Nacha fraud monitoring phase 2 is the second step of the network's 2026 fraud rules: from June 19, 2026 (in practice Monday, June 22) every RDFI not already covered by Phase 1, and every non-consumer originator, third-party sender and service provider, must run risk-based procedures to identify ACH entries induced by fraud and review them at least once a year. Phase 1 had caught only RDFIs that received 10 million or more entries in 2023, so Phase 2 is the step that reached community banks and credit unions. The rule is the same for both phases; the burden is not, because the fixed work of a program weighs most on the institutions with the fewest staff. Botminds' ACH Fraud Monitoring is built to take the reading, linking and drafting off a small team so that the hours left are decisions.
The hour estimates below are ours, with every assumption stated; the sample screens show a fictional bank, Tessaly Community Bank. Counts of institutions come from the FDIC and NCUA.
Estimated hours a month to work received-credit flags by hand, by daily ACH credits received
What is Nacha fraud monitoring phase 2?
It is the extension of Nacha's credit-push fraud rules to everyone Phase 1 left out. On the receiving side, Nacha says the amendment "will require all RDFIs that did not meet the requirement threshold for Phase 1" to put in place risk-based processes and procedures to identify credits initiated due to fraud; on the sending side, all remaining non-consumer originators, third-party service providers and third-party senders take on the same duty for what they originate (Nacha, Fraud Monitoring Phase 2). All ODFIs, whatever their size, had already been covered since Phase 1 on March 20, 2026.
Nothing about the obligation is lighter for being in Phase 2. Nacha's FAQ for the receiving side reads the same in both phases: risk-based processes reasonably intended to identify credits suspected of being unauthorized or sent under false pretenses, procedures for handling them, and a review at least annually.
When did Nacha phase 2 take effect?
On June 19, 2026, which was a federal holiday, so the first banking day under the rule was Monday, June 22. Nacha's own words: "As June 19 is a federal holiday, the practical effective date for these two rules will be the next banking day – Monday, June 22, 2026" (Nacha). Its summary of upcoming changes lists the two Phase 2 rules under June 22 (Nacha, summary of rule changes). By late 2026 an RDFI's first annual review under the rule falls due well inside 2027.
Who is covered by Nacha phase 2?
Every RDFI below the Phase 1 threshold, which is most of them, and every non-consumer originator and third party below 6 million originations in 2023. Nacha's FAQ says Phase 2 "will eliminate the volume threshold and will require all RDFIs (regardless of ACH receipt volume) to comply with the credit monitoring rules". Consumers are the only participants outside the rule.
The receiving population is large and mostly small. The FDIC counted 4,238 insured banks and savings institutions at June 30, 2026, of which 543 held under $100 million in assets and 2,647 between $100 million and $1 billion; the NCUA counted 4,214 federally insured credit unions, 2,438 of them with under $100 million in assets.
Where Phase 2 landed: insured institutions by asset size, June 30, 2026
| Asset size | FDIC-insured banks and savings institutions | Federally insured credit unions |
|---|---|---|
| Under $100 million | 543 | 2,438 |
| $100 million to $1 billion | 2,647 | not broken out at this size |
| $1 billion to $10 billion | 890 | not broken out at this size |
| Over $10 billion | 158 | 748 credit unions over $500 million, counted as complex |
| All | 4,238 | 4,214 |
Small institutions already carry heavier costs for each dollar they hold. In the same FDIC report, banks under $100 million spent noninterest expense equal to 4.14% of assets, annualized, against 2.78% for banks of $1 billion to $10 billion, and their efficiency ratio was 76.47 against 57.43 (FDIC QBP, Q2 2026). A new duty with a fixed core lands on that difference.
What does phase 2 require of small banks?
A written, risk-based way to find suspect received credits, a way to handle them, and a yearly review. It does not require a particular system, screening of every entry or monitoring before posting. Nacha's FAQ asks directly whether RDFIs must screen every entry individually, and answers in one word.
Do the rules require RDFIs to screen every ACH entry individually? No.
