Book a demo
Log in

What are the new 2026 NACHA rules and how do they affect businesses?

sort code checker
IN THIS ARTICLE
Table of Contents
Like it? Share it

The new 2026 NACHA rules require ACH Network participants to establish risk-based processes and procedures to identify fraudulent transactions. The rules were introduced in two phases: Phase 1 became effective on March 20, 2026, while Phase 2 became effective on June 19, 2026. Because June 19 was a federal holiday, the practical compliance date for Phase 2 was Monday, June 22, 2026.

The rules affect financial institutions, businesses that originate ACH payments, and third-party providers involved in ACH processing. Businesses can support their wider Nacha compliance program with controls such as account validation and vendor monitoring. Learn more about Trustpair’s Nacha compliance solution.

NACHA 2026 rules key takeaways

  • Phase 1 of the 2026 NACHA fraud-monitoring rules became effective on March 20, 2026.
  • Phase 2 became effective on June 19, 2026, with June 22 serving as the practical compliance date because June 19 was a federal holiday.
  • Phase 1 applied to all ODFIs, large ACH originators and third parties, and RDFIs above defined 2023 volume thresholds.
  • Phase 2 extended risk-based fraud-monitoring requirements to the remaining non-consumer originators, third parties, and RDFIs.
  • The rules also introduced standardized Company Entry Descriptions for qualifying PAYROLL and PURCHASE transactions.

What are the new 2026 NACHA rules?

The 2026 NACHA rules expand fraud-monitoring responsibilities across the ACH Network. They require affected organizations to establish and implement risk-based processes and procedures reasonably intended to identify ACH entries initiated because of fraud, including transactions involving unauthorized activity or false pretenses.
 
The rules were implemented in two phases.
 

Phase 1: Effective March 20, 2026

Phase 1 applies to:
  • All Originating Depository Financial Institutions, or ODFIs
  • Non-consumer Originators, Third-Party Service Providers, and Third-Party Senders with annual ACH origination or transmission volume of 6 million entries or more in 2023
  • Receiving Depository Financial Institutions, or RDFIs, with annual ACH receipt volume of 10 million entries or more in 2023
  • Phase 1 also introduced two standardized Company Entry Descriptions. The requirements became effective on March 20, 2026.
  • PAYROLL applies to qualifying ACH credit entries for income earned by an individual from employment and paid to a consumer account.
  • PURCHASE applies to qualifying ACH debit entries for online purchases of tangible goods from consumer accounts.
These descriptions are intended to make payment activity easier to identify and support fraud monitoring. They generally do not apply to ordinary business-to-business vendor payments.
 

Phase 2: Effective June 19, 2026

Phase 2 extends the fraud-monitoring requirements to:
  • All other non-consumer Originators
  • All remaining Third-Party Service Providers and Third-Party Senders
  • All other RDFIs, regardless of ACH volume
Nacha lists June 19, 2026, as the formal effective date. Since June 19 was a federal holiday, the next banking day, Monday, June 22, 2026, was the practical compliance date for affected organizations

New call-to-action

Why are the new NACHA rules important?

It’s important that businesses pay attention to the new NACHA governance rules because they affect almost every business in the US. In fact, any organization that processes electronic payments, either by capturing credit and debit card transactions from customers, or even paying staff through payroll, are concerned. 

The new rules are also important for:

  • Standardizing fraud prevention strategies across the industry, no matter the business size 
  • Ensuring that partners and customers can expect a minimum level of protection
  • Improving early detection of suspicious payment activity through risk assessments to see current capabilities and possible vulnerabilities
  • Enabling more accurate transaction labelling, which should lead to better detection

Who needs to comply with NACHA rules?

All ACH network participants must comply. Three types of businesses need to comply with the new 2026 NACHA rules: 

  1. Businesses that initiate ACH transactions
  2. Financial institutions that receive deposits via the ACH network into their customer accounts
  3. Third parties that provide services within the ecosystem (fintechs), such as payment processors and payroll providers 

Although it’s the financial institutions that have primary compliance responsibility, all businesses that are participating in the ACH system have a responsibility to follow the rules.

NACHA, which stands for the National Automated Clearing House Association, regulates the ACH payments network across the United States. The regulatory body enforces the rules that keep the network available, secure and efficient.

What happens if a business doesn’t comply with NACHA rules?

