Title 200 | Chapter 038 | Regulation 080REG
PROPOSED
This document is not yet current.
PREVIOUS VERSION
The previous document that this document is based upon is available.
FINANCE AND ADMINISTRATION CABINET
Office of the Controller
(Amended at ARRS Committee)
200 KAR 38:080.Account validation standards.
Section 1.
Definitions.(1)
"Account Validation Service" or "AVS" means a commercially reasonable process to verify that an account is open, active, and capable of receiving ACH debits (or credits).(2)
"Agency" is defined by KRS 11.080.(3)
"Automated Clearing House" or "ACH" means a secure, batch-oriented electronic funds transfer system that acts as a central clearinghouse for financial transactions, connecting all United States financial institutions.(4)
"Electronic Fund Transfer" or "EFT" means an electronic data processing medium that takes the place of a paper check for debiting or crediting an account and of which a permanent record is made.(5)
"Electronic Accounting and Reporting System" means the web-enabled, centralized accounting application used by the Commonwealth of Kentucky to manage state-level financial operations.(6)
"Internal Control" is defined by 200 KAR 38:070.(7)
"National Automated Clearing House Association" or "NACHA" means the nonprofit organization that governs, develops, and administers the ACH Network in the United States.(8)
"Risk-Based Monitoring" means a process whereby agencies utilize a risk assessment framework to monitor their operations.(9)
"SAS" means the Office of Statewide Accounting Services, as organized pursuant to KRS 42.0201.(10)
"Validation" means confirmation that an account number is active and capable of receiving ACH transactions.Section 2.
Scope.(1)
Maintains ACH/EFT banking information at the agency level;(2)
Initiates ACH/EFT payments through the Commonwealth's electronic accounting and reporting system or an interfaced system;(3)
Initiates ACH/EFT payments through a thirdparty system that transmits payment files to the Commonwealth; or(4)
Collects, stores, or updates vendor or payee banking details.Section 3.
Agencies to Implement NACHA-compliant AVS or Equivalent Validation Process.(1)
Validation shall(a)
A new ACH/EFT record is created;(b)
Existing ACH/EFT data is modified;(c)
Annually, for any ACH/EFT data stored outside the Commonwealth's electronic accounting and reporting system; and(d)
Prior to transmitting any agencymanaged ACH/EFT file in the Commonwealth's electronic accounting and reporting system.(2)
The following data shall be validated:(a)
Account owner's legal name;(b)
Account number; and(c)
Routing Number.Section 4.
Agency Responsibilities.(1)
Internal Control Requirements.(a)
Actively maintain internal controls;(b)
Annually file an Internal Control Plan, prepared in accordance with the requirements of 200 KAR 38:070, with the Office of the Controller;(c)
Document their ACH validation procedures; and(d)
Ensure segregation of duties and fraud prevention controls by implementing risk-based, internal controls that restrict any single employee from having full control over the ACH payment lifecycle by(2)
Internal Procedures.(a)
Immediate review of a failed validation result;(b)
Suspension of ACH/EFT payment activity for the affected payee until a successful validation is completed;(c)
Verification steps to confirm whether the failure resulted from incorrect data entry, outdated records, or a mismatch identified by the validation service; and(d)
Documentation of all review and corrective actions taken in connection with the failed validation.(3)
Implementation.(a)
Agency created internal procedures shall(b)
Agency internal control procedures and execution of the(4)
Documentation.(5)
Exceptions.(6)
Penalties.(a)
A written audit finding that the agency failed to comply;(b)
Suspension of ACH/EFT privileges;(c)
Issuance of a corrective action plan by the Office of the Controller; or(d)
Other corrective action, as appropriate.HISTORY: COMPILER'S NOTE: 2025 RS HB 6, enacted by the General Assembly on March 27, 2025, altered the information to be provided at the time an administrative regulation is filed. Aside from formatting changes necessary to upload the regulation into the LRC's publication application, this regulation has been published as submitted by the agency.
FILED WITH LRC: July 8, 2026
CONTACT PERSON: Cary Bishop, Assistant General Counsel, Office of General Counsel, 200 Mero Street, 5th Floor, Frankfort, Kentucky 40622. Phone: (502) 564-6660, Fax: (502) 564-9875. Email: cary.bishop@ky.gov
FINANCE AND ADMINISTRATION CABINET
Office of the Controller
(Amended at ARRS Committee)
200 KAR 38:080.Account validation standards.
Section 1.
