ACH credit monitoring by RDFIs: the received credits agent, in depth

ACH credit monitoring by RDFIs is the receiving bank's duty, under the Nacha rules in force for all RDFIs since June 22, 2026, to run risk-based procedures that pick out incoming credits suspected of being unauthorized or sent under false pretenses, and to handle them: hold, ask the sending bank, return or release. It is hard because the receiving bank never sees the email that tricked the sender; it sees only an entry, an account and a deadline that, for a next-day credit, falls at 9:00 a.m. on settlement day. Botminds' ACH Fraud Monitoring gives that work to a received credits agent that scores each credit against the account and the receiver's own history, holds a suspect one under Nacha's exemption, and hands a drafted return to people who decide it.

The example traced here runs on a fictional sample bank, Tessaly Community Bank, and fictional people and companies. Rules and research are linked where they are cited.

What is ACH credit monitoring by RDFIs?

It is the receiving half of Nacha's 2026 fraud monitoring rules. Each RDFI must have risk-based processes that aim to identify received credits suspected of being unauthorized or sent under false pretenses, and that cover what happens to the ones it finds (Nacha, Fraud Monitoring Phase 2). Phase 1 applied from March 20, 2026 to RDFIs that received 10 million or more entries in 2023; Phase 2 removed the threshold on June 19, 2026, with June 22 the first banking day.

The reason the duty sits with the receiver is that the fraudster's account sits there. Nacha's Risk Management Advisory Group put it in one line that explains the whole rule.

The ODFI warrants the transaction, but in many cases of credit-push fraud it is the RDFI who provides the fraudster access to the banking system.

Nacha Risk Management Advisory Group, RDFI credit-push fraud response checklists, February 2023

The sending bank can be asked to recall a payment; only the receiving bank can stop the money leaving the account it landed in. Nacha's chief executive made the same point in January 2026: "RDFIs are in the best position to see indicators of fraud for incoming credits" (Nacha, January 2026).

What credits should an RDFI review?

The credits whose shape does not fit the account they land in. Nacha's FAQ lists four signs an RDFI can see without knowing how the payment was sent: an SEC code that does not match the account type, "a high-dollar transaction that is atypical for the receiving account", "a series of similar credit entries received within a short period of time, such as multiple payroll or benefit payments", and "any of the above to a new account, a dormant account, or to an account acting as a mule" (Phase 2 FAQ).

Since March 20, 2026 the agent has a sharper input for payroll. Originators must put "PAYROLL" in the company entry description of PPD credits for wages, and Nacha says the point is that "RDFIs that monitor inbound ACH credits will have better information regarding new or multiple payroll payments to an account" (Nacha, Company Entry Descriptions). Nacha is careful to add that an RDFI is not required to act on the descriptor; it is information, not a duty.

The strongest single signal in the sample is not on the entry at all. Delmar Freight had paid the same employee into a different account every other Friday since 2019; this credit, to the cent, went to an account two days old. Here the receiving bank holds both pieces of evidence, because both accounts are its own; where the old account sits at another bank, the sending bank's file history is the other half, which is why the request to confirm matters.

The received credit, as it arrived, with the evidence the agent found and one proposed next step

Why the name on the entry is read late, not first

Because an ACH credit posts on the routing and account number, and checking names on every entry produces more noise than signal. Nacha reminds RDFIs that its rules "allow for the posting of credits to accounts on Routing Number (RTN) and Account Number only" (Nacha, 2021), and its advisory group is blunt about screening names at volume: "The volume of transactions processed in a batch ACH environment makes name matching untenable" (RMAG, November 2022).

The same guidance adds that a name comparison "can be useful when an ACH payment has been flagged and escalated for review". That is how the received credits agent uses it: as evidence on an entry already flagged by account age, history or velocity, never as the trigger. A "gross mismatch" between the name on the entry and the name on the account, in Nacha's phrase, then weighs heavily; a nickname or a middle name does not.

In payroll diversion the name on the entry is the employee's own, because the employer believes it is paying the employee. Whether it matches the receiving account depends on whose name the fraudster used to open it; in the sample case the new account carried the employee's name, so a name check would have passed. The receiving bank's better evidence is history: whose account this employer paid last time, and how old the new one is.

Can an RDFI hold an ACH credit?

Yes, for a credit its fraud procedures have flagged. Since October 1, 2024 Nacha has exempted from its funds availability requirements a credit the RDFI suspects was sent under false pretenses, alongside the older exemption for credits it reasonably suspects are unauthorized (Nacha, October 1, 2024 rules). An RDFI using it must contact the ODFI to say so.

The exemption has two edges. Nacha says plainly that the exemption does not lift a receiving bank's duties under Regulation CC, and Regulation CC requires funds from an electronic payment to be available "not later than the business day after the banking day on which the bank received the electronic payment" (12 CFR 229.10(b)). And it cannot be used as a blanket delay.

An RDFI cannot delay funds availability because it has not screened an ACH credit; but it can delay funds availability if its fraud detection processes and procedures identifies a flag.

