Posted: November 02, 2026
Release of Nacha’s 2025 year-end report (January 2026) documented over 35.2 billion ACH payments and a volume of $93 trillion. ACH payments include wage and vendor payments, rent and utility payments, and online shopping payments, to name a few.
Nacha sets the rules for this payments network, and for 2026, required financial institutions that send payments through the network to implement controls to manage certain payment frauds. Their objective is to prevent payment fraud and recover previously lost funds.
The majority of the effective dates for these rules have already passed. All financial institutions, regardless of their size, had to assess their payment fraud risk starting from June 22, 2026. Starting in March 2026, two of the payment fraud controls became effective. A third change (funds availability timing for ACH credits) became effective in September. Other, less significant, changes will occur in the next few years.
A summary of each NACHA rule change is provided below, along with the date the change becomes effective and the group of financial institutions that must implement the change. In addition, other implementation considerations are provided.
Five dates were set in 2026 by Nacha, the organization that governs the ACH network. The first was on Jan. 1. On that day, there were very minor wording changes to ACH rules and regulations. Those were anticipated to have a minimal impact on most ACH users, if any at all.
March 20 this year was the second and the largest of the five dates. Starting on that date, many participants, including sending banks and the largest processors, began performing fraud checks. There were also two labels associated with standard payments that became mandatory on that date.
The third and final larger of the five dates was on June 22, 2026. Beginning on that date, all processors, receiving banks and other sending businesses were required to perform fraud checks. On the first date set by Nacha for that requirement, which was on June 19, 2026, banks were closed for the Juneteenth federal holiday. Because of that, the practical deadline to meet that requirement moved to June 22, 2026.
Finally, two smaller changes occurred on July 24 and Sept. 18, 2026. The change on the former date allowed the U.S. Treasury’s Bureau of the Fiscal Service to be a part of Nacha’s service for fraud contact. The change on the latter date changed ACH payments to be made available by 9 a.m., the receiving bank’s local time. The change was anticipated to benefit clients of the ACH network the most. Also on that date, Nacha changed the language to define international payments.
Every ACH transaction is assigned a short text tag that is printed on a bank statement. As of March 20, two tags were mandated.
As of March 20, 2026, direct deposit of payroll and any other payroll payment will contain the tag “PAYROLL”. Bonuses, commissions, tips, and payroll contributions to an IRA or HSA will also carry the “PAYROLL” tag. Tagging of pensions, refunds, and payments to vendors will remain unchanged.
Payments made by a consumer to a shop for goods purchased online will be tagged as “PURCHASE”. Pay-later installments for goods purchased online will also be tagged as “PURCHASE”. Tagging for services will remain unchanged. Therefore, tags for telephone, internet and cable, and other services will remain unchanged. Similarly, tags for rental payments and insurance premiums will be unchanged.
There are no requirements for a financial institution to ensure that a sender uses the correct tag. It is the responsibility of the sender to use the correct tag.
A quick explanation is necessary for two terms. An originator is any company that initiates an ACH transfer, whether it is a collection or payment. An RDFI is the bank or credit union where the customer owning the account receives the funds.
The so-called “2026 Rule” requires originators to implement a process to monitor ACH transactions to help detect potentially suspicious activity. Such a process would be documented and evaluated at least annually. Payment processors, sending banks, and other originators are required to implement this process. Consumer originators are exempt from this requirement.
Covered parties were defined in two phases.
For the first phase, the definition hinged on the total number of ACH payments each party processed in 2023.
| Phase | Start date | Who had to comply |
| First Phase | March 20, 2026 | Every sending bank. Companies and processors that handled 6 million-plus ACH transfers during 2023. Receiving banks that took in 10 million-plus ACH transfers during 2023. |
| Second Phase | June 22, 2026 (originally June 19) | Every other sending company and processor, whatever its size. Every other receiving bank. |
Source: Nacha.org, Risk Management Topics rule pages (Phases 1 and 2).
Earlier versions of the ACH rules focused on unauthorized transfers. The rules published in 2026 address approved transfers made for “pretenses.” For this situation, Nacha coined the term “False Pretenses.”
False Pretenses applies to a situation in which a transfer is made as a result of one of the following three lies. The first lie is misrepresenting one’s identity. The second lie is misrepresenting one’s association with, or authority to act for, another person or company. The last lie is misrepresenting the ownership of the account receiving the funds.
Examples of each lie provided by Nacha include: an electronic communication purporting to be signed by a person’s supervisor, a forged or otherwise unauthorized sales invoice purporting to be issued by a seller, and a purported authorization to direct a transfer of a person’s salary to a different account. False Pretenses does not apply to a situation in which a person is induced to make a payment to a person purporting to represent a seller of a good or service but where no good or service is in fact provided.
No one expects firms to check transfers by hand. Firms are free to make their own assessments. It may be prudent to check higher risk transfers. Lower risk transfers may be assessed less stringently.
There are limits to this, of course. A firm may never conclude that it is sufficiently secure and cease monitoring altogether. Lean processes may still be used to monitor and assess transactions for risk.
As an example, Nacha states that a firm should treat requests by vendors or employees for changes to payment instructions (i.e. to a new bank account) as increased risk transactions, and scrutinize them accordingly.
