ACH fraud risk assessment and the review “at least annually”

An ACH fraud risk assessment is a bank's documented judgement of where fraud can enter through the ACH entries it sends and receives, how likely and costly each route is, which controls stand in the way, and what risk is left after them. Under Nacha's 2026 fraud monitoring rules it is the floor of a risk-based program: Nacha treats an assessment that separates higher-risk from lower-risk transactions as the minimum, and the monitoring built on it must be reviewed "at least annually". The work is hard because the answer decays: rules tuned to last year's frauds miss this year's, and a review written from memory cannot see it. Botminds' ACH Fraud Monitoring keeps each rule's flags and outcomes as the year runs, tests proposed changes against past entries, and drafts the annual review for the people who sign it.

The program figures on this page are sample data from a fictional bank, Tessaly Community Bank, as it runs in the solution. Industry figures come from the Federal Reserve and the FBI, linked where they appear.

What is an ACH fraud risk assessment?

It is the analysis that decides where the bank watches closely, where it takes basic precautions, and what it leaves alone. Nacha allows all three: an RDFI "might take extra measures to detect fraud in transactions in which it has determined risks to be elevated; take basic precautions where it has determined that risks are lower, and exempt transactions or activities that it determines involve very low risk" (Nacha, Fraud Monitoring Phase 2). What it does not allow is a risk assessment that concludes no monitoring is needed.

Nacha's Risk Management Advisory Group spells out the content. The assessment "should assess the risk posed to the organization from any threat along with the likelihood of the event, the potential for compensating controls, and the residual risk to the organization after compensating controls", and the threat the 2026 rules address is "that a fraudster will use your organization to commit credit-push payment fraud" (RMAG, April 2024). That second sentence is the useful one. The question is not only whether customers lose money, but whether the bank's accounts are where stolen money lands.

Bank supervisors ask for the same thing in their own words. The OCC's fraud risk principles say management "should periodically assess the likelihood and impact of potential fraud schemes and use the documented results of this assessment to inform the design of the bank's risk management system and evaluate fraud control activities" (OCC Bulletin 2019-37). An ACH fraud risk assessment is that principle applied to one payment rail.

How often must ACH fraud monitoring be reviewed?

At least once a year, and more often when the risks call for it. Nacha's FAQ requires parties "to review their processes and procedures at least annually and make appropriate updates to address evolving risks", and adds that they "may determine that more frequent review is appropriate, based on their specific circumstances" (Phase 2 FAQ). The rule-maker put the intent more bluntly on the day Phase 1 began.

Fraudsters are always looking for the next big thing, so you should periodically check your procedures and update them as necessary. This should be an evolving process, not a 'one and done.'

Devon Marsh, Nacha Managing Director, ACH Network Rules and Risk Management, March 20, 2026

Good triggers for an extra review are events, not dates: a new fintech partner, a new payment window, a fraud that got through, a threshold that floods the queue. Nacha's consulting arm lists the forces that change a risk profile as "new products, evolving fraud schemes, customer behavior, technological changes and operational growth" (Nacha, April 2026). Each of those should reopen the part of the assessment it touches.

What should an ACH fraud risk assessment include?

Roles, threats, controls, residual risk and evidence, as in the checklist above. In practice four sections carry most of the weight. First, an inventory of where ACH enters and leaves the bank: originators by type and size, third-party senders, fintech partners whose customers hold accounts at the bank, and the account types that receive credits. Second, the threats by type, rated for likelihood and impact on each route. Third, the controls that answer each threat, with the monitoring rules named. Fourth, what is left, and whether the board's risk appetite accepts it.

The ACH-specific inputs that are easy to miss are on the receiving side. How quickly new accounts can receive credits and move money out; whether the bank offers early availability before settlement; which partner apps open accounts at the bank and with what checks. Nacha's advisory group notes that fraudsters adapt to seasoning rules: "They may open an account and wait for 30, 60, 90 days or more prior to using the account to receive funds" (RMAG, November 2022). A risk assessment that rates new accounts as the risk and stops there will be out of date before it is signed.

The OCC's ACH guidance adds the cross-rail point: an ACH program "may not reduce a bank's total risk exposure if activities are allowed to migrate to other payment systems" (OCC Bulletin 2006-39). A control that pushes a fraud from ACH credits to wires or instant payments has moved the loss, not removed it, and the assessment should say which rails the same customers can use.

Why last year's thresholds stop working

Because the frauds and the customers both move. Academic work on fraud detection calls the problem concept drift: customers' habits change, and fraudsters change their methods, over time (Dal Pozzolo et al., IEEE Transactions on Neural Networks and Learning Systems), and it applies as much to a bank's rule thresholds as to statistical models. A rule set at 30 days for new accounts teaches fraudsters to wait 31.

The payments calendar moves too. Since September 18, 2026 non-Same Day credits must be available by 9:00 a.m. on settlement date regardless of when the file arrived, which shortens the overnight window for some RDFIs; on September 17, 2027 the Same Day ACH limit rises from $1 million to $10 million a payment (Nacha, new rules). Each change alters which thresholds make sense, and the review that follows each should say so.

What changed in ACH fraud in 2025?

Scams that make the account holder send the money grew fastest; unauthorized debits stayed the most common. In the Federal Reserve's survey, "41% of respondents reported that it is increasing" for account holder scams, while unauthorized debit fraud was reported by 97% of institutions, "though only 13% noted that it was increasing" (Federal Reserve Financial Services, 2026). The shift is from fraud a debit return can fix to fraud only credit monitoring can see.

