Nacha’s fraud monitoring rules took effect for ODFIs and high-volume parties on March 20, 2026 and for all other non-consumer Originators, third-party senders and service providers on June 19, 2026, with June 22 the practical date. Each must run risk-based procedures to spot unauthorized or false-pretenses entries and review them at least annually.
\nNacha’s Fraud Monitoring Phase 1 rule page says phase 1, effective March 20, 2026, applied to all ODFIs, to non-consumer Originators, third-party service providers and third-party senders with 2023 ACH origination volume of 6 million or greater, and to RDFIs with 2023 receipt volume of 10 million or greater. The phase 2 page says phase 2, effective June 19, 2026, removed the volume threshold for all non-consumer Originators, third-party senders and service providers and for all RDFIs, and that because June 19 is a federal holiday the practical effective date was Monday, June 22, 2026.
\nEach covered party must establish and implement risk-based processes and procedures, relevant to its role, reasonably intended to identify entries suspected of being unauthorized or authorized under false pretenses, and review them at least annually. Nacha says false pretenses covers scenarios such as business email compromise, vendor impersonation and payroll impersonation, and that a risk-based approach should not be used to conclude no monitoring is needed; at a minimum, a party should conduct a risk assessment that separates higher-risk from lower-risk transactions.
\nIt says Originators may be best placed to protect against account takeover, and that their procedures could include change controls on payment information and instructions for vendor and payroll payments.
\nUse this for any business that sends ACH credits or debits through its bank and for payroll and payment providers. Exact obligations depend on each party’s role and bank agreement, so confirm expectations with your bank.
\nDSE recommends writing down how your business checks ACH payments for fraud, starting with independent verification of any change to vendor or employee bank details. Call back on a known number before changing payment instructions, require two people to approve new payees and unusual payments, review exception reports before release, and revisit the procedure at least once a year.
\nSample recent bank-detail changes and confirm each has a recorded call-back, confirm dual approval on new payees, and keep the date of the last annual review with the procedure.
\nNacha — Risk Management Topics (Fraud Monitoring Phase 1). Nacha — Risk Management Topics (Fraud Monitoring Phase 2). Reviewed October 19, 2026.
", "content_text": "Nacha’s fraud monitoring rules took effect for ODFIs and high-volume parties on March 20, 2026 and for all other non-consumer Originators, third-party senders and service providers on June 19, 2026, with June 22 the practical date. Each must run risk-based procedures to spot unauthorized or false-pretenses entries and review them at least annually.\nSource facts\nNacha’s Fraud Monitoring Phase 1 rule page says phase 1, effective March 20, 2026, applied to all ODFIs, to non-consumer Originators, third-party service providers and third-party senders with 2023 ACH origination volume of 6 million or greater, and to RDFIs with 2023 receipt volume of 10 million or greater. The phase 2 page says phase 2, effective June 19, 2026, removed the volume threshold for all non-consumer Originators, third-party senders and service providers and for all RDFIs, and that because June 19 is a federal holiday the practical effective date was Monday, June 22, 2026.\nEach covered party must establish and implement risk-based processes and procedures, relevant to its role, reasonably intended to identify entries suspected of being unauthorized or authorized under false pretenses, and review them at least annually. Nacha says false pretenses covers scenarios such as business email compromise, vendor impersonation and payroll impersonation, and that a risk-based approach should not be used to conclude no monitoring is needed; at a minimum, a party should conduct a risk assessment that separates higher-risk from lower-risk transactions.\nIt says Originators may be best placed to protect against account takeover, and that their procedures could include change controls on payment information and instructions for vendor and payroll payments.\nApplicability\nUse this for any business that sends ACH credits or debits through its bank and for payroll and payment providers. Exact obligations depend on each party’s role and bank agreement, so confirm expectations with your bank.