February 2022 Summaries

Tokenization can protect bank account information by replacing sensitive account and routing numbers with reusable references that can move across systems without requiring decryption logic. The approach is presented as flexible for many serializable data types, supportive of organizational control over underlying data, and useful for functions such as customer support, least-cost routing, and new financial products or partnerships. Basis Theory offers a PCI-compliant, SOC 2-certified token vault with an Atomic Bank token type that stores account and routing numbers together, though they may also be tokenized separately. Developers create an Atomic Bank through an API call, retain the resulting token ID as a reference to the vaulted data, and receive a masked account number suitable for storage or display; the service states that these tokens comply with Nacha security requirements for ACH transactions.

Nacha’s Supplemental Data Security Rule for ACH bank account numbers does not prescribe specific technical solutions, but its references to PCI DSS suggest expectations for industry-standard encryption of stored and transmitted data, minimal data collection and retention, authenticated and least-privilege access, comprehensive logging, and at least one year of log retention. Organizations can render account numbers unreadable through truncation, destruction, encryption, or tokenization, with the appropriate approach depending on how frequently the data must be reused, how many systems handle it, and the company’s technical resources and compliance timeline. The discussion argues that truncation and deletion may be unsuitable for recurring payment use cases, while encryption can work for smaller implementations but becomes harder to manage at scale because of key rotation, infrastructure maintenance, and evolving standards. Combining encryption with tokenization can reduce the number of applications that store sensitive data by allowing systems to use non-sensitive token references, and businesses must weigh whether to build and maintain such capabilities internally or use a specialized provider.