In terms of collections, Nacha says that processes already in place to monitor and track collections that bounce should be treated as a “reasonable” process. Additionally, requirements relating to small test deposits and collections still apply.
Processors are permitted to recognize abnormal or anomalous patterns, such as a client suddenly increasing the number of transfers it requests, or transfers that are unusually large. A sending bank may rely on representations and warranties agreed to by a client (and processed by a third-party) to clear client transfers. Such agreements should be evidenced by a signed contract.
Receiving banks screen for two kinds of danger when funds are deposited. Nacha offers working examples of both. Business transfers to personal accounts are one example. So are big transfers, a series of similar deposits within a few days, and a formerly unused or inactive account with little or no activity that suddenly has a large deposit.
If a bank identifies something suspicious, it has the right to hold the funds and potentially contact the other bank via the Nacha directory. Furthermore, that bank can also send the funds back to the originating bank.
According to Nacha, these provisions would not shift liability for fraud loss. The provisions would not change the location of risk, and the Uniform Commercial Code’s provisions would continue to apply. The changes would require an ACH Originator to implement a process to manage the risk that fraud may occur.
A company uses WEB debits to take money directly from a user’s banking account using a mobile app, website, or other electronic means. Collections made over the phone do not apply. Internet-based transfers represented the largest volume in Nacha’s 2025 figures, reaching 11.4 billion, up 6.1 percent from 2024.
The account validation rule for online collections took effect on March 19, 2021. Nacha delayed enforcement until March 19, 2022, allowing the industry more time to prepare.
There are a couple of reasons for this. Before a company initiates a collection from a customer’s bank account, it should verify that the customer’s bank account is valid and accepts ACH debits. Some companies verify that the bank account is owned by the customer. Confirming ownership is above Nacha’s baseline, but some companies do this.
From a compliance standpoint, Nacha gives a lot of leeway to companies. ACH trial balance deposits, ACH test deposits, bank- or third-party vendor-sponsored pre-collection checks, and/or online verification services, are just some of the ways companies can verify customer bank accounts. Companies also can accept account verification based upon a customer’s previous ACH transactions.
Prior collection records were not impacted by the change. Collection records from before March 2021 do not need to be revalidated. If a bank formally notifies a company of a change of a customer’s bank account details, the company need not revalidate.
After the 2026 fraud rule, collections companies are expected to examine online collection records and are not exempt from additional validation.
There are four additional start dates that mainly affect banks and companies that transfer money internationally.
Beginning January 1, 2027, banks must disclose to Nacha a point of contact for ACH transactions (international), and the rule will define what text characters may be included in ACH files.
As of March 19, 2027, the international ACH format may include the field for the sender’s date of birth. Also, as of that date, Nacha will update the rules to address money transfer services businesses that are not banks.
As of September 17, 2027, the dollar amount limit, above which Same Day ACH Transactions are not permitted, will increase to $10 million.
As of March 17, 2028, banks will be permitted to return entries that would violate sanctions.
Banks should consider changing how they communicate with their overseas suppliers to take advantage of the 2027 changes. Also, companies that send large domestic payments should take into consideration the increased Same Day ACH Transfer limit.
Most ACH breaches result in a warning letter for the first violation. Subsequent violations within the succeeding 12 months result in escalating fines of $1,000, $2,500, $5,000, etc. Each serious breach is assessed fines of $100,000 per month until it is resolved. Failure to cure a serious breach can result in penalties of up to $500,000/month. If this occurs, Nacha can also require the bank to stop the customer from using the ACH network.
The 2025 Nacha Enforcement Summary provides more detail about serious breaches. According to that report, 700 breaches were reported. The review panel determined cases and issued fines totaling $750,750. Small banks and credit unions comprised 174 of the cases for which fines were assessed.
Penalties are assessed against the bank instead of the company. If a company wants to determine how fines and other charges might be assessed against it, it should look to the contract it has with the bank. Often, these charges and limitations are discussed in the ACH agreement.
These steps track the guidance Nacha has published for sending companies. Scale each one to your own level of exposure.
From June 22, 2026, all financial institutions processing ACH transactions have been required to put in place a risk-based method for detecting fraud, including payments authorized under pretenses. Such methods must be reviewed at least once a year. Meanwhile, account validations for online collections have retained the requirements implemented in 2021.
The mandatory use of the PAYROLL and PURCHASE descriptions began on March 20 this year.
Other requirements are more staggered. Character and contact updates will start on January 1, 2027. Changes to cross-border payments will be effective from March 19, 2027. The limit for same-day transfers will be increased to $10 million starting from September 17, 2027. Code R90 takes effect on March 17, 2028. This provides a synopsis of Nacha’s published changes and modifications. Banks should contact their payments compliance officers for clarification on the changes that affect them.
Nacha’s rules will impact small businesses the same as big businesses. Any company sending ACH transfers will have to perform fraud monitoring starting on June 22, 2026. The rules should be proportional to a company’s exposure.
This occurs when a company collects funds from an individual’s account through an agreement made online or through a mobile application. Prior to the collection, the account may need to be verified.
In extreme cases, Nacha can fine a company’s bank up to $500,000 per month and prohibit the bank from transferring ACH transactions for the company. The company’s bank may charge the company for the fine.
