All banks that originate ACH payments, along with the largest corporate originators, payment processors and receiving banks, face a compliance deadline on Friday when Phase One of Nacha's new risk management rules takes effect, requiring them to implement risk-based fraud monitoring for ACH transactions. The rules extend fraud-monitoring requirements, which previously covered mainly WEB debits and Micro-Entries, to a much broader range of ACH entries and to more parties in the network.
WHO MUST COMPLY BY FRIDAY
Under Phase One, all originating depository financial institutions, together with non-consumer originators, third-party service providers and third-party senders with 2023 ACH origination volumes of six million transactions or greater, must establish and implement risk-based processes and procedures reasonably intended to identify entries suspected of being unauthorised or authorised under false pretences. A parallel requirement, covering incoming credit entries, applies to receiving depository financial institutions with 2023 ACH receipt volumes of ten million entries or greater.
The rules are deliberately principles-based rather than prescriptive. Nacha has not specified a detailed definition of what constitutes "risk-based processes and procedures," giving institutions flexibility to tailor their approaches to their own risk profiles, transaction types, and operational capabilities.
PHASE TWO FOLLOWS IN JUNE
Institutions that fall below the volume thresholds for Phase One are not off the hook for long. Phase Two extends the same fraud monitoring requirements to all remaining non-consumer originators, third-party senders, third-party service providers, and receiving depository financial institutions, with a compliance deadline of June 19, 2026.
Violations of the Nacha Operating Rules can lead to fines under Nacha's rules enforcement process.
AN INDUSTRY-WIDE CHALLENGE
The rules are part of a broader Nacha risk-management package aimed at reducing successful fraud, particularly frauds that use credit-push payments, such as business email compromise and vendor impersonation, in which payments are authorised under false pretences. The March 2024 rule amendments codified the monitoring obligations, giving the industry two years to prepare.
Total ACH payment volume exceeded 42 billion payments in 2025, according to Nacha.
Bank news that matters, every weekday.
Follow The Global Banker on LinkedIn