The Nacha fraud monitoring rules 2026 require every ODFI, every RDFI, and every non-consumer originator, third-party sender and third-party service provider in the ACH Network to establish risk-based processes and procedures "reasonably intended to identify" ACH entries suspected of being unauthorized or authorized under false pretenses, to handle the ones they find, and to review those processes at least once a year. Phase 1 took effect on March 20, 2026 for all ODFIs and for the largest receivers and originators; Phase 2 followed on June 19, 2026, a federal holiday, so in practice Monday, June 22, for everyone else. The rules describe outcomes, not methods, which is what makes them hard to apply: each bank must decide and document what "reasonably intended" means for its own business. Botminds' ACH Fraud Monitoring shows each flagged entry beside the rule it answers, on the side of the bank that sent or received it.
This guide quotes only Nacha's free public rule pages and federal sources; the licensed Nacha Operating Rules remain the authority on exact wording. Screens show a fictional sample bank.
The Nacha fraud rules, in force one step at a time from October 2024, and the first annual reviews they require
- False pretenses, R17, R06, exemptionOct 1, 2024
- RDFI answers R06 within 10 banking daysApr 1, 2025
- Phase 1Mar 20
- Phase 2Jun 22
- 9:00 a.m. funds; first annual reviews fall dueSep 18, 2026
What are the Nacha fraud monitoring rules?
Two amendments to the Nacha Operating Rules, one for the parties that send ACH entries and one for the banks that receive them. The sending-side rule requires each ODFI, non-consumer originator, third-party sender and third-party service provider to "establish and implement risk-based processes and procedures, relevant to the role it plays in the authorization or Transmission of Entries, that are reasonably intended to identify Entries that are suspected of being unauthorized or authorized under False Pretenses" and to review them at least once a year, updating them as the risks change (Nacha, Fraud Monitoring Phase 2 FAQ).
The receiving-side rule requires each RDFI to establish risk-based processes for the credits it receives; they "should be reasonably intended to identify credit Entries suspected of being unauthorized or authorized under False Pretenses, and also should include the handling of such credit Entries identified as potentially unauthorized or authorized under False Pretenses". It is the first time the rules have given receiving banks a fraud duty of their own.
Both belong to a larger package. Nacha calls it a risk management set "intended to reduce the incidence of successful fraud attempts and improve the recovery of funds after frauds have occurred", and its pieces arrived over two years, as the timeline shows. Read together they follow a credit-push payment from the business that sends it to the account that receives it.
When do the Nacha 2026 rules take effect?
Both phases are already in force. Phase 1 took effect on March 20, 2026, and Phase 2 on June 19, 2026, with Nacha naming Monday, June 22 as the practical date because June 19 was a federal holiday (Nacha). Nacha's announcement on March 20 said that once both were in place, "everyone using the ACH Network (except consumers) will be contributing to risk management through risk‑based processes and procedures reasonably intended to identify fraudulent ACH activity" (Nacha, March 20, 2026).
Two related changes landed alongside. From March 20, 2026, originators must use the company entry description "PAYROLL" for wage credits and "PURCHASE" for consumer e-commerce debits (Nacha, Company Entry Descriptions). From September 18, 2026, every non-Same Day credit must be available by 9:00 a.m. local time on settlement date, with the old 5:00 p.m. receipt condition removed (Nacha, funds availability rule). The first helps monitoring; the second shortens the time it has.
Who must comply with Nacha fraud monitoring?
Every ACH participant except consumers, each for its own role. The phases decided only who started first.
Who the 2026 fraud monitoring rules cover, by phase
| Party | Phase 1, March 20, 2026 | Phase 2, June 19 (June 22), 2026 | What it must do |
|---|---|---|---|
| ODFI | All, regardless of size | Already covered | Risk-based processes to identify suspect entries it originates, relevant to its role; review at least annually |
| Non-consumer originator | Annual ACH origination volume of 6 million or greater in 2023 | All others | The same, for its own entries; Nacha's example is change controls on vendor and payroll payment details |
| Third-party sender or service provider | Annual origination or transmission volume of 6 million or greater in 2023 | All others | The same, for the functions it performs; Nacha's example is review of volume, velocity, amounts and SEC codes |
| RDFI | Annual ACH receipt volume of 10 million or greater in 2023 | All others, regardless of volume | Risk-based processes to identify suspect credits it receives, and to handle them; review at least annually |
| Consumer | Not covered | Not covered | Nothing under these rules |
Two details trip readers up. An ODFI may take into account what other originating parties do, provided the reliance has a reasonable and clear basis, such as a contract and oversight that checks it. And nothing the sending side does reduces the RDFI's duty: Nacha's FAQ says plainly that the originating parties' monitoring leaves the RDFI's own credit monitoring obligation untouched.
