Nacha’s fraud monitoring rules now apply to almost every business and bank that touches the US ACH Network. Phase 1 took effect on 20 March 2026 for all originating banks and for the largest originators and processors, and Phase 2 removed the volume thresholds on 19 June 2026, with a practical compliance date of 22 June because 19 June is a federal holiday, according to Nacha’s Phase 2 rule summary.
The rules shift ACH risk management away from a narrow focus on unauthorised debits and towards credit-push fraud, where a legitimate account holder is tricked into sending money. For the first time, receiving banks share that monitoring duty.
Why Nacha rewrote its rules around credit-push fraud
Nacha, the body that writes the operating rules for the ACH Network, published its “Risk Management Framework for the Era of Credit-Push Fraud” in 2022. In its announcement that the rules were in effect, Nacha said the framework had found that “the most significant fraud threats to bank account holders” now involve “fraud and scams that result in money being sent out of their accounts using credit payments, including ACH credits, wires, cards, and other instant and digital payments.”
The old rulebook did not reflect that. Before 2026, the Nacha Rules only required originators to use a “commercially reasonable” fraudulent transaction detection system to screen WEB debits (consumer debits authorised online) and Micro-Entries. Other debits, and any credit other than a Micro-Entry, carried no specific fraud screening obligation. The new rules close that gap by covering credits as well as debits, and by adding the receiving side of the payment.
Who the Nacha fraud monitoring rules cover, and when
The rules were phased by 2023 ACH volume. Consumers are the only ACH users outside their scope. The table below sets out the two phases as described in Nacha’s Phase 1 rule summary and the Phase 2 summary.
| Participant | Phase 1: 20 March 2026 | Phase 2: 19 June 2026 (practically 22 June) |
|---|---|---|
| ODFIs (originating banks) | All, regardless of size | Already covered |
| Non-consumer originators, Third-Party Senders and Third-Party Service Providers | Those with 2023 ACH origination volume of 6 million entries or more | All remaining, regardless of volume |
| RDFIs (receiving banks) | Those with 2023 ACH receipt volume of 10 million entries or more | All remaining, regardless of volume |
Phase 2 brought smaller fintech platforms, payroll providers and community banks acting as RDFIs into scope.
False Pretenses: the definition that widens the net
The rules introduce a defined term, False Pretenses: “the inducement of a payment by a Person misrepresenting (a) that Person’s identity, (b) that Person’s association with or authority to act on behalf of another Person, or (c) the ownership of an account to be credited.”
Nacha says this covers business email compromise, vendor impersonation, payroll impersonation and other payee impersonations, and complements existing language on unauthorised credits, which captures account takeover. The practical consequence is that a payment can be fully authorised by the account holder and still fall within scope, because the authorisation was obtained by deception. Monitoring only for unauthorised activity is therefore not enough.
The definition has a clear boundary. Nacha states that it does not cover scams involving fake, non-existent or poor-quality goods or services. A purchase scam is outside the rule; a fraudster posing as a supplier with new bank details is inside it.
What originators, processors and ODFIs must do
Each ODFI, non-consumer originator, Third-Party Sender and Third-Party Service Provider must do two things, according to Nacha’s FAQs:
- Establish and implement risk-based processes and procedures, relevant to the role it plays, that are reasonably intended to identify entries suspected of being unauthorised or authorised under False Pretenses.
- Review those processes and procedures at least annually and update them to address evolving risks.
The final rule softened the original May 2023 proposal. It dropped the “commercially reasonable” standard, replaced “detection system” with “processes and procedures”, and clarified that monitoring does not have to happen before processing. Nacha also confirms that the rules do not require every entry to be screened individually.
What “risk-based” looks like in practice
Nacha gives examples by role. Originators may be best placed to guard against account takeover through change controls on payment instructions for vendors and payroll. Third-Party Senders and Service Providers may review the volume, velocity, dollar amounts and Standard Entry Class (SEC) codes of the entries they originate. ODFIs may rely on monitoring performed by other originating participants, but Nacha says that reliance should be “reasonable and clear”, for example allocated by contract and verified by oversight.