Nacha, Fraud Monitoring Phase 2, FAQ
What a small RDFI cannot do is decide that its risk is too low to watch. Nacha's FAQ is explicit that a risk-based approach cannot end in the conclusion that nothing needs monitoring, and that at minimum a risk assessment should tell higher-risk from lower-risk transactions (Phase 2 FAQ). For many credit unions the higher-risk set is narrow: payroll and benefit credits into new accounts, business credits into personal accounts, and runs of credits for different names into one account.
A small institution that also originates for business members or customers has carried the ODFI duty since March 20, 2026, Phase 1, whatever its size. For debits, Nacha accepts a robust return and return-rate monitoring program as the minimum; for the credits it sends, Nacha's examples point at changes to payment instructions and unusual volume, velocity, amounts and SEC codes.
What was the 10 million receipt threshold?
It was the line that decided which RDFIs started in March rather than June: Phase 1 applied to "RDFIs with annual ACH receipt volume of 10 million or greater in 2023" (Nacha, Fraud Monitoring Phase 1). At roughly 250 banking days a year, that is about 40,000 received entries a banking day. Any RDFI below that line started on June 22 instead of March 20.
For scale, the whole ACH Network carried 35.2 billion payments in 2025, an average of 141 million a day, including 8.74 billion direct deposits (Nacha, ACH volume statistics).
How much does Nacha fraud monitoring cost? An estimate by size
Mostly staff time, and most of that time goes on the flags rather than on the program. Our estimate in the chart above puts received-credit monitoring by hand at about 38 hours a month for an institution receiving 1,000 credits a day and about 92 hours at 3,000 a day. At the median wage for compliance officers, $38.81 an hour in 2025 (O*NET, BLS data), that is roughly $1,500 and $3,600 a month in wages before benefits.
How the estimate is built, so a bank can redo it with its own numbers
| Input | Value used | Where it comes from | What moves it |
|---|---|---|---|
| Flags per 1,000 credits received | 1 | The fictional sample bank flagged 53 of 76,200 received in a day, 0.07%; rounded up because an untuned program flags more | How narrowly the risk assessment draws the higher-risk set |
| Working minutes per flag, by hand | 77 | The solution's estimate: 12 reading systems, 15 checking pay history and outflows, 20 finding and asking the other bank, 5 deciding, 15 writing the notice and keying the return, 10 for a second person | How many systems hold the evidence; whether the other bank's contact is ready |
| Fixed program work a month | 11 hours | Our assumption: 60 hours a year for the risk assessment, annual review, procedures and registry upkeep, plus 6 hours a month of rule tuning and reporting | Number of partners and originators to oversee |
| Wage | $38.81 an hour | Median wage, compliance officers, 2025 (O*NET, from BLS data) | Benefits and overhead add to it; a specialist may earn less, a manager more |
Two things follow. The fixed part is a larger share at the smallest size: 11 of 38 hours, nearly 30%, at 1,000 credits a day, against about 1% at the Phase 1 line. And the variable part scales with the flag rate, so the cheapest hour a small RDFI can save is a flag it never needed to raise. A risk assessment that narrows the higher-risk set honestly is the first cost control.
Nacha's advisory group is frank about where this ends. "Modern financial institutions can't hire enough employees to review every transaction in real time," it wrote, recommending that institutions use AI "to detect unusual payments patterns and flag specific transactions for their employees to review" (RMAG, March 2024). The rule never required every transaction to be reviewed; the cost question is how much of each flag's 77 minutes a person must spend.
Where the hours go
On a small RDFI that also sends a little ACH, most hours go on reading and checking received credits, and the second-largest share on reaching the other bank. The split below is for an illustrative institution receiving 3,000 credits and sending 500 entries a banking day, at the same assumptions.
Where an estimated 97 hours a month go at a small RDFI working its flags by hand
Illustrative institution: 3,000 credits received and 500 entries sent a banking day
- Received credits: reading, history, deciding, notices, second check · 62%
- Contacts with the other bank · 22%
- Sent entries · 5%
- Program upkeep and the annual review · 11%
With agents doing the reading, the history check, the request to the other bank and the draft, the solution's own estimate brings a received flag from 77 working minutes to 14, of which 4 are the decision itself, unchanged. On the illustrative institution that is about 27 hours a month instead of 97, if the fixed program work stays the same; the decision and the second person's check remain human work, as they should. These are estimates, not measured results.