What does “reasonably intended to identify” mean?
It means a process designed, on the bank's own risk assessment, to catch the suspect entries that matter, not a guarantee of catching every one and not a particular system. Nacha changed the wording from its 2023 proposal on purpose, and the changes are the best guide to its meaning.
From the 2023 proposal to the 2026 rule: what Nacha changed, and what each change means for a bank
What Nacha's rule page says changed: Eliminates use of "commercially reasonable" as a standard
What it means in practice: No external yardstick of what other banks do; the bank's own documented risk assessment is the measure
What Nacha's rule page says changed: Replaces "detection system" with "processes and procedures"
What it means in practice: A written procedure with people in it can comply; software is a choice, not a requirement
What Nacha's rule page says changed: Provides a next level description of requirements, i.e. "reasonably intended to identify…"
What it means in practice: Designed to find the suspect entries the assessment identifies, not every possible fraud
What Nacha's rule page says changed: Provides that the requirements apply "to the extent relevant to the role the entity plays"
What it means in practice: A third-party sender watches its files; an RDFI watches its accounts; neither does the other's job
What Nacha's rule page says changed: Allows an ODFI to expressly consider steps that other participants in origination are taking
What it means in practice: An ODFI can lean on a processor's or originator's controls, if the reliance is contracted and verified
What Nacha's rule page says changed: Clarifies that monitoring is not required pre-processing
What it means in practice: Monitoring after processing complies; monitoring before is what lets a bank stop or hold
What Nacha's rule page says changed: Requires a review of processes and procedures "at least annually"
What it means in practice: The program is judged on whether it changes with the frauds, year by year
There is one floor. A risk-based approach lets a bank go lightly on low-risk activity, but Nacha draws a line under it.
A risk-based approach should not be used, however, to conclude that no monitoring is necessary at all. At a minimum, an entity applying a risk-based approach should conduct a risk assessment to identify and differentiate higher-risk from lower-risk transactions.
Nacha, Fraud Monitoring Phase 2, FAQ
Do the Nacha rules require automated monitoring?
No. The rules require processes and procedures, not a system, and Nacha removed the earlier proposal's reference to a "detection system". The FAQ also answers "No" to whether parties must screen every entry individually, and says monitoring before processing is not required.
For debits, Nacha names a minimum that most banks already run: "a robust return and return rate monitoring program in conformance with existing Rules (as well as any required compliance with other specific fraud detection Rules for WEB debits and Micro-Entries) is sufficient as a minimum level of fraud monitoring" (Phase 2 FAQ). For credits there is no such floor, which is where automation earns its place. Whether a person can read every flagged credit before 9:00 a.m. is a question of volume, not of law; why a client's debit filter does not answer it is covered separately.
What the 2026 rules require at a minimum, in Nacha's own terms
- A risk assessment
One that identifies and differentiates higher-risk from lower-risk transactions. No risk-based program without it.
- Processes and procedures, relevant to the role
Reasonably intended to identify entries suspected of being unauthorized or authorized under false pretenses.
- Handling, for RDFIs
Procedures that cover what happens to a flagged credit: hold, contact the ODFI, return or release.
- A review at least annually
With updates to address evolving risks; more often if the bank's circumstances call for it.
- For debits sent, return monitoring
A robust return and return-rate program, plus the existing WEB debit and Micro-Entry fraud detection rules.
- Not required
A specific system, screening every entry individually, or monitoring before processing.
What changed between phase 1 and phase 2?
Only who was covered. Phase 1 applied the rules to all ODFIs, to RDFIs that received 10 million or more ACH entries in 2023, and to non-consumer originators, third-party senders and service providers with 6 million or more in 2023. Phase 2 removed the volume thresholds, so the rules apply to all of them however much they send or receive (Nacha). The duties, the FAQ answers and the annual review are the same.
The burden is not the same, because Phase 2 reached the institutions with the fewest people. What Phase 2 costs a small RDFI estimates the hours by size.
Does Nacha fraud monitoring apply to consumers?
