Nacha 2026 Rules: ACH Fraud Monitoring for Businesses

The Nacha 2026 rules require banks and businesses that send ACH payments to have risk-based processes to spot payments that are unauthorized or made under false pretenses, such as business email compromise. Phase 1 took effect on March 20, 2026 for large originators and all ODFIs. Phase 2, effective June 19, 2026, covers everyone else, including small businesses that originate ACH.

If you run payroll by direct deposit, pay suppliers through your bank's ACH service, or collect payments by ACH debit, these rules apply to you. This guide explains the dates, who is affected, what "risk-based monitoring" means in practice, and the simple steps that keep your business compliant and harder to defraud. It is general information, not legal advice; check details with your bank or a qualified adviser.

What changed in the Nacha 2026 rules

Nacha manages the ACH Network and writes the Nacha Operating Rules that banks and their customers must follow. The 2026 changes focus on fraud, especially "credit-push" fraud, where a business is tricked into sending money to the wrong account.

The main changes:

• Fraud monitoring by originators. ODFIs (the sending banks), non-consumer Originators, Third-Party Service Providers and Third-Party Senders must have risk-based processes reasonably intended to identify entries suspected of being unauthorized or authorized under false pretenses.
• Fraud monitoring by receiving banks. RDFIs must have risk-based processes to identify suspicious incoming credit entries.
• Annual review. These processes must be reviewed at least once a year and updated as risks change.
• Standard Company Entry Descriptions. PAYROLL for PPD credits paying wages and PURCHASE for WEB debits for e-commerce purchases.

These build on earlier rule changes that let receiving banks return suspicious credits and expanded the definition of false pretenses.

ACH fraud monitoring rules: phase 1 and phase 2 dates

Phase	Effective date	Who is covered
Phase 1	March 20, 2026	All ODFIs; non-consumer Originators, TPSPs and TPSs with 2023 ACH origination volume of 6 million or more; RDFIs with 2023 ACH receipt volume of 10 million or more
Phase 2	June 19, 2026	All remaining non-consumer Originators, TPSPs, TPSs and RDFIs, with no volume threshold
Company Entry Descriptions	March 20, 2026	Originators of payroll PPD credits (PAYROLL) and e-commerce WEB debits (PURCHASE)

Nacha's rules page lists June 19, 2026 for Phase 2. Because June 19 is the Juneteenth federal holiday, some banks and advisers described the practical date as Monday, June 22, 2026. Either way, Phase 2 is now in force.

Six million entries a year is roughly 500,000 a month, so Phase 1 caught only the largest payroll processors and corporates. Phase 2 is the one that reaches typical small and mid-sized businesses.

Who is affected by the Nacha rule changes in March 2026 and after

Businesses that originate ACH

You are a non-consumer Originator if your business initiates ACH entries through a bank, for example:

• Running payroll by direct deposit through your bank (rather than a payroll company acting as the originator).
• Paying vendors by ACH credit from your business banking portal.
• Collecting customer payments by ACH debit under your own origination agreement.

Since Phase 2, there is no minimum volume. If you originate, you need risk-based procedures.

Payroll companies and payment providers

Third-Party Service Providers and Third-Party Senders, such as payroll services and payment platforms, are covered too. If you pay staff through a payroll provider, much of the work sits with them, but your bank or provider may still ask you to confirm your own controls.

Businesses that only receive ACH payments

If clients pay your invoices by ACH and you never originate, the originator duty does not apply to you directly. But your bank, as RDFI, now monitors incoming credits and may hold or return ones that look suspicious, for example large unusual credits into a new account. Stable, correct bank details help.

What "risk-based" fraud monitoring means

Nacha has said that risk-based monitoring does not mean screening every single entry, and it does not require monitoring before processing. It does mean doing a risk assessment and having procedures that fit your role and size. At a minimum, you should be able to tell higher-risk payments from lower-risk ones.

Examples of higher-risk ACH activity for a small business:

• A vendor asks to change bank details by email.
• An employee asks HR to redirect their pay to a new account.
• An unusually large or urgent payment request, especially from a senior person "who is travelling".
• A first payment to a brand-new payee.
• Payment files changed after they were prepared.

Nacha defines false pretenses as inducing a payment by misrepresenting identity, authority or account ownership. That covers business email compromise, vendor impersonation and payroll impersonation. It does not cover a legitimate seller who delivers poor-quality goods.

What businesses should do now

Here is a practical, small-business version of a compliance program:

1. Write down your ACH payment process: who prepares payments, who approves them, and which systems are used.
2. Use dual approval for ACH batches above a set amount, for example $2,500, and for any new payee.
3. Verify every bank detail change by calling the vendor or employee on a phone number you already have on file, never one from the change request.
4. Hold new payee changes for a short cooling-off period, such as two business days, before the first payment.
5. Review payment files before release and compare totals with approved invoices.
6. Turn on your bank's fraud tools, such as ACH positive pay, debit blocks and filters, and payee alerts.
7. Train staff on email fraud signs. Our guide to invoice scams is a good starting point.
8. Use PAYROLL and PURCHASE descriptions correctly, or confirm your provider does.
9. Review the process once a year and keep a dated record of the review.

