January 2022 Summaries

Basis Theory React is an open-source React wrapper for Basis Theory’s JavaScript SDK designed to simplify the secure collection, encryption, tokenization, and storage of sensitive browser-entered data such as personal information, API keys, bank details, and payment cards. Developers use the `useBasisTheory` hook and provider to add secure input elements to a component tree, then call tokenization APIs to replace raw values with non-sensitive token IDs that can be stored in their own systems and retrieved securely when necessary. The module supports features including masked fields for formatted values such as Social Security numbers, while its card components, PCI-compliant vault, and Serverless Reactors allow organizations to handle card data without directly maintaining PCI Level 1 compliance. Basis Theory positions the package as a way to reduce encryption decisions, in-memory security concerns, backend-transfer risks, and implementation time compared with conventional JavaScript encryption libraries.

Nacha’s updated ACH security rules require organizations that store bank account numbers electronically to make them unreadable at rest, responding to the growing scale of ACH transfers and the risks associated with account-number fraud. ACH is a U.S. bank-transfer network that processed nearly 27 billion payments worth almost $62 trillion in 2020, and its transactions rely on routing and account numbers to direct funds between financial institutions. The requirement was introduced in phases, applying from June 30, 2021 to ACH originators and third parties initiating more than 6 million annual payments, and from June 30, 2022 to those exceeding 2 million, with totals assessed across financial partners. It covers 5-to-17-digit deposit account numbers, including numbers visible in scanned checks or authorization forms, but does not currently extend to names, amounts, or routing numbers; actively used account data may remain readable under appropriate access controls. The discussion notes that companies are pursuing approaches such as encryption, tokenization, aliasing, and masking to comply while limiting operational disruption, and suggests many are voluntarily securing additional transaction data in anticipation of broader future requirements.