A risk-based approach cannot be used to conclude that no monitoring is needed. At a minimum, Nacha expects a risk assessment that separates higher-risk from lower-risk transactions. For debits, a robust return and return-rate monitoring programme, alongside the existing WEB debit and Micro-Entry rules, is enough as a minimum.
RDFI credit monitoring: the receiving bank joins the defence
The most novel element is the obligation on RDFIs. “What’s particularly noteworthy is that for the first time, RDFIs have a role to play, alongside ODFIs, Originators and third parties,” said Devon Marsh, Nacha Managing Director, ACH Network Rules and Risk Management, in the March announcement. “Because of the way credit-push frauds work, financial institutions on both sides of a payment need to be part of the monitoring solution.”
Each RDFI must have risk-based processes reasonably intended to identify incoming credits suspected of being unauthorised or authorised under False Pretenses, including how such credits are handled. Nacha points to red flags that an RDFI can see even without knowing how a payment was initiated:
- an SEC code that does not match the receiving account type, such as a corporate CCD entry into a consumer account;
- a high-dollar credit that is atypical for the account;
- a series of similar credits in a short period, such as several payroll or benefit payments;
- any of the above arriving in a new, dormant or suspected mule account.
Nacha says this aligns with existing AML transaction monitoring, which ties the work to the same alerts that can feed a suspicious activity report. Pre-posting monitoring is not required, but an RDFI that does monitor before posting may use the voluntary exemption from funds availability requirements to investigate. If it decides to send funds back, it can return the entry with reason code R17 “QUESTIONABLE” or, at the ODFI’s request, R06.
Liability stays where it was
The rules create a compliance obligation to Nacha, not a new route to compensation. Nacha’s FAQs state that the requirements do not impose a duty to prevent wrongful activity and do not change the allocation of liability between parties. The rules expressly disclaim any change to Uniform Commercial Code Article 4A rights and obligations.
That is a material contrast with the UK, where mandatory reimbursement for authorised push payment fraud shifts losses onto payment firms. Fintechly has examined how the UK APP reimbursement regime is working. In the US ACH context, a customer who is tricked into paying a fraudster gains no automatic refund right from these rules.
Nacha fraud monitoring rules FAQs
Does a small fintech originator below 6 million entries need a fraud monitoring programme?
Yes. Phase 2, effective 19 June 2026 with a practical date of 22 June 2026, removed the volume threshold for all non-consumer originators, Third-Party Senders and Third-Party Service Providers. The programme must be risk-based and proportionate to the firm’s role, but Nacha states that a risk-based approach cannot conclude that no monitoring is needed.
Do we have to screen every ACH entry before it is sent?
No. Nacha confirms that the rules do not require every entry to be screened individually and do not require monitoring before processing. Nacha does note that pre-processing monitoring gives the best chance of stopping fraud.
Is a purchase scam covered by the False Pretenses definition?
No. Nacha says the definition does not cover scams involving fake, non-existent or poor-quality goods or services. It covers misrepresentation of identity, of authority to act for another person, or of ownership of the account being credited, such as business email compromise and vendor or payroll impersonation.
How often must ACH fraud monitoring procedures be reviewed?
At least annually, for every covered party including RDFIs. Nacha says participants may decide that more frequent reviews are appropriate based on their circumstances. For firms that came into scope in March or June 2026, the first annual review falls due during 2027.
Can an RDFI outsource its credit monitoring to a vendor?
Yes. Nacha states that the rule does not alter an RDFI’s ability to use a Third-Party Service Provider to carry out its obligations. The RDFI’s own obligation is not reduced by any monitoring done on the originating side of the payment.
Do the rules make banks liable for customer losses from scams?
No. Nacha’s FAQs state that the requirements do not create a duty to prevent wrongful activity and do not change the allocation of liability between parties. They expressly disclaim any modification of UCC Article 4A rights and obligations.
For banks, the rules turn ACH credit monitoring into a documented, examinable discipline that should sit alongside AML alerting rather than in a separate silo. For fintechs, payroll platforms and payment processors, the immediate task is evidence: a written risk assessment, controls mapped to False Pretenses scenarios such as changed vendor bank details, and a dated record of the first annual review. For context on how ACH compares with other rails, see Fintechly’s guide to the movement of money between accounts, and its analysis of account takeover fraud at US banks.