\nDSE recommendation\nDSE recommends writing down how your business checks ACH payments for fraud, starting with independent verification of any change to vendor or employee bank details. Call back on a known number before changing payment instructions, require two people to approve new payees and unusual payments, review exception reports before release, and revisit the procedure at least once a year.\nVerification\nSample recent bank-detail changes and confirm each has a recorded call-back, confirm dual approval on new payees, and keep the date of the last annual review with the procedure.\nOfficial references\nNacha — Risk Management Topics (Fraud Monitoring Phase 1). Nacha — Risk Management Topics (Fraud Monitoring Phase 2). Reviewed October 19, 2026.", "content_markdown": "Nacha’s fraud monitoring rules took effect for ODFIs and high-volume parties on March 20, 2026 and for all other non-consumer Originators, third-party senders and service providers on June 19, 2026, with June 22 the practical date. Each must run risk-based procedures to spot unauthorized or false-pretenses entries and review them at least annually.\n\n## Source facts\n\nNacha’s [Fraud Monitoring Phase 1 rule page](https://www.nacha.org/rules/risk-management-topics-fraud-monitoring-phase-1) says phase 1, effective March 20, 2026, applied to all ODFIs, to non-consumer Originators, third-party service providers and third-party senders with 2023 ACH origination volume of 6 million or greater, and to RDFIs with 2023 receipt volume of 10 million or greater. The [phase 2 page](https://www.nacha.org/rules/risk-management-topics-fraud-monitoring-phase-2) says phase 2, effective June 19, 2026, removed the volume threshold for all non-consumer Originators, third-party senders and service providers and for all RDFIs, and that because June 19 is a federal holiday the practical effective date was Monday, June 22, 2026.\n\nEach covered party must establish and implement risk-based processes and procedures, relevant to its role, reasonably intended to identify entries suspected of being unauthorized or authorized under false pretenses, and review them at least annually. Nacha says false pretenses covers scenarios such as business email compromise, vendor impersonation and payroll impersonation, and that a risk-based approach should not be used to conclude no monitoring is needed; at a minimum, a party should conduct a risk assessment that separates higher-risk from lower-risk transactions.\n\nIt says Originators may be best placed to protect against account takeover, and that their procedures could include change controls on payment information and instructions for vendor and payroll payments.\n\n## Applicability\n\nUse this for any business that sends ACH credits or debits through its bank and for payroll and payment providers. Exact obligations depend on each party’s role and bank agreement, so confirm expectations with your bank.\n\n## DSE recommendation\n\nDSE recommends writing down how your business checks ACH payments for fraud, starting with independent verification of any change to vendor or employee bank details. Call back on a known number before changing payment instructions, require two people to approve new payees and unusual payments, review exception reports before release, and revisit the procedure at least once a year.\n\n## Verification\n\nSample recent bank-detail changes and confirm each has a recorded call-back, confirm dual approval on new payees, and keep the date of the last annual review with the procedure.\n\n## Official references\n\n[Nacha — Risk Management Topics (Fraud Monitoring Phase 1)](https://www.nacha.org/rules/risk-management-topics-fraud-monitoring-phase-1). [Nacha — Risk Management Topics (Fraud Monitoring Phase 2)](https://www.nacha.org/rules/risk-management-topics-fraud-monitoring-phase-2). Reviewed October 19, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/nacha-ach-fraud-monitoring-rules-2026-originators-false-pretenses-bec/", "url": "https://update.dsesecurity.com/updates/nacha-ach-fraud-monitoring-rules-2026-originators-false-pretenses-bec/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-19" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/nacha-ach-fraud-monitoring-rules-2026-originators-false-pretenses-bec/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Nacha’s ACH fraud monitoring rules now reach every business that sends ACH payments: document your checks", "item": "https://update.dsesecurity.com/updates/nacha-ach-fraud-monitoring-rules-2026-originators-false-pretenses-bec/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/nacha-ach-fraud-monitoring-rules-2026-originators-false-pretenses-bec/#article", "identifier": "https://update.dsesecurity.com/updates/nacha-ach-fraud-monitoring-rules-2026-originators-false-pretenses-bec/", "url": "https://update.dsesecurity.com/updates/nacha-ach-fraud-monitoring-rules-2026-originators-false-pretenses-bec/", "headline": "Nacha’s