Nacha’s ACH fraud monitoring rules now reach every business that sends ACH payments: document your checks

Nacha’s fraud monitoring rules took effect for ODFIs and high-volume parties on March 20, 2026 and for all other non-consumer Originators, third-party senders and service providers on June 19, 2026, with June 22 the practical date. Each must run risk-based procedures to spot unauthorized or false-pretenses entries and review them at least annually.

Source facts

Nacha’s Fraud Monitoring Phase 1 rule page says phase 1, effective March 20, 2026, applied to all ODFIs, to non-consumer Originators, third-party service providers and third-party senders with 2023 ACH origination volume of 6 million or greater, and to RDFIs with 2023 receipt volume of 10 million or greater. The phase 2 page says phase 2, effective June 19, 2026, removed the volume threshold for all non-consumer Originators, third-party senders and service providers and for all RDFIs, and that because June 19 is a federal holiday the practical effective date was Monday, June 22, 2026.

Each covered party must establish and implement risk-based processes and procedures, relevant to its role, reasonably intended to identify entries suspected of being unauthorized or authorized under false pretenses, and review them at least annually. Nacha says false pretenses covers scenarios such as business email compromise, vendor impersonation and payroll impersonation, and that a risk-based approach should not be used to conclude no monitoring is needed; at a minimum, a party should conduct a risk assessment that separates higher-risk from lower-risk transactions.

It says Originators may be best placed to protect against account takeover, and that their procedures could include change controls on payment information and instructions for vendor and payroll payments.

Applicability

Use this for any business that sends ACH credits or debits through its bank and for payroll and payment providers. Exact obligations depend on each party’s role and bank agreement, so confirm expectations with your bank.

DSE recommendation

DSE recommends writing down how your business checks ACH payments for fraud, starting with independent verification of any change to vendor or employee bank details. Call back on a known number before changing payment instructions, require two people to approve new payees and unusual payments, review exception reports before release, and revisit the procedure at least once a year.

Verification

Sample recent bank-detail changes and confirm each has a recorded call-back, confirm dual approval on new payees, and keep the date of the last annual review with the procedure.

Official references

Nacha — Risk Management Topics (Fraud Monitoring Phase 1). Nacha — Risk Management Topics (Fraud Monitoring Phase 2). Reviewed October 19, 2026.