NACHA's New ACH Fraud Rule Already Took Effect. Here's What It Means If You Bill by ACH
By Yan Payments
What is NACHA’s new ACH fraud monitoring rule, and has it already taken effect?
Yes. NACHA’s updated fraud monitoring rule phased in on two dates earlier this year: March 20, 2026 for larger originators and all receiving banks, and June 22, 2026 for everyone else. If you bill customers through ACH debit, pulling payment from their bank account, or process ACH payments as a contractor or service business, this rule already applies to you, whether or not your bank has mentioned it.
What does the rule actually require?
Before this change, NACHA only required a “commercially reasonable fraudulent transaction detection system” for WEB debits (ACH debits originated over the internet) plus Micro-Entries (the small test deposits used to verify bank accounts). Everything else fell outside that requirement.
The new rule extends fraud monitoring to all ACH debit entries, not just WEB debits, and swaps the old “commercially reasonable” standard for a slightly different one: “risk-based processes and procedures reasonably intended to identify” fraudulent transactions. NACHA doesn’t mandate a specific technology or vendor. It points to things like transaction velocity and account-level anomalies as examples of what risk-based monitoring might look at, but leaves the method up to each bank or originator to design and review periodically.
Who’s covered, and when
Phase 1 took effect March 20, 2026, and covers all RDFIs (the receiving bank on the other end of a transaction), plus non-consumer originators, third-party service providers, and third-party senders with 6 million or more annual ACH originations in 2023.
Phase 2 took effect June 22, 2026 (NACHA’s listed date was June 19, a federal holiday, so the practical effective date landed on the next banking day), and covers everyone else: all remaining non-consumer originators and third-party senders, regardless of transaction volume.
That second phase is the one that matters for most small and mid-size businesses. NACHA defines an “originator” as the business initiating the debit, and removing the volume threshold in phase 2 means size doesn’t exempt you. If you’re a contractor billing clients by ACH, or a service business pulling recurring payments from customer bank accounts, you’re technically an originator bound by this rule right now.
Why did NACHA do this?
Fraud has been shifting. As checks and wires have gotten harder to exploit, more fraud, especially business email compromise schemes where a scammer impersonates a vendor and redirects a payment, has moved to ACH credit-push transactions. NACHA’s own framing when it introduced these changes was explicitly about closing that gap, since the old rule’s narrow scope left a lot of ACH activity essentially unmonitored for fraud by rule, even where individual banks were doing more informally.
Do you need to do anything about this?
Honest answer: it’s genuinely unsettled how much falls on a small business directly versus on the bank or processor handling the ACH relationship. Most small businesses don’t originate ACH debits directly through NACHA; they go through a processor or platform acting as a third-party sender, and that processor’s bank carries most of the actual monitoring infrastructure. In practice, that’s where the heavy lifting happens.
But some guidance aimed at finance teams is blunt that compliance can’t be fully outsourced to your bank just because they’re doing the technical monitoring. The originator of record is still responsible for the obligation existing, even if someone else executes it.
Two questions worth asking your bank or payment processor directly:
- Under our contract, am I the originator of record, or am I a sub-originator under your third-party sender role?
- Is your fraud monitoring representing that it satisfies my own obligation under this rule, or is there something separate I need to have in place?
Don’t assume the answer is “nothing to do here” just because no one has brought it up. And don’t assume there’s a new fee coming either; no credible source ties this rule to new merchant-facing fees or slower account setup, so if someone tells you this change is costing you money directly, ask them to show you where.
One thing this rule doesn’t touch
This is a NACHA rule, which only governs the ACH network, bank-to-bank transfers. It has no bearing on your card payment processing, which runs under separate Visa, Mastercard, and PCI DSS rules. If you take both card and ACH payments, which most Clover-based setups do, this update is specific to the ACH side of your business, not your card terminal. If you send or collect invoices by bank transfer, this is also worth a second look at your invoicing setup.
Sources:
← Back to all posts