An ACH fraud monitoring policy is the board-approved document in which a bank states how it meets Nacha's 2026 fraud monitoring rules on both sides of its ACH business: which entries it sends and receives get scrutiny and why, the thresholds and who may change them, how a flagged entry is held, returned or released and by whom, how the other bank is contacted, how fintech partners and third parties are relied on, and how the program is reviewed at least once a year. Nacha prescribes outcomes, not wording, so the policy is where the bank's risk-based choices become commitments an examiner and an auditor can test. The hard part is writing clauses the bank can prove it keeps. Botminds' ACH Fraud Monitoring keeps each rule's version, every decision with its maker and checker, and the annual review's numbers, so the evidence for each clause builds itself.
Sample wording on this page is ours, written for a fictional bank, Tessaly Community Bank, and is a starting point for a bank's counsel and compliance officer, not legal advice. Rule and guidance citations are linked where they appear.
What the 2026 Nacha rules ask, beside the policy wording that answers it
What the rule asks: Risk-based monitoring relevant to each role the bank plays: as ODFI for entries it sends, as RDFI for credits it receives
Sample policy wording: This policy covers every ACH entry the Bank originates as ODFI, for itself, its business clients and its third-party senders, and every credit it receives as RDFI, including for accounts held through fintech partners.
What the rule asks: At minimum, a risk assessment separating higher-risk from lower-risk transactions
Sample policy wording: The ACH fraud risk assessment, appended, rates each entry type and route; scrutiny follows the rating, and any activity exempted as very low risk is listed with the reason.
What the rule asks: Processes reasonably intended to identify entries suspected of being unauthorized or authorized under false pretenses
Sample policy wording: The monitoring rules in Schedule A, each with its threshold, owner and version, identify suspect entries. No rule takes effect without a second person's approval.
What the rule asks: Procedures for handling credits identified as suspect
Sample policy wording: A flagged credit may be held under the funds availability exemption only on a Schedule A rule; the ODFI is told; the credit is returned, released or escalated before funds would otherwise be due.
What the rule asks: R17 QUESTIONABLE at the RDFI's discretion; R06 at the ODFI's request, with an answer within ten banking days
Sample policy wording: A return for suspected fraud is prepared by an ACH operations specialist and released by a manager who did not prepare it; an ODFI's request is answered within one business day.
What the rule asks: Review at least annually and update to address evolving risks
Sample policy wording: The ACH operations manager and BSA officer review this policy and Schedule A each year, and on any trigger in Section 10, and report to the Board Risk Committee.
What should an ACH fraud monitoring policy include?
Ten things: scope, roles, the risk assessment, the monitoring rules, holds, returns, contact with other banks, reliance on others, escalation and confidentiality, and the annual review. The first five say what the bank watches and who decides; the second five say how it acts and how it proves it. The comparison above shows the clauses that answer Nacha directly; the rest come from bank supervision.
Supervisors have long said what an ACH policy needs. The OCC's ACH guidance lists, among the basic components, "Board-approved risk tolerances that outline the types of activities the bank may conduct and the types of businesses approved for ACH transactions", clearly defined duties, an ACH credit-risk program, and "An effective vendor management program, including a due diligence process for selecting third-party service providers, and an oversight process for monitoring them" (OCC Bulletin 2006-39). A fraud monitoring policy written in 2026 sits inside that frame, or extends it.
The ten sections of an ACH fraud monitoring policy, and who owns each
| Section | What it says | Owner | Evidence it promises |
|---|---|---|---|
| 1. Scope | Every role: ODFI, RDFI, third-party sender relationships, fintech partners | ACH operations manager | The list of originators, senders and partners, current |
| 2. Roles | Who prepares, who checks, who may change a rule; no one checks their own work | ACH operations manager | Access rights and the trail of who did what |
| 3. Risk assessment | How entries are rated, what is exempt and why | Payments risk manager | The assessment, dated, signed |
| 4. Monitoring rules | Schedule A: each rule, threshold, side, owner, version | ACH operations manager | Each rule's flags and confirmed fraud |
| 5. Holds | When a received credit may be held under the exemption; telling the ODFI; Regulation CC | ACH operations manager | Each hold with its rule, time and ODFI notice |
| 6. Returns | R17 and R06: who prepares, who releases, time limits | ACH operations manager | Each return with maker, checker and time against the window |
| 7. Contact with other banks | Registry entries kept current; what a request may say; reply standards | ACH operations manager | Registry verification and the contact log |
| 8. Reliance | Partners' and third parties' monitoring: what is relied on, how it is tested | Third-party risk manager | Attestations, test results, gaps closed |
| 9. Escalation and confidentiality | Referral to the BSA officer; nothing in a notice may reveal a SAR | BSA officer | Referrals, kept out of every notice and customer message |
| 10. Review | Annual review and its triggers; reporting to the board | ACH operations manager and BSA officer | The review, signed, and the board minute |
Is there an ACH fraud monitoring policy template?
