Sage 100

Upcoming Nacha operating rules changes

What's changing?

The ACH Risk Management Topics are comprised of a set of amendments to the Nacha Operating Rules that, together, are intended to strengthen the ability of the ACH Network to detect and reduce the incidence of successful fraud attempts and improve the recovery of funds if fraud has occurred. 
 

March 20, 2026: ACH risk management topics

• Fraud Monitoring by Originators, Third Party Service Providers/Third Party Senders, and originating depository financial institution (ODFI) Phase I – All ODFIs and originators with volume greater than 6 million in 2023. The amendment will require each non-consumer Originator, ODFI, Third-Party Service Provider, and Third-Party Sender to establish and implement risk-based processes and procedures reasonably intended to identify ACH entries initiated due to fraud. Each of these parties will need to review at least annually their processes and procedures and make any appropriate updates to address evolving risks.
• ACH Credit Monitoring by receiving depository financial institution (RDFI) Phase 1 – RDFIs that receive volume greater than 10 million in 2023. The rule mirrors the Fraud Monitoring by Originators, Third-Party Service Providers/Third-Party Senders and ODFIs Rule in that it will require RDFIs to establish and implement risk-based processes and procedures reasonably intended to identify credit ACH entries initiated due to fraud. As with the other entities, RDFIs will need to review at least annually their processes and procedures and make any appropriate updates to address evolving risks. 
• Standard company entry descriptions – Payroll and purchase. The rule will establish two new Company Entry Descriptions, PAYROLL and PURCHASE. The PAYROLL Company Entry Description must be used for ACH credits bearing the PPD Standard Entry Class Code that are for the payment of wages, salaries, and other similar types of compensation. The objective of adding PAYROLL as a Company Entry Description is to reduce the incidence of fraud involving payroll redirections. RDFIs that monitor inbound ACH credits will have better information regarding new or multiple payroll payments to an account. The PURCHASE Company Entry Description must be used for e-commerce purchases. An e-commerce purchase will be defined as a debit entry authorized by a consumer Receiver for the online purchase of goods. The new Company Entry Description will enable identification of such e-commerce transactions.

June 22, 2026: ACH risk management topics

• Fraud Monitoring by Originators, Third Party Service Providers/Third Party Senders and ODFIs (Phase II – All other). The Rule will apply to all other non-consumer Originators, Third-Party Service Providers, Third-Party Senders to establish and implement risk-based processes and procedures reasonably intended to identify ACH entries initiated due to fraud. Each of these parties will need to review at least annually their processes and procedures and make any appropriate updates to address evolving risks.
• ACH Credit Monitoring by RDFIs (Phase II – All other). The Rule will apply to all other RDFIs to establish and implement risk-based processes and procedures reasonably intended to identify credit ACH entries initiated due to fraud. As with the other entities, RDFIs will need to review at least annually their processes and procedures and make any appropriate updates to address evolving risks.