Q: We are preparing for the upcoming ACH rule changes as an RDFI. We are unclear as to our responsibility for monitoring ACH transactions. I understand the rule was made to be flexible. Do you have any recommendations for what we need to be monitoring exactly?
A: This is not uncommon; with the upcoming NACHA changes being intentionally principles-based, implementation can feel absolutely open-ended. It’s good that you’re taking this seriously; being efficient with your monitoring resources is fundamental.
RDFI’s are subject only to credit monitoring under the rule, requiring programs be established to monitor ACH credits for fraudulent entries. Depending on received transactions’ volume, RDFIs are expected to come into compliance with this rule as soon as March 20, 2026. Institutions with volume of less than 10 million credits in 2023 get some relief, with their compliance deadline on June 19, 2026. As you note, NACHA does not prescribe any specific transaction thresholds, software requirements, or other processes. Thankfully, there is some existing framework.
The principles here are similar to other identification of suspicious activity; you’ll want to consider likely characteristics of credits that are unauthorized or may have been authorized under false pretenses. An easy example to point to would be the result of a business email compromise event or internal fraud. In cases such as these, oftentimes a business SEC code is used to send funds disguised as a vendor payment to a personal account. A way to monitor for this could be to take the average of an account’s deposits over a period of time, using these to establish a ‘baseline’ at which transactions may be scrutinized if they are dramatically out of the norm. In this example, it could also be effective to monitor transactions with a corporate SEC code posting to consumers’ accounts. Some other examples of what to watch for could be:
Overall, the headline here is that RDFIs are expected to evaluate their ACH credit risk exposure and take reasonable steps to mitigate that risk. We’d recommend documenting the credit union’s findings, as well as how the risk is mitigated by the internal controls being implemented. This approach will formalize the credit union’s risk analysis and provide examiners with proof that the credit union made its determination on a risk basis, as well as setting the stage for future periodic reassessment.
Provided by ViClarity.
For more information, email Heather Line.
Your League-member benefits include the Compliance Hotline — providing exclusive access to dedicated compliance experts:
Using the above phone number and email address, you can gain access to a knowledgeable team that’s ready to address all your credit union’s compliance inquiries — promptly and efficiently. With the Compliance Hotline, you can proactively respond to impromptu questions and issues by getting clarity and insight on technical topics that normally slow you down. We want to help you unlock the full potential of your League membership by leveraging the resources and support you need to navigate the complex world of compliance effortlessly. We’re ALWAYS just a phone call or email away!
Additionally, other League-member compliance resources include:
Powered by ViClarity, a California’s Credit Unions and Nevada’s Credit Unions company.