Definitions.(1)
"Account Validation Service" or "AVS" means a commercially reasonable process to verify that an account is open, active, and capable of receiving ACH debits (or credits).(2)
"Agency" is defined by KRS 11.080.(3)
"Automated Clearing House" or "ACH" means a secure, batch-oriented electronic funds transfer system that acts as a central clearinghouse for financial transactions, connecting all United States financial institutions.(4)
"Electronic Fund Transfer" or "EFT" means an electronic data processing medium that takes the place of a paper check for debiting or crediting an account and of which a permanent record is made.(5)
"Electronic Accounting and Reporting System" means the web-enabled, centralized accounting application used by the Commonwealth of Kentucky to manage state-level financial operations.(6)
"Internal Control" is defined by 200 KAR 38:070.(7)
"National Automated Clearing House Association" or "NACHA" means the nonprofit organization that governs, develops, and administers the ACH Network in the United States.(8)
"Risk-Based Monitoring" means a process whereby agencies utilize a risk assessment framework to monitor their operations.(9)
"SAS" means the Office of Statewide Accounting Services, as organized pursuant to KRS 42.0201.(10)
"Validation" means confirmation that an account number is active and capable of receiving ACH transactions.Section 2.
Scope. The requirements of this administrative regulation shall apply to all Commonwealth of Kentucky agencies, cabinets, departments, constitutional offices, and any organizational unit that:(1)
Maintains ACH/EFT banking information at the agency level;(2)
Initiates ACH/EFT payments through the Commonwealth's electronic accounting and reporting system or an interfaced system;(3)
Initiates ACH/EFT payments through a thirdparty system that transmits payment files to the Commonwealth; or(4)
Collects, stores, or updates vendor or payee banking details.Section 3.
Agencies to Implement NACHA-compliant AVS or Equivalent Validation Process.(1)
Validation shall be performed when:(a)
A new ACH/EFT record is created;(b)
Existing ACH/EFT data is modified;(c)
Annually, for any ACH/EFT data stored outside the Commonwealth's electronic accounting and reporting system; and(d)
Prior to transmitting any agencymanaged ACH/EFT file in the Commonwealth's electronic accounting and reporting system.(2)
The following data shall be validated:(a)
Account owner's legal name;(b)
Account number; and(c)
Routing Number.Section 4.
Agency Responsibilities.(1)
Internal Control Requirements. Agencies shall:(a)
Actively maintain internal controls;(b)
Annually file an Internal Control Plan, prepared in accordance with the requirements of 200 KAR 38:070, with the Office of the Controller;(c)
Document their ACH validation procedures; and(d)
Ensure segregation of duties and fraud prevention controls by implementing risk-based, internal controls that restrict any single employee from having full control over the ACH payment lifecycle by separation of initiation, approval, and reconciliation.(2)
Internal Procedures. Agencies shall create and maintain written internal procedures to address any instance where ACH/EFT account validation fails. At a minimum, these procedures shall include:(a)
Immediate review of a failed validation result;(b)
Suspension of ACH/EFT payment activity for the affected payee until a successful validation is completed;(c)
Verification steps to confirm whether the failure resulted from incorrect data entry, outdated records, or a mismatch identified by the validation service; and(d)
Documentation of all review and corrective actions taken in connection with the failed validation.(3)
Implementation. Agencies shall implement NACHAcompliant procedures, train staff, and maintain documentation as follows:(a)
Agency created internal procedures shall support standardized Company Entry Descriptions, audit trails, and NACHAcompliant validation; and(b)
Agency internal control procedures and execution of the procedures may be reviewed for compliance with the requirements of this administrative regulation and may be subject to penalties for violation.(4)
Documentation.Agencies shall document each annual validation, new ACH/EFT record creation, as well as modifications of ACH/EFT data and maintain the documentation in accordance with the requirements of the Kentucky Open Records Act.(5)
Exceptions. Any exceptions to the requirements of this administrative regulation require written approval from the Office of the Controller and shall be subject to the requirements for compensating controls or a mitigation plan as prerequisite to approval.(6)
Penalties. Non-compliance with the requirements of this administrative regulation may result in the following penalties:(a)
A written audit finding that the agency failed to comply;(b)
Suspension of ACH/EFT privileges;(c)
Issuance of a corrective action plan by the Office of the Controller; or(d)
Other corrective action, as appropriate.HISTORY: COMPILER'S NOTE: 2025 RS HB 6, enacted by the General Assembly on March 27, 2025, altered the information to be provided at the time an administrative regulation is filed. Aside from formatting changes necessary to upload the regulation into the LRC's publication application, this regulation has been published as submitted by the agency.
FILED WITH LRC: July 8, 2026
CONTACT PERSON: Cary Bishop, Assistant General Counsel, Office of General Counsel, 200 Mero Street, 5th Floor, Frankfort, Kentucky 40622. Phone: (502) 564-6660, Fax: (502) 564-9875. Email: cary.bishop@ky.gov