If a business fails to comply with NACHA rules, the risks of fraud and enforcement action are significant:

  • Greater risk of fraud or unauthorized payments
  • Financial losses and reputational impacts such as harm to customer trust levels and third party relationships
  • Damaged service relationships between the business and its bank, which could lead to the freezing of payment services or other account restrictions
  • Potential fines from NACHA itself – this is typically sent to the financial institution that processes the payment, which may then choose to pass the fine onto the non-compliant business

How do NACHA rules relate to fraud prevention?

NACHA rules relate to fraud prevention because payment fraud has risen significantly in the US across the last decade, much of which has been perpetrated on the ACH network. These new rules have been introduced to add more verification and therefore protection for vendors and customers alike.

NACHA currently prevents fraud by requiring companies to screen debits and micro-entires, but the updates provide a broader overview. 

We recommend that companies use NACHA rules as part of their wider vendor onboarding process, authenticating the payment details of their partners and suppliers. Even with these updates, ACH fraud risks exist: it’s important that companies go further to secure their supplier onboarding.

At Trustpair, we secure and streamline vendor onboarding by leveraging a unique account validation methodology. Go beyond the rules aimed at NACHA compliance and protect your entire supply chain with simplified account ownership verification. 

New call-to-action

How can businesses be NACHA 2026 compliant?

Here’s a step-by-step guide to become NACHA compliant:

  1. Account validation: at the start of every new client relationship, you should automatically verify the existence and ownership of the payment and business accounts.
  2. Change management: ongoing account monitoring is required to ensure that as details change, your company remains secure. This covers bank account access, ownership, contact details and even geographical details. Trustpair performs ongoing vendor monitoring as a direct response to fraudulent bank account change requests.  
  3. Fraud prevention tools: screening for suspicious activity is an important part of continued NACHA compliance. Businesses must build this, alongside tools like compliance checklists, into their process for confidence in compliance.

A summary on the new NACHA rules

The 2026 NACHA rules are now in effect and require a broader approach to ACH fraud prevention. Phase 1 began on March 20, 2026, and Phase 2 became effective on June 19, with June 22 serving as the practical compliance date.
Businesses should confirm their ACH role, document risk-based monitoring procedures, review their controls at least annually, and strengthen account validation and payment-change processes. The rules provide an important framework, but organizations should also address the wider risks of vendor impersonation, business email compromise, and fraudulent payment redirection. 
Trustpair aids compliance as a secure solution for fraud prevention, thanks to automated account validation.

FAQ
Frequently asked questions
Browse through our different sections and find the answer to your question.

The Nacha 2026 rule changes require businesses and financial institutions to implement risk-based monitoring processes for ACH transactions and will roll out in phased stages. Key updates include:

  • The “commercially-reasonable” standard is replaced with a requirement for documented, risk-based processes and procedures to detect unauthorized or false-pretenses entries.
  • Expanded responsibility across the ACH network: Originators, Third-Party Service Providers (TPSPs), Third-Party Senders (TPSs), ODFIs and RDFIs will all be required to monitor for both credits and debits.
  • Updated Company Entry Descriptions for ACH files: e.g., “PAYROLL” for wages, “PURCHASE” for e-commerce, to improve description standardization.
  • Documentation, annual review and audit trails will be required to demonstrate compliance with the revised rules

ACH (Automated Clearing House) payments in the U.S. are governed by the Nacha Operating Rules, which define roles, responsibilities and data standards for network participants. The main regulatory elements include:

  • Originator, ODFI and RDFI obligations: each party must process entries in accordance with rules regarding authorization, formats, returns and risk controls.
  • SEC Codes and entry descriptions: Standard Entry Class (SEC) codes identify payment types (e.g., CCD, PPD, WEB) and must align with the transaction.
  • Fraud monitoring and risk management: Participants must implement monitoring systems to detect unauthorized entries and maintain audit documentation.
  • Data standards and return timeframes: Rules set requirements for data fields, formats, and return reason codes (e.g., R17 for fraud) to manage risk and revocation.

The 2026 fraud-monitoring rules roll out in two phased stages:

  • Phase 1 (effective March 20, 2026): Applies to all ODFIs plus non-consumer Originators, TPSPs and TPSs with 2023 origination volume ≥ 6 million entries; and RDFIs with 2023 receipt volume ≥ 10 million.
  • Phase 2 (effective June 19/22, 2026): Extends the requirement to all remaining non-consumer Originators, TPSPs, TPSs and RDFIs, regardless of volume.

You’d like these articles

Ready to beat the fraudsters? Try our 2-minute game

PLAY

Ready to beat the fraudsters? Try our 2-minute game

PLAY