The FBI's 2025 report adds a pattern the RDFI side of a risk assessment should name. Its Recovery Asset Team saw more account takeover cases, some of which sent 50 or more ACH payments at the same moment to recipient accounts at many different banks (FBI IC3, 2025 Internet Crime Report). A receiving bank sees one or two of those fifty credits; it will only spot them if its rules look at velocity and new accounts rather than single large amounts.

New tactics also aim at the bank's own controls. Nacha's advisory group described "double-sided spoofing" in January 2025: fraudsters posing as the bank to a business client, then as the client to the bank, to reset a security token and send ACH credits and wires; the target, it says, is the bank's own controls against corporate account takeover (RMAG, January 2025). A risk assessment that rated token resets as low risk in 2024 should not say so in 2026.

How do you test ACH fraud thresholds?

By replaying each proposed change over past entries whose outcomes are known, and comparing what it would have caught and missed. Two numbers matter for each rule: how many flags it raises, which is staff time, and how many of those turned out to be fraud, which is the point. A change that removes hundreds of flags and misses no confirmed case is easy to approve; one that adds flags must find enough fraud to pay for them.

The second row is concept drift caught in the act. The 30-day rule worked, and the replay shows payroll diversions sitting just beyond it, in accounts between 30 and 45 days old. Without each flag's outcome kept as the year went, no one could have seen where the misses clustered.

ACH Fraud Monitoring's program screen: nine rules, their versions and outcomes, both phases, and the review drafted

Who signs the ACH annual review?

Nacha does not say; the bank's governance does. The rules put the review duty on the institution. The OCC's ACH guidance gives the board the job of setting risk limits for the ACH program and asks for an "ongoing process that evaluates whether ACH activities are conducted within the risk parameters established by the board of directors" (OCC Bulletin 2006-39). The annual review is the obvious document to carry that evaluation to the board or its risk committee.

A sensible pattern is two signatures below the board: the manager who owns ACH operations, because the rules and thresholds are theirs, and the BSA officer, because the same flags feed suspicious activity monitoring. That is how the sample bank does it; the board risk committee then receives the review and a short report of the year's numbers.

Ninety days in ACH Fraud Monitoring, in plain numbers, and the board report drafted from them

Is the ACH risk assessment part of the Nacha audit?

They are separate, and one does not replace the other. Every participating financial institution must complete an annual ACH Rules Compliance Audit by December 31 (Nacha, Risk Management Portal), and Nacha tells auditors to "be prepared to audit on all relevant rules" (Nacha, audit requirements), which now include the fraud monitoring rules. An auditor will therefore look for the procedures and for evidence that they were reviewed in the year.

The risk assessment is the bank's own analysis, and its quality is a matter for examiners and internal audit, not for a rules checklist. The OCC put the limit of the Nacha audit plainly: "The Rules Audit, however, is only one element of an effective ACH audit program and is not a substitute for a comprehensive, risk-based audit" (OCC Bulletin 2006-39).

Rules, models and agents: what the 2026 model-risk guidance covers

Plain threshold rules are not models under the 2026 interagency model risk guidance, and agentic AI sits outside it for now. The OCC's April 2026 bulletin keeps simple spreadsheet arithmetic and fixed, rule-based processes out of its definition of a model, and leaves generative and agentic AI outside the guidance altogether as too new and fast-moving to cover yet (OCC Bulletin 2026-13).

That leaves the annual review to do work model validation would otherwise do. For a program that uses agents to read, link and draft, the review should show what each agent is allowed to do, which version of its instructions ran, how a new version was tested before it went live, and every override with its reason. ACH Fraud Monitoring runs a new instruction version beside the live one over 30 days of entries before a checker approves the switch, a design target the review can sample. The policy that governs those choices, and the rules the review answers to, have their own guides. To see the program screens in context, start from ACH Fraud Monitoring.

Questions people ask

Is an ACH fraud risk assessment the same as the Nacha ACH risk assessment?

It is the fraud part of it. Banks already assess the risks of their ACH activities for credit, return and operational risk; the 2026 monitoring rules require a risk-based approach to fraud specifically, built on an assessment that separates higher-risk from lower-risk transactions. Many banks fold it into the existing ACH risk assessment as its own section.

Does a small bank need a separate ACH fraud risk assessment?

It needs the content, not a separate binder. Nacha's rule is risk-based, so a small RDFI receiving mostly payroll and benefit credits can keep the assessment short, provided it names the threats, the rules that answer them and what it chose not to monitor, and why.

What evidence does an examiner expect from an annual ACH fraud review?

The rules the bank ran, what each flagged and confirmed, what was missed, what was changed and how the change was tested, and who approved it. The OCC's ACH guidance also asks for board reports with metrics and trend analysis on returns and losses, which the review can supply.

How do you measure whether an ACH fraud rule works?

Keep each flag's outcome: confirmed fraud, cleared, or still open. A rule's yield is confirmed cases divided by flags; its cost is the flags themselves. At the sample bank one rule confirmed 0.5% of its flags and another 16.3%, which told the reviewers where to move effort.

Should the ACH fraud risk assessment cover fintech partners?

Yes, where their customers hold accounts at the bank or send entries through it. Nacha allows an ODFI to rely on other originating participants' monitoring if the basis is "reasonable and clear", for example allocated by contract and verified by oversight; the review is where that verification is shown.