Nacha's Fraud Monitoring and Payroll Labeling Rules Take Effect March 20

The largest overhaul of ACH fraud prevention rules in the network's history takes effect on March 20, 2026, as Nacha's Risk Management package introduces mandatory fraud monitoring and standardized transaction labeling across the ACH Network.

Under the new rules, Originating Depository Financial Institutions and large non-consumer originators, third-party senders, and third-party service providers with 2023 ACH origination volume of six million or more must implement risk-based processes to detect entries that may have been initiated due to fraud. This includes a new category called False Pretenses, covering payments where a customer authorizes a transaction after being deceived about the recipient's identity, authority, or the destination account. Receiving Depository Financial Institutions above the same volume threshold must also implement monitoring of inbound ACH credits for unusual patterns.

The rules mandate two new Company Entry Description values. Originators must use PAYROLL for all PPD credits related to wages, salaries, and similar compensation, and PURCHASE for eligible consumer e-commerce debits. These standardized labels give receiving institutions better information for applying early funds availability logic and detecting anomalous payment patterns. A payroll credit arriving at an account that has never received payroll before, for instance, becomes a signal that RDFIs can act on.

Phase 1 applies to large originators effective March 20. Phase 2 extends the same requirements to all remaining non-consumer originators and third-party processors from June 19, 2026. A further wave of rule changes scheduled for September 18, 2026, will update the definition of International ACH Transaction entries and introduce new funds availability requirements for non-same-day ACH credits.

The Federal Reserve has aligned its FedACH services with the new requirements, offering the FedACH Risk Origination Monitoring Service for ODFIs seeking enhanced control over outbound ACH risk and the FedACH Risk RDFI Alert Service for institutions monitoring inbound credits. These tools supplement but do not replace the Nacha Operating Rule obligations that each participant must independently satisfy.

The changes arrive as the ACH Network continues to grow. In 2025 the network processed 35.2 billion payments valued at $93 trillion, with Same-Day ACH reaching 1.4 billion payments worth $3.9 trillion. The fraud monitoring mandate reflects an industry recognition that as ACH volumes and speed increase, the controls governing those flows must evolve in parallel.