ACH fraud monitoring rules now reach every business that sends ACH payments: document your checks", "description": "Nacha’s fraud monitoring rules took effect for ODFIs and high-volume parties on March 20, 2026 and for all other non-consumer Originators, third-party…", "abstract": "Nacha’s fraud monitoring rules took effect for ODFIs and high-volume parties on March 20, 2026 and for all other non-consumer Originators, third-party senders and service providers on June 19, 2026, with June 22 the practical date. Each must run risk-based procedures to spot unauthorized or false-pretenses entries and review them at least annually.", "articleBody": "Nacha’s fraud monitoring rules took effect for ODFIs and high-volume parties on March 20, 2026 and for all other non-consumer Originators, third-party senders and service providers on June 19, 2026, with June 22 the practical date. Each must run risk-based procedures to spot unauthorized or false-pretenses entries and review them at least annually.\nSource facts\nNacha’s Fraud Monitoring Phase 1 rule page says phase 1, effective March 20, 2026, applied to all ODFIs, to non-consumer Originators, third-party service providers and third-party senders with 2023 ACH origination volume of 6 million or greater, and to RDFIs with 2023 receipt volume of 10 million or greater. The phase 2 page says phase 2, effective June 19, 2026, removed the volume threshold for all non-consumer Originators, third-party senders and service providers and for all RDFIs, and that because June 19 is a federal holiday the practical effective date was Monday, June 22, 2026.\nEach covered party must establish and implement risk-based processes and procedures, relevant to its role, reasonably intended to identify entries suspected of being unauthorized or authorized under false pretenses, and review them at least annually. Nacha says false pretenses covers scenarios such as business email compromise, vendor impersonation and payroll impersonation, and that a risk-based approach should not be used to conclude no monitoring is needed; at a minimum, a party should conduct a risk assessment that separates higher-risk from lower-risk transactions.\nIt says Originators may be best placed to protect against account takeover, and that their procedures could include change controls on payment information and instructions for vendor and payroll payments.\nApplicability\nUse this for any business that sends ACH credits or debits through its bank and for payroll and payment providers. Exact obligations depend on each party’s role and bank agreement, so confirm expectations with your bank.\nDSE recommendation\nDSE recommends writing down how your business checks ACH payments for fraud, starting with independent verification of any change to vendor or employee bank details. Call back on a known number before changing payment instructions, require two people to approve new payees and unusual payments, review exception reports before release, and revisit the procedure at least once a year.\nVerification\nSample recent bank-detail changes and confirm each has a recorded call-back, confirm dual approval on new payees, and keep the date of the last annual review with the procedure.\nOfficial references\nNacha — Risk Management Topics (Fraud Monitoring Phase 1). Nacha — Risk Management Topics (Fraud Monitoring Phase 2). Reviewed October 19, 2026.", "datePublished": "2026-10-19T00:28:00+00:00", "dateModified": "2026-10-19T01:55:07+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/nacha-ach-fraud-monitoring-rules-2026-originators-false-pretenses-bec/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/nacha-ach-fraud-monitoring-rules-2026-originators-false-pretenses-bec/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Nacha’s ACH fraud monitoring rules now reach every business that sends ACH payments: document your checks" }, "articleSection": [ "Business Continuity", "Cybersecurity" ], "keywords": [ "Business Continuity", "Cybersecurity", "Explainer", "Important priority" ], "genre": "Explainer", "about": [ { "@type": "Thing", "name": "Business Continuity", "url": "https://update.dsesecurity.com/topic/business-continuity/" }, { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" } ], "wordCount": 391, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Nacha — Risk Management Topics (Fraud Monitoring Phase 1)", "url": "https://www.nacha.org/rules/risk-management-topics-fraud-monitoring-phase-1" } } ] } }