ACH fraud monitoring procedures are the written, risk-based steps a bank follows to spot ACH entries that are unauthorized or were induced under false pretenses, on both sides of its business: the entries it sends as originating bank (ODFI) and the credits it receives as receiving bank (RDFI). Under the Nacha rules that took full effect on June 22, 2026, those procedures must say how entries are flagged, who looks at a flag, how the other bank is contacted, who decides a hold or a return, and how the whole program is reviewed at least once a year. The hard part is not the rule; it is that the evidence sits in four systems and the decision has a clock. Botminds' ACH Fraud Monitoring puts what the bank sends and what it receives on one screen, has agents read, link and draft, and leaves every return, hold and notice to a specialist who prepares it and a manager who releases it.
The worked examples on this page come from a fictional sample bank as it runs through the solution: Tessaly Community Bank, which sends ACH for 14 fintech partners and 1,100 business clients. Every person, company and account named here is fictional; the rules and figures from regulators are linked where they appear.
Six seats touch a flagged ACH entry; the 2026 rules changed what each one does
Today
Worked returns, notifications of change and exception reports; fraud reached the desk as a customer claim, days after the money moved.
With agents
Works the morning flags on both sides with the evidence already gathered, edits the drafted notice, and prepares the hold or the return.
Still theirs: Choosing between hold, return and release, and the reason given for it.
Today
Saw a return after the person who decided it had keyed it; met the program once a year as a policy document.
With agents
Checks each prepared action against its evidence before it is released, and approves threshold changes replayed over past entries.
Still theirs: The release, and the signature on the annual review.
Today
Monitored the same payments for suspicious activity in a separate system, often learning of a mule account after the ACH team.
With agents
Receives confidential referrals from the ACH flags and shares what its own monitoring saw on the same account.
Still theirs: The suspicious activity report decision, kept out of every customer view.
Today
Filed each partner's attestation of its own monitoring and relied on it as written.
With agents
Sees what each partner says it monitors beside what the bank tested, and prepares partner thresholds and restrictions.
Still theirs: The judgement whether reliance on a partner is still reasonable.
Today
Owned the business client and its origination limits; heard about fraud when a client called.
With agents
Is asked to confirm a client's payment or changed instructions before a flagged sent entry releases.
Still theirs: The call to the client on a number already on file.
Today
Rebuilt who decided what from emails and a binder before the annual Nacha audit.
With agents
Filters one trail of every action, by a person or an agent, and samples decisions with their evidence.
Still theirs: Independence: reads everything, changes nothing.
What are ACH fraud monitoring procedures under the 2026 Nacha rules?
They are the bank's own answer to two Nacha obligations, one for each side of the payment. As an ODFI, a bank must have risk-based processes and procedures designed to pick out the entries it sends that may be unauthorized or induced under false pretenses, and must review them at least annually (Nacha, Fraud Monitoring Phase 2). As an RDFI, it must have procedures that pick out suspect credits it receives and say how each one found is handled. Detection without a handling step does not meet the rule.
Nacha's rule-maker described the change plainly when Phase 1 began on March 20, 2026.
What's particularly noteworthy is that for the first time, RDFIs have a role to play, alongside ODFIs, Originators and third parties.
Devon Marsh, Nacha Managing Director, ACH Network Rules and Risk Management, March 20, 2026
That sentence is the operating-model change. Before 2026 most banks treated the receiving side as posting work: accept the file, post by account number, make funds available on time. The receiving side now has a fraud duty of its own, and Nacha's FAQ says the processes of the parties that originate an entry "do not affect the obligations of RDFIs" (Phase 2 FAQ). A bank cannot point at the sending bank and stop there.
The rules prescribe no method. Nacha's FAQ answers "No" to whether a bank must screen every entry individually and says monitoring before processing is not required, though it "provides the greatest opportunity for detecting and preventing potential fraud". The procedures therefore have to state the bank's own choices: which entries get extra scrutiny, which get basic precautions, and which the bank has decided carry very low risk.
