Nacha Fraud Monitoring Rules in 2026: What Phase 1 and Phase 2 Mean for B2B ACH Originators

Business payments teams that send ACH credits for payroll, vendor payments or refunds now work under Nacha fraud monitoring requirements that took effect in 2026. Nacha’s fraud monitoring amendments took effect in two phases during 2026, and both phases are now in force. This article summarizes what Nacha’s own rule pages say, what the rule does and does not require, and which questions are reasonable to ask your bank or payment provider. It is informational only.

What the rule is

Nacha describes the fraud monitoring amendments as part of a larger risk management package “intended to reduce the incidence of successful fraud attempts and improve the recovery of funds after frauds have occurred.” According to Nacha, the rule requires each ODFI, non-consumer Originator, Third-Party Sender and Third-Party Service Provider that performs ACH processing functions to establish and implement risk-based processes and procedures “relevant to the role it plays in the authorization or Transmission of Entries” that are reasonably intended to identify Entries suspected of being unauthorized or authorized under False Pretenses. The same parties must review those processes and procedures at least annually and update them to address evolving risks.

Before this change, Nacha notes, the rules only required Originators to use a commercially reasonable fraudulent transaction detection system to screen WEB debits and to screen Micro-Entries. The new language is broader and reaches other transaction types, including ACH credits, which is the payment type most associated with business email compromise and payroll redirection.

The two phases

Nacha’s rule page lists two effective dates:

• Phase 1, March 20, 2026: applies to all ODFIs, and to non-consumer Originators, Third-Party Service Providers and Third-Party Senders whose annual ACH origination or transmission volume in 2023 was 6 million entries or greater.
• Phase 2, June 19, 2026: removes the volume threshold, so all other non-consumer Originators, Third-Party Service Providers and Third-Party Senders are covered.

On the receiving side, Nacha says an RDFI-focused companion rule requires RDFIs to implement risk-based processes intended to identify credit Entries initiated due to fraud, with Phase 1 applying to RDFIs with annual ACH receipt volume of 10 million or greater in 2023 and Phase 2 (also June 19, 2026) covering all other RDFIs. Nacha also states that processes implemented by RDFIs do not change the obligations of originating participants. In practical terms, a business that originates ACH payments should not assume the receiving bank’s monitoring satisfies its own obligation.

What “False Pretenses” covers

The rules introduce a defined term, False Pretenses: the inducement of a payment by a person misrepresenting that person’s identity, that person’s association with or authority to act for another person, or the ownership of an account to be credited. Nacha says this definition covers common scenarios such as business email compromise, vendor impersonation, payroll impersonation and other payee impersonation, and that it complements language on unauthorized credits, which covers account takeover. Nacha also states that it does not cover scams involving fake, non-existent or poor-quality goods or services.

That distinction matters for scoping. The rule is aimed at payments induced by impersonation or account misuse, not at every type of commercial dispute. For background on how impersonation fraud typically unfolds in vendor payments, see our article on business email compromise and vendor-change controls.

What the rule does not require

Nacha’s FAQ is explicit on several points that are easy to misread:

• The rules do not prescribe specific processes or technologies. Nacha’s credit-push fraud resource page describes the rules as neutral on methods and lists velocity checks, anomaly detection, behavioral tolerances and pattern recognition as possibilities.
• The rules do not require screening of every ACH entry individually.
• The rules do not require monitoring before entries are processed, although Nacha notes that pre-processing monitoring offers the greatest opportunity to detect and prevent fraud.
• A risk-based approach “should not be used” to conclude that no monitoring is necessary at all. At a minimum, Nacha says, an entity using a risk-based approach should conduct a risk assessment to differentiate higher-risk from lower-risk transactions.

What this looks like for different roles

Nacha’s FAQ gives examples of how appropriate procedures vary by role. It says Originators may be best placed to protect against account takeover and other ways of initiating unauthorized transactions, and that such procedures could include change controls on payment information and instructions for vendor and payroll payments. It says Third-Party Senders and Third-Party Service Providers may review the volume, velocity, dollar amounts and SEC Codes of the entries they originate.

Nacha also states that an ODFI’s processes may take into account the processes of other participants in the origination chain, and that the basis for relying on another party should be reasonable and clear, for example allocated by contract and verified by appropriate oversight. For a business that sends ACH through a bank or processor, this is the reason the division of responsibility is worth clarifying in writing.

Control examples from Nacha’s payroll checklist

Nacha has published a sample electronic payroll origination checklist. Its steps include authenticating the requestor when adding or updating a payee, confirming any change request through a separate channel using known contact information, verifying the payee’s account and routing numbers before the first payment, obtaining approval, and requiring a second person to confirm and release the transaction. Nacha describes the last two steps as “dual control” and says the checklist could apply to any push payment channel. Nacha adds that some practitioners advise treating any request to change account information as an attempt to commit fraud.

These are examples of published practices, not requirements of the rule. Nacha’s April 2026 guidance on the rules also says they are not intended to be a one-time compliance exercise, and that risk profiles change with new products, evolving fraud schemes, customer behavior and technology, which is why the rule includes the annual review.

How this connects to recall and recovery

Monitoring is about detecting suspect payments; recovery after the fact is a separate and more limited process. Our article on ACH reversals, wire recalls and payment finality covers what is generally available once a payment has gone out, and our piece on positive pay and check fraud covers the equivalent bank-side control for paper checks.

Questions to ask your bank or processor

• Which phase applies to our organization, and how does the bank or processor treat us for purposes of the rule?
• Which fraud monitoring steps does the bank or processor perform on our ACH credit files, and which are our responsibility?
• Is any reliance on another party’s monitoring documented by contract?
• How are payee and bank-account changes authenticated and confirmed before the first payment?
• Is dual approval available for ACH credit batches, and is it switched on?
• When a payment is flagged, who is contacted, how quickly, and what happens to the entry?
• How often are the monitoring procedures reviewed, and who owns that review?

Where a merchant account broker fits

Bridge Capital Partners helps businesses compare merchant account and payment processing options. When comparing ACH or combined card and ACH providers, it is reasonable to ask how the provider handles fraud monitoring responsibilities under the Nacha rules, as described above. For a broader view of 2026 ACH obligations, see our quick-start guide to 2026 Nacha compliance.

Sources

• Nacha, Risk Management Topics (Fraud Monitoring Phase 1) (checked 14 October 2026)
• Nacha, Credit-Push Fraud Monitoring Resource Center (checked 14 October 2026)
• Nacha, A Checklist Approach to Reduce Fraud in Payroll Origination (checked 14 October 2026)
• Nacha, Next Steps for the New Nacha Risk Management Rules (checked 14 October 2026)

This content is for general informational purposes only and is not financial, legal, tax or investment advice. Payment rules, fraud patterns and bank practices change, so consult your bank, payment provider or a qualified professional about your specific situation.