Nacha, Risk Management Topics, October 1, 2024

That sentence decides how the agent is built. It holds only a credit that a written rule flagged, it records which rule, and it starts a visible clock. Since September 18, 2026 that clock is short: a non-Same Day credit must be available by 9:00 a.m. local time on settlement date wherever in the night the file arrived (Nacha, funds availability rule). A bank that also offers early availability, before settlement, shortens it further; Nacha's guidance suggests limiting early funds to seasoned accounts and recurring credit types for exactly that reason (RMAG).

When can an RDFI use R17, and when R06?

R17 is the receiving bank's own call; R06 answers a request from the sending bank. Since October 1, 2024 Nacha's rules have expressly let an RDFI, at its option, use R17 to return an entry it believes is fraudulent, with the word QUESTIONABLE in the return addenda (Nacha). R06 is "Returned Per ODFI's Request", and an ODFI may now ask for a return for any reason, indemnifying the RDFI.

The draft carries both. The Contact agent writes the notice with R17 selected and R06 one click away, because which fits is a judgement about who found the fraud and who asked, not a rule the agent can apply. What counts as false pretenses, and therefore when an R17 for that reason is defensible, has its own page.

How does an RDFI contact the ODFI?

Through the ODFI's registered fraud contact. Every ODFI and RDFI must register an ACH operations contact and a risk or fraud contact in Nacha's ACH Contact Registry (Nacha, Risk Management Portal), and Nacha's RDFI checklist puts the call right after the hold: contact the ODFI, using the registry for its details (RMAG checklist).

What goes in the request matters as much as where it goes. The sample request at 2:16 a.m. names the trace number, the amount, the receiver, that the account was opened two days earlier and that the same employer paid a different account for seven years, then asks the ODFI to check with its originator. It says nothing about a referral to the BSA officer or the other accounts the device opened. The reply at 8:41 a.m. confirmed that the change of direct deposit had come by email from a look-alike domain.

The agents' run in ACH Fraud Monitoring, step by step: seven steps between 1:42 and 8:43 a.m., each with its confidence and hand-off

What the agent never does

It never returns a credit, never restricts an account and never sends a notice; a person prepares those and a second person releases them. That line is deliberate. A flag is a probability, and Nacha's own advisory group warns that monitoring controls "should not be used alone to determine the validity of an incoming credit transaction" (RMAG).

There is also a regulatory history behind it. In 2022 the CFPB found a large bank had acted unfairly by freezing accounts and denying claims on the output of a faulty fraud filter and nothing more (CFPB, Bank of America, 2022). That case concerned prepaid card disputes, not ACH credits, but the lesson carries: an automated score may stop money for hours under a rule written for that purpose; a person decides what happens next, on evidence a second person can check.

Respondents to the Federal Reserve's 2026 risk officer survey said much the same when listing what works against ACH losses: alongside analytics and machine learning, they named manual review (Federal Reserve Financial Services, 2026; not independent academic research, margin of error ±6%).

Do RDFIs have to monitor every credit?

No. Nacha's FAQ answers "No" to whether RDFIs must screen every entry individually, and says the rule "does not require pre-posting monitoring of credit entries" (Phase 2 FAQ). An RDFI may leave out activity it judges to be very low risk, provided a risk assessment separates higher-risk from lower-risk transactions.

Scoring every credit before it posts is therefore a design choice, not a duty. ACH Fraud Monitoring is built to score every received credit before its funds fall due, as a target, because the funds availability exemption only helps a bank that has flagged the credit before 9:00 a.m. A bank that monitors after posting meets the rule and gives up the hold.

The pattern is worth checking at any bank. The mismatch rule Nacha lists first is cheap to run and catches real cases, but at this bank one flag in sixteen was fraud; payroll credits to new accounts were confirmed one time in six. A received-credit program earns its keep by measuring each rule this way and moving staff time to the rules that pay. How to test those thresholds each year is the subject of the risk assessment guide, and the payroll diversion behind this credit is traced from the first email. To run the received credits agent on a bank's own files, start from ACH Fraud Monitoring.

Questions people ask

What is a false pretenses credit?

A credit the sender authorized because someone lied about who they were, whom they acted for, or who owned the receiving account. Nacha's definition covers business email compromise, vendor and payroll impersonation; it does not cover scams over fake or poor-quality goods. A payment to the right person induced by some other lie is not false pretenses either.

How long can an RDFI hold a suspect ACH credit?

Nacha's exemption releases the RDFI from Nacha's own availability deadline for a flagged credit, but Regulation CC still applies, and it requires electronic payments to be available by the business day after the banking day the bank received them. The practical window is the time needed to ask the ODFI and decide; the bank must tell the ODFI it is using the exemption.

Does the RDFI need the customer's permission to return a suspect credit?

No customer statement is needed for an R17 return of a credit the RDFI believes is fraudulent; unauthorized-debit returns are the ones built on a customer's claim. Nacha's rules leave R17 to the RDFI's discretion, within the two-day return window.

What should an RDFI do after returning a fraudulent credit?

Look for the same pattern elsewhere. Nacha's RDFI post-mortem checklist starts by asking the AML team whether it saw the credit, then checks for similar credits to the same account and from the same originator to other accounts, and records the event in internal reporting.

Can a third party do ACH credit monitoring for an RDFI?

Yes. Nacha's FAQ says the rule does not alter an RDFI's ability to use a third-party service provider to carry out its obligations. The obligation itself, and the annual review of whether the monitoring still fits the bank's risks, stay with the RDFI.