Nacha does not publish a free one, and a template copied whole would defeat the rule. Nacha's FAQ says the rules do not "prescribe specific processes and procedures" and instead call for a risk-based approach (Nacha, Phase 2 FAQ), so the substance of the policy has to come from the bank's own risk assessment. The sections and sample clauses on this page are a skeleton; the thresholds, exemptions and owners must be the bank's.
Nacha's advisory group suggests a practical start: "Documenting existing processes can offer a good first step toward developing policies and procedures to comply with the new Rules" (RMAG, April 2024). Most ACH teams already watch some things informally, such as a large credit to a new account or a payroll file with many changes. Writing those down, with the threshold actually used, gives the first draft of Schedule A.
A sample clause: holding a received credit, with the evidence it promises
5.2 Holding a received credit
(a) The Bank may delay availability of an ACH credit only where a monitoring rule in Schedule A has flagged it as suspected of being unauthorized or authorized under false pretenses. No credit is delayed because it has not yet been reviewed.
(b) When the Bank delays availability under this section, it informs the ODFI through the ODFI's registered fraud contact, and records the rule, the time of the hold and the notice.
(c) A held credit is decided, by return, release or escalation, before the time the Bank would otherwise be required to make the funds available, and in any event within the time Regulation CC allows.
(d) A hold beyond the settlement date is prepared by one person and approved by another.
Evidence: for each hold, the rule and its version, the time flagged, the notice to the ODFI, the decision, its maker and checker, and the time against the deadline.
Who approves the ACH fraud monitoring policy?
The board, or a committee it designates, on management's recommendation. The FFIEC's examination procedures for ACH ask whether policies "Are in writing and approved by the board or a designated committee", "Adequately address ODFI or RDFI responsibilities", "Establish management accountability", "Include a process to monitor policy compliance" and "Include a mechanism for periodic reviews and updates" (FFIEC, Retail Payment Systems booklet). Those procedures were written for internet-initiated entries; they read as a fair test of any ACH policy.
The OCC adds what the board should receive afterwards: periodic reports including metrics on ACH volume, returns and operational losses, and "Unauthorized returns that exceed board-established thresholds" (OCC Bulletin 2006-39). A fraud monitoring policy should name its own board reporting in the same way: flags and confirmed fraud by type, money stopped, frauds missed, partner gaps, and changes to rules.
How detailed must ACH procedures be?
As detailed as the bank's ACH business is complex. The OCC's words: "The depth and breadth of a bank's ACH policies and procedures will depend on the scope and complexity of the ACH activities" (OCC Bulletin 2006-39). A credit union that only receives payroll and benefit credits can have a short policy and a two-page procedure; a bank sending for fintech partners and a thousand business clients needs procedures for each side, each partner type and each file window.
The useful split is between policy and procedure. The policy states commitments: what is monitored, who decides, within what time, with what evidence. The procedures say how, step by step, and change more often: which screen, which call, which form. Thresholds belong in a schedule the policy refers to, so that a tuned threshold is a controlled change rather than a policy rewrite. The ACH team's procedures, seat by seat, show the level below the policy.
How do you document risk-based monitoring?
By keeping, for every rule, what it was meant to catch, what it flagged, what it confirmed and what changed, and for every flag, who decided what and when. The OCC's fraud principles ask banks to assess fraud schemes periodically and to let the documented results of that assessment shape their controls (OCC Bulletin 2019-37); the word that matters is documented.
The evidence an examiner or auditor is likely to ask for, and the clause it proves
- The risk assessment, dated and signed
Proves Section 3: the program is risk-based, and exemptions were chosen, not assumed.
- Schedule A with version history
Proves Section 4: which rule was live on any date, and who approved each change.
- A sample of flags with their decisions
Proves Sections 5 and 6: each hold and return had a rule, a maker, a checker and a time.
- Notices to ODFIs for holds
Proves Section 5: the exemption was used with the required notice.
- The registry verification and contact log
Proves Section 7: contacts kept current within 45 days of a change and verified each year.
