Last updated: November 5, 2026
Nacha’s fraud monitoring rule requires businesses that send ACH payments to keep risk-based processes for spotting unauthorized payments and payments made under false pretenses, and to review them at least annually. Phase 2 took effect June 22, 2026.
TL;DR. Nacha now expects businesses that send ACH payments to have risk-based processes for catching unauthorized payments and payments made under false pretenses. It has applied to every remaining business since June 22, 2026. You don’t have to screen every payment or buy a tool. You do need a few controls on vendor bank changes, a paper trail your bank can see, and a yearly review. Start with the financial system you already run.
A note from the bank lands in the controller’s inbox. Or a vendor forwards a webinar invite with the word deadline in the subject line. Either way, the Nacha ACH fraud monitoring rule is now sitting on your accounts payable team’s desk, and nobody has said how much is enough. Fair question.
Here’s the calm version. The rule is live. It has applied to every remaining business that sends ACH payments since June 22, 2026, so this isn’t a countdown anymore. It’s a housekeeping item with a paper trail attached.
Nacha’s own pages are short, and they leave room for judgment. That’s the good news and the annoying news. A three-person AP team and a payment processor shouldn’t be held to the same playbook, and the rule is risk-based, which gives a small team room to size its process to its exposure.
This post covers what the rule asks for, what it doesn’t, and a control list you can put in writing this month. If your books run in Dynamics GP, there’s also a section on questions to ask about your own setup.
What Does the Nacha Fraud Monitoring Rule Actually Require?
Each covered business must set up risk-based processes to identify ACH entries that may be unauthorized or authorized under false pretenses, and review those processes at least annually. Nacha doesn’t prescribe the method.
False pretenses is Nacha’s term for a payment induced by someone misrepresenting their identity, their authority to act for another person, or the ownership of the account being credited. Business email compromise, vendor impersonation, and payroll impersonation all fit. A scam over fake or poor-quality goods doesn’t. That’s a different problem.
It rolled out in two phases. Phase 1 reached every originating bank plus businesses and processors that sent 6 million or more ACH entries in 2023. Phase 2 picked up everyone else, and Nacha asks for processes relevant to the role a party plays in sending payments, which bank guidance reads as scaled to the size and complexity of the business instead of one template for every company that touches the network.
Read one line twice. Nacha says a risk-based approach can’t be used to conclude that no monitoring is necessary, and at a minimum it expects a risk assessment that separates higher-risk payments from lower-risk ones. Being small isn’t a defense. Buying a tool isn’t one either, if nobody reviews it.
Does the Rule Apply to a Company That Pays Vendors and Payroll by ACH?
Yes, if your company originates ACH payments. Phase 2 covers all other non-consumer originators with no volume threshold, so paying vendors or payroll by ACH through your bank generally puts you in scope.
Regions says it plainly in its client guidance, and by June 22, 2026, the requirements apply to all non-consumer ACH participants. That includes finance teams in nonprofits, healthcare groups, and manufacturers that have never thought of themselves as payment originators. There’s no volume floor. You send a payment instruction to your bank. That makes you an originator.
One edge case. If a payables platform or bank portal sends the ACH on your behalf, your role may read differently on paper. Ask your bank how the rule treats your setup when a platform or portal sends the files.
When Did the Rule Start, and Are We Late?
Phase 1 started March 20, 2026. Phase 2 has a small wrinkle, since the listed date of June 19 was a federal holiday. Nacha says the practical date was the next banking day, Monday, June 22, 2026.
| Phase | Effective date | Who it covers |
|---|---|---|
| Phase 1 | March 20, 2026 | All originating banks, plus non-consumer originators, processors, and third-party senders with 6 million or more ACH entries in 2023 |
| Phase 2 | June 19, 2026 (practically June 22) | All other non-consumer originators, processors, and third-party senders |
It’s in effect. Late’s a strong word, though. Nacha’s pages don’t list penalty amounts, Regions says noncompliance may bring formal rule violations, financial penalties, or restrictions on ACH origination without giving figures, and Nacha says the new rules will be managed through its existing enforcement mechanisms. Nobody outside Nacha and your bank can tell you how that plays out for a small originator, and we can’t either.
