Verifying a Vendor Bank Account Before the First ACH Payment: What Nacha Says About Micro-Entries

This article is general educational information about published Nacha materials. It is not legal, financial, tax, or compliance advice, and it does not recommend any product or provider. Rules and your bank’s requirements can change, so confirm details with your financial institution, processor, or counsel.

Before a business sends its first ACH payment to a new vendor, someone has to confirm that the routing and account numbers on the form actually belong to that vendor. Mistakes here are expensive in a quiet way: a payment can be returned, delayed, or sent to the wrong party. Vendor bank details are also a favorite target of impersonation schemes, a topic we covered in Business Email Compromise and B2B Payments in 2026.

One widely used way to check an account is the Micro-Entry: a few tiny ACH transactions sent to the account for validation. Nacha, which writes the ACH rules, has defined what a Micro-Entry is and what an originator must do when using one. This post walks through what Nacha’s own pages say, where the rules stop, and what questions a finance team might bring to its bank.

What a Micro-Entry is

In its announcement of the rule, Nacha describes Micro-Entries as being used for account validation. It gives the familiar setup in which a financial institution sends two small ACH credits, followed by one debit that pulls back the total amount. Providers commonly then ask the account holder to confirm the amounts, though that step is a provider design choice that Nacha’s article does not specify.

Nacha’s article on the adopted rule sets out these requirements:

• Each Micro-Entry credit must be less than $1.
• Any debits cannot exceed the total value of the credits.
• Credits and debits must be transmitted to settle at the same time.
• The company entry description must read “ACCTVERIFY.”
• The company name must be easily recognizable to consumers and the same as, or similar to, the name that will appear on future ACH entries from that company.

The effective dates

According to the same Nacha article, the rule took effect in two phases. Phase one, on September 16, 2022, defined Micro-Entries and made the “ACCTVERIFY” description required. Phase two, on March 17, 2023, added fraud detection and volume monitoring requirements. Both dates are in the past, so a business that uses Micro-Entries today, directly or through a bank or software provider, is operating under both phases.

The fraud-detection requirement

The phase two language is worth reading closely. Nacha states that Micro-Entry Originators must use commercially reasonable fraud detection, including volume monitoring, and that originating banks (ODFIs) must watch for significant changes or fluctuations in the number of Micro-Entries they send.

Nacha’s risk management page for the fraud monitoring rules repeats the point in a broader context. It says that the current Rules require Originators to use a commercially reasonable fraudulent transaction detection system for WEB debits and Micro-Entries, and that these existing requirements do not encompass other transaction types. The page also notes that the newer monitoring rules have less impact on organizations that already run a monitoring system for WEB debits or Micro-Entries.

The word “commercially reasonable” is not defined with a number in the sources we reviewed, and we did not find a specific return-rate threshold or a required order of credits and debits in Nacha’s announcement. Anyone building a validation process should ask their bank what it expects rather than assume a figure.

How this connects to the 2026 monitoring rules

Separate from Micro-Entries, Nacha has phased in broader risk-based fraud monitoring requirements. Per Nacha’s page, Phase 1 took effect March 20, 2026, for all ODFIs and for non-consumer Originators, third-party service providers, and third-party senders whose 2023 annual ACH origination volume was 6 million or greater. Phase 2 applies to the remaining non-consumer Originators and related parties. Because June 19, 2026 is a federal holiday, Nacha’s page gives Monday, June 22, 2026 as the practical date. For a plain-language overview, see our earlier post on Nacha fraud monitoring rules for B2B ACH originators.

That same Nacha page defines “False Pretenses” as the inducement of a payment by a person misrepresenting their identity, and says the definition covers common scenarios such as business email compromise, vendor impersonation, and payroll impersonation. A bank-account check does not by itself prove that a vendor is who it says it is, so many finance teams pair account validation with a separate identity check, such as calling a known contact at a number already on file.

What a Micro-Entry check does and does not show

Based on how Nacha describes the mechanism, a Micro-Entry test shows that the account exists and that the person who completed the check could see the small transactions. Nacha’s article does not say that it confirms the legal name on the account, the signer’s authority, or the vendor’s identity, and we would not read that into it. Those are separate questions that a bank, a validation service, or an internal procedure may answer in other ways.

Some practical limits follow from the text itself:

• Timing. Because the credits and debits must settle at the same time, the test is not instant. The article does not give a settlement schedule, so ask your bank or processor how long its process takes.
• Naming. The “ACCTVERIFY” description and a recognizable company name exist so that the recipient can tell the entries apart from unexplained activity. If your vendor sees an unfamiliar company name, the check may be mistaken for a problem.
• Volume. Nacha’s monitoring language is about changes or fluctuations in how many Micro-Entries are sent. Unusual spikes are the kind of pattern that draws attention.

Questions a finance team may want to ask its bank

These are discussion prompts, not a compliance checklist, and your own bank or counsel may frame them differently:

1. Does the bank or payment platform support Micro-Entries, or does it use another account validation method?
2. How does the bank describe its own fraud detection and volume monitoring for Micro-Entries, and what does it ask of the business?
3. What company name will appear on the entries, and does it match what will appear on later payments?
4. How are failed or returned validation entries reported back, and who in the business sees them?
5. How does the process fit with internal vendor-change controls, such as a second reviewer or a call-back to a known contact?
6. For businesses that are Originators, which phase of the 2026 monitoring rules applies, and what does the bank want documented?

Nacha also maintains an Account Validation Resource Center, which its risk management page links to for readers who want to explore validation methods beyond Micro-Entries.

A note on related payment types

Micro-Entries are only part of the picture. Payments between businesses often travel as CCD entries, which carry their own authorization and return-window considerations. Our overview of ACH debits between businesses covers those topics, and the sources there are separate from the ones used in this post.

Key takeaways

• Nacha defines Micro-Entries as small ACH transactions used for account validation, with each credit under $1 and any debit no larger than the credits’ total.
• The entries must settle at the same time and carry the “ACCTVERIFY” description.
• Since March 17, 2023, Originators using Micro-Entries must apply commercially reasonable fraud detection, including volume monitoring.
• A Micro-Entry check, as Nacha describes it, is not a substitute for confirming a vendor’s identity through a separate, trusted channel.

Sources

• Nacha, New Nacha Rule on Micro-Entries Adopted
• Nacha, Risk Management Topics: Fraud Monitoring Phase 2

Disclaimer: Bridge Capital Partners provides general information about payment processing. Nothing in this article is legal, financial, tax, or compliance advice or an offer to provide any service. Consult your bank, processor, or qualified professional about your specific situation.