Who is responsible for ACH fraud monitoring at a bank?
The bank is, and the procedures must name a person for each step. The Nacha rules place the duty on the institution, not on a job title; the OCC's ACH guidance, last amended in March 2025, expects "clearly defined duties and responsibilities that ensure strong internal controls over transactions" (OCC Bulletin 2006-39). In practice the work lands in ACH operations, because that team sees the files, the returns and the deadlines, with BSA/AML, treasury management and partner risk as named contributors.
Nacha expects the seats to talk. Its Phase 1 page says the RDFI amendment "encourages the necessary communication between compliance monitoring, operations, product management, and relationship staff" (Nacha, Fraud Monitoring Phase 1). A procedure that lives only in ACH operations, with no line to the people who know the customer, will flag entries nobody can explain.
The board's part is set by examiners, not by Nacha. The same OCC bulletin asks for board-approved risk tolerances for the ACH program and periodic reports on returns and losses; the program's annual review is the natural moment those reports are refreshed. Writing the ACH fraud monitoring policy covers the approval chain clause by clause.
What does an RDFI have to monitor, and what does an ODFI?
An RDFI monitors the credits it receives; an ODFI monitors the entries it sends, credits and debits, for its originators and third parties. The two duties look alike on paper and differ in what the bank can see. The receiving bank knows the account, its age, its history and its holder; the sending bank knows the originator, its usual files and who changed a payee yesterday.
The same rule, two sides of the bank: what each side watches and what it can do
| As ODFI (entries the bank sends) | As RDFI (credits the bank receives) | |
|---|---|---|
| Who else is covered | Every non-consumer originator, third-party sender and third-party service provider, each for its own role | Only the RDFI; any party performing an RDFI function on its behalf should monitor for the functions it performs |
| What it can see | The originator's usual volumes, payees, SEC codes and recent changes to payment instructions | The receiving account's age, balance, history, holder, and the pattern of credits arriving |
| Nacha's examples of what to watch | Volume, velocity, dollar amounts and SEC codes of originated entries; change controls on vendor and payroll payment details | SEC code that does not fit the account, an atypical high-dollar credit, a run of similar credits such as several payrolls, any of these into a new, dormant or mule account |
| What it can do when an entry looks wrong | Stop further processing, consult the originator, check other internal monitoring, contact the RDFI or ask for a freeze or return | Delay funds availability under the exemption, contact the ODFI, return the entry as R17 QUESTIONABLE or as R06 at the ODFI's request |
| Minimum Nacha accepts for debits | A robust return and return-rate monitoring program, plus the WEB debit and Micro-Entry fraud rules | Not addressed: the RDFI duty is written for credit entries |
The last row matters for staffing. On the sending side, debits already had a monitoring regime in the return-rate rules, which is why Nacha accepts return monitoring as the floor for them. Credits had none. The new procedure work is concentrated in sent credits, where a business client is tricked into paying a fraudster, and received credits, where the fraudster's account sits. How a receiving bank monitors credits, signal by signal, is worked through on its own page.
The procedure runs on the file clock
ACH fraud monitoring is a timed procedure: each step has to finish before the money becomes spendable. Since September 18, 2026 the RDFI must make a non-Same Day credit available "no later than 9:00 a.m. (RDFI's local time) on the Settlement Date" whatever time the file arrived (Nacha, funds availability rule), so the window between a credit landing overnight and the money leaving is often a single working morning. An R17 return then has to reach the ODFI by the opening of business on the second banking day after settlement (Nacha, October 1, 2024 rules).