Worked example: stopping a fake vendor change

A landscaping company pays its mulch supplier about $3,200 a month by ACH. One morning, the bookkeeper gets an email that looks like it is from the supplier, with an invoice for $3,180 and "new bank details, effective immediately". Under the company's written procedure, any bank change triggers a call to the supplier's number stored in the vendor file. The supplier confirms it sent nothing. The company forwards the email to its bank, and the $3,180 stays where it should.

Without a procedure, the bookkeeper might have updated the details and released the payment. Recovering that money after it reaches a mule account is often impossible. The control cost a five-minute phone call.

The PAYROLL and PURCHASE descriptions in practice

Every ACH batch carries a short Company Entry Description, which often appears on the receiver's bank statement. Before 2026, businesses used all sorts of labels for the same type of payment, such as "SALARY", "WAGES", "DIR DEP" or the company name. That made it harder for receiving banks to spot unusual activity, such as a payroll-style credit landing in an account that has never received pay before.

Under the Nacha 2026 rules, from March 20, 2026:

• PAYROLL must be used for PPD credits that pay wages, salaries and similar compensation.
• PURCHASE must be used for WEB debits for e-commerce purchases, including recurring purchases first authorized online.

Nacha has said the receiving side has no obligation to verify that the descriptions are present or accurate, but using them correctly is still your duty as an Originator. If you run payroll through your bank's ACH module, check the batch template. If you use a payroll provider, ask it to confirm in writing that it uses PAYROLL. Employees may notice the change on their statements, so a one-line note in your next payslip email avoids confused questions.

What your bank may ask you for

Your bank, as ODFI, is responsible for making sure the businesses it lets originate ACH entries meet the rules. Since Phase 2, many banks have updated their ACH origination agreements or sent questionnaires. Typical requests include:

• Confirmation that you have written procedures for detecting false pretenses and unauthorized entries.
• The name of the person responsible for ACH controls.
• Evidence of dual control or approval limits in your banking platform.
• Confirmation that you verify vendor and employee bank detail changes independently.
• The date of your last annual review.

Keep a short document, one or two pages, that answers these points, and update the review date each year. If your bank offers templates, use them; they show what it expects to see.

Worked example: setting approval limits

A 12-person agency pays about 40 vendors and runs payroll twice a month. It sets three rules in its banking platform: any ACH batch over $5,000 needs a second approver, any first payment to a new payee needs a second approver regardless of amount, and payroll batches are reviewed against the payroll register before release. With an average of 25 vendor payments a month, the second approval adds perhaps 20 minutes of work a month. Against a single business email compromise loss of several thousand dollars, the trade-off is easy.

How the rules affect invoicing

The Nacha 2026 rules govern payments, not invoices, but invoices are where most ACH fraud starts. Fraudsters copy real invoices and change the bank details. To protect your clients and your cash:

• Show the same bank details on every invoice and keep them in a consistent place. See bank details on an invoice.
• Add a line to your notes: "We will never change our bank details by email. Please call us to confirm any change."
• Use a consistent invoice numbering format, so a fake invoice stands out. Our invoice number generator can help.
• If you genuinely change banks, tell clients in advance through a trusted channel and expect them to verify.
• Avoid sending invoices as editable documents. A PDF is harder to alter quietly.

Our US invoice generator creates PDF invoices with a US locale, your bank details in the notes, and optional sales tax. It does not send ACH payments or monitor fraud; it simply helps you issue clean, consistent invoices.

ACH vs other payment methods after the changes

The Nacha 2026 rules add some friction to ACH, but ACH remains the cheapest common way for US businesses to pay each other. Compare it with alternatives in our guides to ACH vs wire transfer and FedNow vs RTP instant payments. Instant payments settle immediately, which makes fraud controls before sending even more important.

If you collect payments online, pay by bank products often run on ACH debits, and the PURCHASE description applies to WEB debits for e-commerce. For international clients, bank data standards are changing too; see ISO 20022 for small businesses.

Conclusion

The Nacha 2026 rules turned good fraud hygiene into a requirement. Phase 1 started March 20, 2026, Phase 2 brought in every business that originates ACH from June 2026, and the PAYROLL and PURCHASE descriptions are now standard. For most small businesses, compliance means a written process, dual approval, call-back checks on bank changes and an annual review. Pair that with clean, consistent invoices from our free invoice generator, and ask your bank or a qualified adviser what evidence it expects from you.