The day's flags in ACH Fraud Monitoring, ordered by who must act and by the money clock
What happens if a bank does not comply with Nacha?
Nacha's enforcement applies, and the larger cost is the fraud the bank failed to stop. Nacha's rules compliance process works "through a formal system of warnings and fines" and lets financial institutions report violations and seek arbitration (Nacha, ACH Rules Compliance); every institution's annual rules compliance audit is also expected to cover all relevant rules. Fine amounts are set in the rulebook, which this guide does not reproduce.
The monitoring rules do not shift liability between banks, and Nacha says so: they disclaim any change to UCC Article 4A rights and any duty beyond the commitment to Nacha (Phase 2 FAQ). The money at stake is therefore the bank's own and its customers': losses on credits it let customers spend, the work of chasing them, and the regulatory questions that follow. The OCC's fraud principles warn that "the true cost of fraud is greater than the direct financial loss, given the time and expense to investigate, loss of productivity, potential legal and compliance costs associated with remediation, and impact on a bank's reputation" (OCC Bulletin 2019-37).
Cutting the cost without cutting the monitoring
Draw the higher-risk set narrowly, buy or share the routine work, and spend people's minutes on decisions. Nacha's rules allow each of these.
First, tiering. Nacha lets an RDFI leave out activity it has assessed as very low risk, once a risk assessment has separated it from the rest. Payroll from an employer that has paid the same account for years is a candidate; the same payroll to a new account is not.
Second, the new description. Since March 20, 2026 originators must put "PAYROLL" in the company entry description of wage credits, so an RDFI can see new or repeated payroll into an account without guessing (Nacha, Company Entry Descriptions). A rule that reads it costs almost nothing to run.
Third, early availability. Nacha's advisory group suggests offering early funds only to seasoned accounts and capping it, for example "the first $500" per entry (RMAG, November 2022). Fewer credits spendable before settlement means fewer that must be decided before 9:00 a.m.
Fourth, help. Nacha's FAQ confirms an RDFI may use a third-party service provider to carry out its obligations; the duty and the annual review stay with the institution. Its fintech partners are the other side of that: their customers' accounts are the bank's receiving accounts, and their monitoring has to be tested, not assumed.
A fintech partner's monitoring in ACH Fraud Monitoring, attested and tested, with a gap found and a restriction prepared
For a small team the choice is less whether to buy software than which hours to stop spending by hand. A go-live plan for ACH fraud detection software sets out what a rollout takes, and the 2026 rules in full list every date and duty. To see the work queue and the partner checks together, start from ACH Fraud Monitoring.
Questions people ask
Did Nacha phase 2 apply to credit unions?
Yes. Phase 2 covered all RDFIs below the Phase 1 threshold, and credit unions that receive ACH credits are RDFIs. With 4,214 federally insured credit unions at mid-2026, 2,438 of them under $100 million in assets, credit unions are a large share of the institutions Phase 2 reached.
Is there a size exemption from Nacha fraud monitoring?
No. The 10 million and 6 million thresholds only decided who started in Phase 1; Phase 2 removed them. A small institution's relief is that the rule is risk-based, so its program can be as narrow as its risk assessment honestly allows.
Do small RDFIs need to buy fraud monitoring software?
The rule does not require any system, and Nacha's resource center describes the rules as neutral about methods and technologies. Whether software pays depends on the flag volume: on our estimate, a few flags a day worked by hand already costs a large part of one person's month.
What did phase 1 cover that phase 2 did not?
Phase 1, from March 20, 2026, covered all ODFIs, RDFIs that received 10 million or more ACH entries in 2023, and non-consumer originators and third parties with 6 million or more originations in 2023. Phase 2 extended the same duties to every remaining RDFI, originator and third party.
When is the first annual review due under phase 2?
Nacha requires a review "at least annually" without naming a date. A program in force from June 22, 2026 should be reviewed within a year of that date at the latest; an institution may find it convenient to align it with its annual ACH rules compliance audit, which must be completed by December 31.