One flagged payroll credit in ACH Fraud Monitoring: where 8 h 48 min went, from the overnight file to the return file
Thursday, 1:42 a.m. to 10:30 a.m., at the sample bank
- Agents read, link, hold and ask the sending bank (1:42 to 2:16 a.m.), 34 min · 6%
- Waiting for the sending bank's reply, 6 h 25 min · 73%
- Specialist prepares, manager checks and releases (8:41 to 9:15 a.m.), 34 min · 6%
- Until the 10:30 a.m. return file, 1 h 15 min · 14%
The shape is typical of what the procedure must plan for. The work itself is minutes; the waiting is hours, and the deadline does not move. A procedure that sends the request to the other bank only when a person reaches the flag at 8:00 a.m. has spent the night. One that sends a standing request to confirm, under rules the bank approved in advance, arrives at the morning with an answer.
Sent entries run on a different clock: the file release. Here the procedure needs an escalation time before each release window, because a payment stopped before release costs nothing to fix and one recovered afterwards depends on another bank's goodwill. The sample bank's own setting escalates a flagged sent entry one hour before its file; that is a bank choice, not a rule.
How do ODFIs and RDFIs communicate about fraud?
Through the contacts each bank registers with Nacha, and through the two return codes the rules provide. All ODFIs and RDFIs "are required to register contact information for ACH Operations and ACH Risk/Fraud" in the ACH Contact Registry (Nacha, Risk Management Portal), keep it current with changes "within 45 days", and verify it at least annually (Nacha, 2023). An RDFI that uses the funds availability exemption is required to contact the ODFI to tell it so.
The registry only helps if someone answers. Among respondents to the Federal Reserve's risk officer survey, one large community bank named its main ACH problem as being "unable to contact the receiving depository financial institution [RDFI] or originating depository financial institution [ODFI] in [a] timely manner" (Federal Reserve Financial Services, 2026 Risk Officer Survey; the survey notes it is not independent academic research, margin of error ±6%). Procedures should therefore cover both directions: how the bank asks, and how fast it answers when it is asked.
What the contact procedure should say, in both directions
- Who looks up the other bank, and where
The ACH Contact Registry's fraud contact, not a general customer line. Nacha's checklists for both sides start the contact step there.
- What the bank may say in a request to confirm
The entry, the amount, why it looks wrong. Never that a suspicious activity report exists or may be filed.
- When the bank calls instead of writing
A set number of hours without a reply before a phone call goes on someone's list.
- How fast the bank answers another bank
A bank standard, set shorter than the rules' own deadlines; for an ODFI's request to return, Nacha requires a decision or status within ten banking days.
- Who signs an indemnity
An ODFI asking for an R06 return indemnifies the RDFI; the procedure names who may sign the letter, so the request is not stalled waiting for a lawyer.
- Who keeps the registry entries current
Changes within 45 days of a staff move, and a dated annual verification the auditor can see.
One line in that list is a legal limit rather than a courtesy. Federal law forbids a bank to disclose a suspicious activity report, or anything that would show one exists (31 CFR 1020.320(e)). A fraud notice to another bank, written in a hurry by the person who also referred the account to the BSA officer, is exactly where that slips. The sample bank's procedure keeps the referral off every outgoing notice and customer message, and shows the specialist what each recipient will see before she signs.
ACH Fraud Monitoring's first screen: what the bank sent, what it received, and the rule each flag answers
One person prepares, another releases
Every action that moves money, freezes an account or speaks to someone outside the bank should be prepared by one person and released by another. That is older than the Nacha rules: the OCC's ACH guidance tells banks to "minimize and segregate ACH staff and limit access to various maintenance and transaction support functions (i.e., changing account numbers, adding or deleting new users, changing transaction limits.)" (OCC Bulletin 2006-39). The 2026 rules add new actions to which it applies: holds under the exemption, R17 returns and notices to other banks.
The sample bank's procedure names the actions that need two people: a return, a hold past the settlement date, an account restriction, a cancelled sent entry, an originator restriction, an exposure limit, a threshold change, and any notice to another bank or a customer. The screen refuses to let the specialist who prepared a package check it. That is a design target in ACH Fraud Monitoring, and it is also what an examiner's sample will look for first.
