think they're both confused. But I'm guessing the objection was probably intended to convey "this is just as 'direct' in the US as it is in Australia", which would seem like a valid objection to the article.

Most country’s bank systems have a “receiving only” number which can be shared and then used by a 3rd party to directly enter an instant money transfer into the system.

Because America doesn’t have the equivalent of a “receive only” code, every service has to build that functionality themselves “on top of” ACH, and prevent direct access to ACH debit and credit functionality.

That being said, for $10/month any business can get direct access to ACH including debits and credits, and then whatever gateway you use is supposed to do some level of fraud detection against your transactions.

A few days ago someone here point out the numbers aren't actually "receive-only" for IBANs either, but anyway, the point you're making is a separate point from the one being made here. If anything, it's the opposite -- it's arguing that the US system is too capable, rather than insufficiently capable.

I suppose that's fair.

In the article author's defense, he did pretty much disclaim any detailed or experiential knowledge right up front. That said, while my own relevant experience is now many years past and was in any case mostly refracted through the payment card industry, I didn't spot any obvious howlers.

I tried that two months ago and the bank didn't support it, unless I was holder of both accounts.

Upvote for your amazing domain!!

The history of credit cards is also somewhat wild: unsolicited cards arrived activated in the mail, and consequently, a huge volume of credit card fraud was born. Consumer protections came a few years later cleaning up obvious issues. But looking at that story, it seemed awfully reminiscent of the Uber model.

"A piece of the action" is a great book on the history of this.

The whole history of settlement is really fascinating starting from correspondent balances to Clearinghouse (now CHIPS) to central bank clearing. I highly recommend Economics of Money and Banking course on Coursera if anyone is interested to learn more.

You say “FedNow will eventually supplement”, and I read through your post, not too thoroughly, but I liked it and saved it to my Pinboard archive. Why couldn’t FedNow eventually replace the system you described though?

It might be able to! I was being a little conservative.

It's possible that some of the more obscure abilities of ACH, like death notification entries[1], won't be needed in FedNow or will be replaced separately. But that's idle speculation on my part.

[1]: https://www.moderntreasury.com/journal/what-happens-when-you...

Well apparently they’re using some schema called ISO 20022, and I saw references further down that this is a complicated beast, to be expected if ISO is involved, but a cursory once over makes it appear to be the type of schema which whether easily or with the forging fires of hell or somewhere in between makes it possible to incorporate other schemas such as ACH.

Thank you for answering my questions, faster payments is something I think we can all get behind.

The complexity of this protocol seems to match its needs. I don't really get the issue. FTP and the file format come off as old-sounding but so what?

Why can't this just be batched faster anyway? Improve the hardware, run the batches every 30 seconds, and it's just like instant systems? I know there must be a reason but I'm curious why it is.

When money takes time to go from A to B, who do you think gets to use the money? Yes, the banks. They are all set up to make money from your money, by lending it out at attractive overnight rates.

Is that a problem? Perhaps, but you've been trained to tolerate it, because you have no choice. Multiply your money by tens of millions of bank customers, and you begin to see the size of the opportunity.

Is it any wonder the status quo has lasted for so many decades since the invention of the computer?

“It is difficult to get a man to understand something, when his salary depends on his not understanding it.”

― Upton Sinclair

Attractive is a stretch https://apps.newyorkfed.org/markets/autorates/SOFR, granted rates are historically low but today a bank will earn $25 overnight for every billion lent out. Not really a cash cow. Maybe that’s why there is finally some progress.

Hey bud, never thought I'd see an old friend on the top of an HN thread.

That was a great writeup to read while lying in bed dreading the week!

Best, Misker

Blatant self promotion: I referenced your blog post in my weekly newsletter.

https://mailchi.mp/12e86aca340f/synthesis-emergence-15

SIC and EuroSIC is pretty cool. Have to read your summary.:)

"Astoundingly" complicated???? ACH/NACHA isn't any more complicated than any other API. If anything it's easier than most if you're used to string processing, because the file format is just 80 character rows with 9 different types of rows starting with that numerical digit. The schema is well defined. In many cases a "transaction" is executed by simply FTPing an .ach file. What did you find so complicated?

As I mentioned in the blog post:

* ACH-formatted transactions are supposed to be 80 character rows, but ACH emitters play loose and fast with that. 81 (CR/LF) and 82 (CR+LF) character entries are common enough in the wild that financial communities regularly complain about them. ACH transactions are supposed to be concatenative, so it wouldn't surprise me to learn that most real-world ACH handling code needs to handle 80, 81, and 82-character records in the same stream.

* The envelope and hierarchy of ACH is extremely simple. The internal state machine isn't: there are plenty of overlapping entry classes[1], obscure return codes, common misuse of said codes, and rider entries (like addenda information). The records for international settlements are shockingly complex; no ODFIs or RDFIs seem to follow the rules about not clawing back money after various contest periods expire.

[1]: When do I use CIE entries versus PPD? Do I use WEB for a recurring utility payment that was initiated online?

In addition to the sibling comment: as already mentioned, the machinery to handle ACH (or any bank transactions, really) is very complex:

- the formats (there are more than one for interbank communications) are never properly followed by any bank, and many add their own undocumented proprietary extensions to them

- they are usually processed in batches, and the entirety of bank systems are built assuming that everything is processed in batches at specific times of day

- entries in batches may and will arrive out-of-order. For example, a request to cancel a transaction may and at one point will arrive before the request to authorize a transaction.

- a lot of other systems are built into the entire transaction process and assuming everything is processed in batches: fraud detection, dunning chains [1], account cancellations, reminders, fees etc. etc.

- There are systems where bank holidays are built into the system. If bank holiday is on a Friday, and you request/send payment, it will not be processed by the bank on the other side until Monday evening and the transaction will not be completed until Tuesday morning.

And that's just scraping the top of the iceberg. You can't just magically replace this. But you can try to build on top/work around that.

Source: worked at Klarna [2]

[1] https://en.wikipedia.org/wiki/Dunning_(process)

[2] https://www.klarna.com/

> entries in batches may and will arrive out-of-order.

This is on purpose by some banks. They will sort the incoming queue and process withdraws before deposits to increase the number of NSF fees they collect.

...and as someone that interfaces with clearing firms via SFTP, I can tell you that it's a nightmare. FTP was great for downloading ratio-ed mp3s in the year 1998. It's a terrible way to handle things in 2020. It perplexes me how much of my industry is held together by cron-jobs and SFTP processes.

Reply on news.ycombinator.com