No. The originator rule applies to non-consumer originators, and Nacha's March 2026 announcement describes the finished state as everyone using the network "except consumers". Consumers keep their existing protections, which come from federal law rather than these rules: for an unauthorized debit from a consumer account, Regulation E's error resolution and liability limits apply (12 CFR 1005.6), and a consumer's bank can return it as unauthorized within the extended return window.
What the rules do protect consumers from is being the mule. A consumer account receiving a corporate credit, several payrolls in other names, or a large credit days after opening is exactly what Nacha tells RDFIs to look at; the customer is often a victim recruited to receive and forward the money. In the Federal Reserve's 2026 risk officer survey, about two-thirds of the institutions asked had seen mule accounts belonging to legitimate customers who had been deceived (Federal Reserve Financial Services, 2026).
Every flag in ACH Fraud Monitoring joined to the Nacha rule it answers
The tools that came first: R17, R06 and the funds exemption
The 2026 monitoring duties rest on tools Nacha put in place on October 1, 2024. That package defined "False Pretenses"; let an RDFI use return code R17 with the word QUESTIONABLE for an entry "that it thinks is fraudulent", explicitly allowed but not required; let an ODFI request a return under R06 "for any reason", with an indemnity; and gave RDFIs an exemption from funds availability for credits they suspect were sent under false pretenses (Nacha, October 1, 2024). From April 1, 2025 an RDFI must answer an ODFI's R06 request within ten banking days.
The October 2024 package also tightened debits: an RDFI returning a consumer debit as unauthorized in the extended window must do so by the opening of the sixth banking day after it finishes reviewing the customer's signed statement. What false pretenses covers and excludes is the definition the 2026 rules lean on.
ACH Fraud Monitoring's program screen: the rule dates, both phases, and the bank's own rules under them
What the rules leave alone
Liability, federal law and the other bank's duties. Nacha's FAQ says the monitoring rules carry "Express disclaimers of modification of Uniform Commercial Code (UCC) Article 4A rights and obligations, and of the creation of any duty other than the commitment to Nacha to comply with the Rules", so Nacha can enforce them "without upsetting the allocation of liability among Nacha participants under otherwise applicable law" (Phase 2 FAQ). Monitoring badly is a breach of the Nacha rules; whether it also leaves a bank liable for a customer's loss is decided by the law and agreements that applied before.
Federal funds availability law stays too. When Nacha created the false pretenses exemption it noted that "RDFIs are still subject to requirements under Regulation CC for funds availability" (Nacha), which for an electronic payment means availability by the business day after the banking day the bank received it (12 CFR 229.10(b)). And enforcement runs through Nacha's own system, not a regulator's: violations can be reported by a participating financial institution and are handled through warnings and fines (Nacha).
The rules land on a real problem. In the Federal Reserve's 2026 risk officer survey, 41% of institutions said ACH account holder scams were increasing (Federal Reserve Financial Services, 2026; not independent academic research, margin of error ±6%). To see each flag mapped to its rule on a bank's own files, start from ACH Fraud Monitoring.
Questions people ask
Are the Nacha rules mandatory?
For participants in the ACH Network, yes. Nacha describes the rules as defining "the roles and responsibilities of financial institutions" and each network participant, and enforces them through a formal system of warnings and fines. They are private network rules, not federal regulation, though the OCC expects banks' ACH compliance reviews to test against "NACHA and other network rules".
Where can I read the Nacha fraud monitoring rules?
Nacha publishes summaries, technical notes and FAQs for each rule free on its website, including the Phase 1 and Phase 2 pages and the October 1, 2024 risk management page. The full rule text is in the licensed Nacha Operating Rules, which anyone can buy.
Do the rules require a bank to call the other bank?
Not as such; they require handling procedures. But an RDFI using the funds availability exemption is required to contact the ODFI to tell it, and every ODFI and RDFI must keep ACH operations and risk or fraud contacts in Nacha's ACH Contact Registry.
Does the 2026 rule apply to Same Day ACH?
Nacha's rule pages describe the monitoring duty for ACH entries generally and list no exception for Same Day entries. The September 18, 2026 funds availability change is the one that treats them differently: its 9:00 a.m. requirement covers non-Same Day credits, while Same Day credits are governed by their own availability requirements.
What is the next Nacha rule change after the fraud monitoring rules?
On Nacha's published calendar: IAT contacts in the ACH Contact Registry and a defined character set on January 1, 2027; IAT changes on March 19, 2027; a $10 million Same Day ACH limit on September 17, 2027; and a new return code, R90, for sanctions compliance on March 17, 2028.