The largest participants in the American payments system face a regulatory compliance deadline on Thursday when Phase One of Nacha's new risk management rules takes effect, requiring major financial institutions and corporate originators to implement proactive fraud monitoring for ACH transactions. The March 20 deadline marks a fundamental shift from the reactive approach that has governed the nation's automated clearing house network for decades, placing affirmative fraud detection obligations on banks, third-party service providers, and large corporate payment senders for the first time.
WHO MUST COMPLY BY THURSDAY
Under Phase One, originating depository financial institutions with 2023 ACH origination volumes of six million transactions or greater must establish and implement risk-based processes and procedures reasonably intended to identify entries initiated due to fraud. The same requirement applies to receiving depository financial institutions with annual ACH receipt volumes exceeding ten million transactions, as well as large third-party senders and third-party service providers that handle comparable volumes.
The rules are deliberately principles-based rather than prescriptive. Nacha has not specified a detailed definition of what constitutes "risk-based processes and procedures," giving institutions flexibility to tailor their approaches to their own risk profiles, transaction types, and operational capabilities. That flexibility, however, comes with a clear expectation: compliance will be judged by outcomes, not merely by the existence of documentation.
PHASE TWO FOLLOWS IN JUNE
Institutions that fall below the volume thresholds for Phase One are not off the hook for long. Phase Two extends the same fraud monitoring requirements to all remaining originators, third-party senders, third-party service providers, and receiving depository financial institutions, with a compliance deadline of June 22, 2026. The staggered rollout was designed to give smaller participants additional time to build or acquire the monitoring tools needed to meet the new standard, but the compressed timeline between phases means that many institutions are already working in parallel on both compliance tracks.
Noncompliance carries meaningful consequences. Nacha's enforcement framework provides for compliance fines, and institutions that fail to implement adequate monitoring may face heightened exposure to fraud losses, reputational damage, and potential scrutiny from federal banking regulators who increasingly view payment system integrity as a supervisory priority.
AN INDUSTRY-WIDE CHALLENGE
The rules emerge from a multi-year collaborative process between Nacha and the payments industry, tracing back to a risk management framework first released in September 2022. That framework identified systemic vulnerabilities in the ACH network, particularly around credit-push fraud schemes in which bad actors initiate unauthorised transfers that are difficult to reverse once settled. The March 2024 rule amendments codified the monitoring obligations, giving the industry two years to prepare.
For community banks and smaller credit unions, the compliance challenge is especially acute. These institutions often lack the internal technology teams and data analytics capabilities of their larger counterparts, making them dependent on core banking providers and third-party fraud detection vendors. The American credit union industry has been particularly vocal about the need for accessible compliance tools, with America's Credit Unions publishing detailed guidance on the requirements and urging members to engage their technology partners early.
Banks that have invested in real-time transaction monitoring and machine-learning-based anomaly detection are best positioned to meet the new standard. Those that have relied primarily on post-settlement review processes will need to accelerate their technology adoption, creating an immediate market opportunity for regtech firms specialising in payment fraud detection. The broader effect is likely to be a measurable improvement in the integrity of the ACH network, which processed more than 30 billion transactions in 2025 and remains the backbone of the US consumer and business payments ecosystem.