You control the paper. Write it down now. Date it. Let your bank know it exists.
What Do False Pretenses Look Like in an AP Department?
Picture a plain email. It carries a real vendor contact’s name, comes from a domain one letter off, and asks AP to update the bank account before Friday’s payment run. That’s a hypothetical. Nothing about it is exotic.
US Bank’s guidance for originators lists the same family of tricks. Someone impersonates a person of authority and demands an ACH payment, someone poses as a vendor you work with and asks for money to go to a fraudulent account, someone claims to be an employee and wants a payment redirected, and a fourth plays a real estate settlement agent or attorney.
Email is the delivery system. Nacha’s May 2026 summary of the AFP survey says 85% of organizations received spoofed emails in 2025, and more than half saw lookalike domains. 74% experienced business email compromise, up from 63% the year before. Numbers like that aren’t a reason to panic, but they are a reason to stop treating a vendor bank change as clerical work, because the email that asks for one is the exact shape this kind of fraud takes.
Where does it break inside a small team? At a handoff nobody thought of as a control. The person who receives the request can also be the person who edits the vendor record and the person who releases the payment. One person. Three jobs. No second look. US Bank also warns that criminals create a sense of urgency to force a quick decision, which is why a Friday deadline in the email should make you slower, not faster.
What Doesn’t the Rule Require?
Less than the emails suggest. Nacha’s pages say the rule doesn’t require monitoring before an entry is processed, doesn’t require screening every entry one at a time, and doesn’t prescribe a specific process or technology.
| Nacha requires | Nacha doesn’t require |
|---|---|
| Risk-based processes to identify suspect entries | Monitoring before entries are processed |
| A review of those processes at least annually, with updates | Screening every entry individually |
| At a minimum, a risk assessment separating higher-risk from lower-risk payments | A specific tool, vendor, or method |
Risk-based isn’t a loophole. Regions reads it the same way, saying Nacha wants risk-based programs, not real-time or transaction-by-transaction review.
How Common Is This Kind of Fraud, Really?
For its 2026 report, the Association for Financial Professionals surveyed 465 corporate professionals, with Truist underwriting the work. 76% reported attempted or actual payments fraud in 2025. Here’s how it split by payment method, as reported by Digital Transactions.
| Payment method | Share of organizations hit in 2025 |
|---|---|
| Checks | 58% |
| ACH debits | 30% |
| Wire transfers | 25% |
| Corporate and commercial cards | 21% |
| ACH credits | 18% |
ACH credits, the kind you send to vendors, sit lowest on that list, which is the comforting half, though a survey of 465 treasury professionals tells you about direction and not about your odds, since your own exposure depends on how your vendor changes get approved. It’s a small sample. Treat it as direction. Ask your bank what happens, step by step, if you report a wrong-account credit the same day.
What Should Be on Paper Before Your Bank Asks?
Guidance from US Bank, PNFP, and Regions points to roughly the same short list, and PNFP adds that controls should be scaled for the size and operational complexity of the business, so a small AP team can keep this lean. Owners below are suggestions, not requirements.
| Control | What it catches | Suggested owner | Evidence to keep |
|---|---|---|---|
| Call back on every bank-detail change, using contact information you already have, never the details in the request | Vendor and executive impersonation | AP lead | Call log with date, person reached, and number used |
| Two people on vendor bank changes and on ACH release | One person doing the whole chain | Controller | Approval record for each change and each batch |
| Validate every new or changed account number | Accounts that aren’t the vendor’s | AP lead with the bank | Validation result on file (US Bank notes a prenote doesn’t prove ownership) |
| Review account activity daily and report anything odd right away | Unauthorized entries | AP or treasury | Dated sign-off |
| Train staff on impersonation and manufactured urgency | The email that works because it’s rushed | Finance lead | Training record |
| Review all of the above at least once a year and update it | Process drift | Finance lead | The dated review itself |
Evidence matters as much as the controls. PNFP’s list of what to be ready to show runs like this.
