Effective March 20, 2026, non-consumer originators, third-party service providers, and third-party senders processing six million or more annual ACH entries must establish risk-based processes and procedures reasonably intended to identify credit entries initiated due to fraud. The requirement is part of Nacha's broader Risk Management Rules package designed to reduce the incidence of credit-push fraud across the ACH Network, which processed 35.2 billion payments valued at $93 trillion in 2025.
Receiving depository financial institutions handling ten million or more annual ACH credits face a parallel obligation under Phase 1. These RDFIs must implement monitoring systems designed to flag incoming credit entries suspected of being unauthorized or initiated under false pretenses, and must establish procedures for handling transactions that their systems identify as potentially fraudulent.
Nacha specifies that monitoring should follow a risk-based approach, considering factors such as transactional velocity, anomalies like SEC code mismatches with account type, and account characteristics including the age of an account and its average balance. The rules do not prescribe specific technology solutions, giving institutions flexibility to integrate monitoring into their existing fraud prevention frameworks.
The second phase, effective June 19, 2026, removes the volume thresholds entirely. All non-consumer originators regardless of size will be subject to the same systems-based credit monitoring requirements, and all RDFIs will need monitoring processes in place. Together the two phases establish a universal fraud monitoring baseline across the entire ACH ecosystem.
Two additional Nacha rule changes also take effect today. Mandatory Company Entry Description fields for PAYROLL and PURCHASE transactions become required, improving transaction transparency and enabling better fraud detection at receiving institutions. A separate funds availability change, effective September 18, 2026, will require RDFIs to make non-Same Day ACH credits available to recipients by 9:00 AM local time on the settlement date, tightening the window within which beneficiaries can access incoming funds.