- Partner attestations and test results
Proves Section 8: reliance was reasonable and verified, not taken on trust.
- Referrals, and the notices that do not mention them
Proves Section 9: escalation happened, and nothing revealed a SAR.
- The annual review and the board minute
Proves Section 10: the program was reviewed and the board saw it.
Keep the evidence for long enough to cover both the rules audit and the regulators' look-back. Bank Secrecy Act records are kept for five years (31 CFR 1010.430), and a fraud program that feeds referrals into BSA work is simplest to run to the same period. ACH Fraud Monitoring keeps its trail append-only for five years as a design target.
ACH Fraud Monitoring's audit trail behind each clause, and evidence bundles for the examiner and the Nacha audit
Reliance on fintech partners and third parties, in writing
The policy must say what the bank relies on others to monitor, on what basis, and how it checks. On the sending side Nacha allows it, with a condition: "The basis for relying on another originating entity should be reasonable and clear (e.g., allocated by contract and verified by appropriate oversight)" (Nacha, Phase 2 FAQ). On the receiving side the duty stays with the RDFI, though it may use a third-party service provider to carry it out.
For fintech relationships Nacha's advisory group lists what an RDFI's agreement might cover, including "The responsibility to monitor incoming credit Entries suspected of being initiated due to false pretenses (as of the effective date of the new rules – either March or June 2026)" (RMAG, July 2024). A policy should require that responsibility to be in each agreement and require the bank to test, at least yearly, that the partner does what it attests. Originator underwriting and exposure limits belong to a separate ACH risk policy, often owned by treasury management.
The program in ACH Fraud Monitoring as the policy describes it: rules, versions, outcomes, phases, review
What does an examiner look for in an ACH policy?
That it is approved, fits the bank's actual ACH business, assigns accountability, and is followed. The FFIEC's procedures above are the test of the document; a sample of decisions is the test of the practice. Examiners will also look across rails: the OCC has long warned that controls on one payment system can simply push fraud onto another (OCC Bulletin 2006-39), so a policy should say how ACH flags reach wire and instant payment monitoring for the same customers.
The most common gap is between policy and evidence. A policy that promises every return is checked by a second person needs a trail that shows the second person, for every return, not a sign-off sheet at month-end. That is where software earns its place in a policy: not by complying, but by making each clause provable.
How often should the ACH fraud policy be updated?
At least once a year with the program review, and whenever a trigger in the policy fires. Nacha's consultants put the principle plainly.
These new rules are not intended to be a one-time compliance exercise.
Nacha Consulting, Next Steps for the New Nacha Risk Management Rules, April 2026
Good triggers are a new partner or product, a new payment window, a fraud that got through, a rule that floods the queue, a change in Nacha's rules, and a change in the bank's own structure. The next Nacha changes on the calendar include a $10 million Same Day ACH limit from September 17, 2027 and a sanctions return code, R90, from March 17, 2028. The annual review is where each trigger's effect is measured, and the 2026 rules are the text each clause answers. Return handling outside fraud, such as notifications of change and administrative returns, belongs to ACH return and NOC management. To see the evidence each clause promises on a bank's own files, start from ACH Fraud Monitoring.
Questions people ask
Do we need a separate ACH fraud monitoring policy?
Not necessarily a separate document. A bank can extend its existing ACH risk management policy with fraud monitoring sections. What matters is that the 2026 duties, for both sides of the business, are written down, approved, owned and reviewed at least annually.
Should the policy name thresholds?
Put them in a schedule the policy refers to, not in the policy text. Thresholds change as the program learns; a schedule with version control lets a tuned threshold be approved by the named owners without a board-level rewrite, while the policy fixes who may approve it.
Does the policy need to cover Same Day ACH separately?
It should address it, because Same Day entries settle and become available faster, which shortens the time to act. Nacha's Same Day per-payment limit rises from $1 million to $10 million on September 17, 2027, a natural trigger to revisit thresholds for large Same Day credits.
How should the policy handle a SAR referral?
By sending it to the BSA officer and keeping it out of everything else. Federal law prohibits disclosing a SAR or anything that would reveal one, so the policy should say that notices to other banks and messages to customers never mention a referral, and who checks that before they are sent.
Who should write the ACH fraud monitoring policy?
The ACH operations manager with compliance, drawing on BSA/AML and third-party risk, and approved by the board or its committee. Nacha's advisory group recommends starting from the processes already in use and talking to the BSA/AML team, which already monitors suspicious activity across payment rails.