- Written policies and procedures, even if they fit on two pages.
- The controls you’ve actually turned on.
- Monitoring logs or alerts, which can be as plain as the daily sign-off.
- Any incident, and how it got fixed.
- Evidence of training.
Skipping the annual review is easy, because nothing breaks the day you skip it. Pick a date. Tie it to something that already happens, like audit prep. If a support partner who knows your setup already works with your team, ask who owns the technical half of the list.
Where Does Your Financial System Fit In?
Argus Consulting Group is a Dynamics GP partner in Pasadena, California, built to help finance teams get more out of the financial system they already run, with 33 years of GP experience behind it. We support GP, so of course we’d start with the system. If your bank already runs strong monitoring and your vendor changes go through a locked-down portal, you may need less than this section suggests.
Still, the controls in that last table live somewhere. Some live in your people. Others live in system settings. Ask these.
- Who can open a vendor record and change its bank account, one person or several?
- Does a change need a second approver before the next payment run?
- If someone asked for the change history on a single vendor from last spring, how long would it take to produce?
- Can the person who releases payments also edit vendors?
- When someone leaves or changes roles, who removes their access, and how fast?
- Where does the original request live, in an email thread, a ticket, or nowhere?
- Who can reach the system remotely, and is how your system is hosted and accessed written down anywhere?
Another Nacha change is worth a quick look too. Since March 20, 2026, wage and salary credits to employee accounts have to carry PAYROLL as the Company Entry Description. If direct deposit files come out of your financial system, ask your payroll provider or support partner to confirm what the file says.
Platform changes aren’t required. Getting more from the system in place is the optimize-before-you-migrate argument, and it applies to fraud controls as much as it applies to reports. Optimizing your current setup also keeps your options open as 2029 gets closer.
Where to Start This Week
Pick one owner. Write the six controls from the table in plain language, two pages maximum. Date it. Put the annual review on the calendar, and let your bank know the document exists. The lift is small.
If you’d like a second set of eyes on how your system handles vendor changes and payment approvals, a Free Business Assessment is the low-pressure way to start, or call (626) 403-9744. We lay out options and you decide.
Everything above summarizes public Nacha rules and bank guidance. It isn’t legal advice, and Argus doesn’t certify compliance. Confirm specifics with your bank or counsel.
Questions Finance Teams Ask About the Rule
Can we get fined if we miss the annual review?
Penalty amounts aren’t published on Nacha’s pages. Regions says noncompliance may bring formal rule violations, financial penalties, or restrictions on ACH origination, with no figures given. Ask your bank how it handles a missed review.
Do we need to screen every payment before it goes out?
No pre-processing review is required. Nacha says the rules don’t call for screening each entry individually or for monitoring before entries are processed.
Is a spreadsheet and a callback list enough to count as a process?
Possibly, if you actually use it and keep it current. Nacha doesn’t prescribe a method, and bank guidance says to scale controls to the size and complexity of the business. What matters is that it’s written down, tied to a risk assessment, and reviewed at least annually. A spreadsheet nobody opens won’t hold up, and a modest process people follow will.
What if our bank hasn’t asked us anything yet?
Wrong signal to wait on. The rule applies to originators directly, so a quiet bank doesn’t mean you’re exempt. Regions says the requirements apply to all non-consumer ACH participants as of June 22, 2026, whether or not anyone has written to you yet.
Does the rule cover payroll direct deposit as well as vendor payments?
Payroll counts too. Nacha’s false pretenses definition names payroll impersonation among its scenarios, so direct deposit files sit inside the rule. A separate rule, in effect since March 20, 2026, also requires PAYROLL as the Company Entry Description on wage credits.
Who owns this, finance or IT?
Short answer, finance owns the policy and whoever supports your system owns the settings that enforce it. The split matters because the weak points straddle both. A callback rule is a finance habit. Who can edit the vendor record is a system setting. If nobody is named for either one, the annual review has no one to run it. Name the finance owner first, then ask whoever supports your system to take the technical half, and write both names on the document.