A decision package: seven actions, one maker, waiting for a checker who did not prepare it
Where fraud monitoring meets BSA/AML, and where it stops
The two programs watch the same payments for different reasons, and the procedures should say who tells whom. Nacha itself draws the line close: a risk-based approach to RDFI monitoring "aligns with AML monitoring practices in place today", and its rule pages note RDFIs may need to share information internally "between teams that monitor transactions for suspicious activity and operations, product, and relationship teams" (Phase 2 page). Nacha's Risk Management Advisory Group goes further and suggests talking to the BSA/AML team, because it already monitors items moving in and out of the bank on multiple payment rails (RMAG, April 2024).
The split that works in practice: ACH operations owns the entry, the clock and the return; BSA/AML owns the customer, the pattern across rails and the report. A referral flows from the first to the second, confidentially, the moment a flag points at a mule or a compromised account. The ACH team does not decide whether to file, and the BSA team does not key returns.
What staff does ACH fraud monitoring need at a small bank?
Fewer people than the list of seats suggests, but never fewer than two on any action. Nacha's rule is risk-based, so a bank receiving a few thousand credits a day can watch a narrow set of patterns, such as payroll credits to accounts under 30 days old or business credits into consumer accounts, and still meet it. What it cannot do is conclude that no monitoring is needed; Nacha says a risk assessment that tells higher-risk from lower-risk transactions is the minimum.
The staffing question is mostly about mornings. Received credits fall due at 9:00 a.m., so someone has to read the overnight flags before then, and someone else has to be available to check. What Phase 2 costs a small RDFI estimates the hours by size of institution, with the assumptions shown.
What the annual review asks of the team
The rules require the processes to be reviewed "at least annually" and updated "to address evolving risks" (Phase 2 FAQ). For the ACH team that means evidence, not a memo: each rule the bank runs, how many entries it flagged, how many turned out to be fraud, what was missed and found later, and what changed in the threats. A team that keeps each flag's outcome as it goes writes the review from its own numbers; a team that does not writes it from memory.
In ACH Fraud Monitoring a Program agent keeps each rule's outcomes, proposes threshold changes replayed over 90 days of past entries, and drafts the review for the ACH operations manager and the BSA officer to sign. The ACH fraud risk assessment sets out what the review should measure and the evidence for each line. To see the screens together, start from ACH Fraud Monitoring.
Questions people ask
Do the Nacha fraud monitoring rules apply to credit unions?
Yes. The rules apply to every participating depository financial institution in the ACH Network, banks and credit unions alike, in whichever role it plays. A credit union that only receives payroll and benefit credits has the RDFI duty; one that also sends entries for members or business accounts has the ODFI duty too.
Can a bank outsource ACH fraud monitoring?
It can use a third-party service provider: Nacha's FAQ says the rule "does not alter an RDFI's ability to utilize a Third-Party Service Provider to carry out the RDFI's obligations". The obligation stays with the bank, and so does the annual review of whether the provider's monitoring still fits the bank's risks.
Must ACH fraud monitoring happen before entries post?
No. Nacha says the rules do not require monitoring before processing, though monitoring early gives "the greatest opportunity" to stop fraud. A bank that does monitor before posting may delay availability of a flagged credit under the funds availability exemption, which is the main reason to do it.
How often should a bank update its ACH Contact Registry entries?
Within 45 days of any change, such as a staff move, and with a full verification at least once a year. Nacha has tested registered addresses by sending emails and asking for a reply; in one case the answer took three weeks.
Who should the RDFI call when it suspects a received credit?
The ODFI's registered ACH risk or fraud contact in the ACH Contact Registry, reached through Nacha's Risk Management Portal. Nacha's RDFI checklist puts that contact right after placing a hold, and before deciding how the funds should be returned.
Does a fraud return change who carries the loss?
Not by itself. Nacha's FAQ says the monitoring rules expressly disclaim any change to UCC Article 4A rights and leave the allocation of liability to the law that already governed it. A return recovers money; who bears a loss is still settled by the agreements and law that applied before.