What New ACH Rules Mean for Fraud Monitoring

The clock is ticking. With required fraud monitoring for both Originating Depository Financial Institutions (ODFIs) and Receiving Depository Financial Institutions (RDFIs) just around the corner, many institutions are in the final stages of preparation.

Beginning next month, major updates to the Nacha ACH Operating Rules take effect next month. These updates are designed to strengthen fraud detection, increase transparency, and encourage greater collaboration across the ACH Network.

These changes expand fraud monitoring responsibilities for ODFIs, RDFIs, Originators, and Third-Party Service Providers, which makes now the time to confirm that processes, controls, and documentation are in place.

What’s Changing?

To prepare for implementation, focus on three main areas:

1. Expanded fraud monitoring requirements for ODFIs, Originators, and Third Parties
2. New fraud monitoring expectations for RDFIs
3. New Company Entry Descriptions for payroll and online purchase transactions

Below is a detailed breakdown of effective dates, phased requirements, and key responsibilities under the updated rules. 

Expanded Fraud Monitoring Requirements: ODFIs, Originators, and Third Parties

Effective Dates:

• Phase 1: March 20, 2026; Applies to all ODFIs and non-consumer Originators, TPSPs, and TPSs with ACH origination volumes of six million or more entries in 2023
• Phase 2: June 19, 2026; Applies to all remaining non-consumer Originators, TPSPs, and TPSs

All non-consumer Originators, Third-Party Service Providers (TPSPs), Third-Party Senders (TPSs), and ODFIs must establish and implement risk-based fraud monitoring processes for ACH credit and debit entries.

The rules do not require every transaction to be screened or monitored before processing. Institutions have flexibility to design controls based on their risk profile, but doing nothing is not acceptable. Fraud monitoring processes must be documented and reviewed annually.

These measures aim to reduce fraud risk and encourage timely communication between ODFIs and RDFIs when suspicious activity is detected.

Fraud Monitoring for RDFIs

Effective Dates:

• Phase 1: March 20, 2026; RDFIs with ACH receipt volumes of ten million or more entries in 2023 (approximately 70% of RDFIs)
• Phase 2:June 19, 2026; All remaining RDFIs

For the first time, all RDFIs are required to maintain a formal ACH credit fraud monitoring program. RDFIs must implement risk-based processes to identify potentially fraudulent ACH credit entries, including unauthorized transactions or transactions authorized under false pretenses.

While liability for ACH credit fraud remains with the ODFI, RDFIs are expected to actively assess risk, maintain documented procedures, and conduct annual program reviews. Collaboration with BSA/AML teams is strongly encouraged.

Examples of ACH Credit Fraud Red Flags:

• SEC codes that do not match the account type
• Unusually large credit amounts for the receiving account
• Multiple credits posted in a short period (e.g., repeated payroll deposits)
• Sudden activity in a previously dormant account

New Company Entry Descriptions

Effective Date: March 20, 2026

Nacha is introducing two new standardized Company Entry Descriptions to improve transaction clarity and support fraud detection:

• PAYROLL – Required for PPD credits used to pay wages or salaries, helping RDFIs identify payroll deposits and detect payroll-related fraud
• PURCHASE – Required for consumer-authorized e-commerce debit entries for online purchases of goods 

Preparing for Implementation

As your organization finalizes preparations, use the steps below to ensure compliance and position your team for a smooth transition. A proactive, well-documented approach strengthens fraud controls and supports ongoing monitoring.

Recommended Next Steps:

• Review ACH activity and volumes to determine which phase applies to your organization
• Update or create a documented ACH fraud risk assessment covering both credit and debit activity
• Evaluate existing monitoring tools and processes to determine whether enhancements are needed
• Establish formal fraud monitoring procedures that are risk-based and scalable
• Coordinate with BSA/AML teams to leverage existing monitoring frameworks where possible
• Plan for annual reviews of fraud monitoring programs and document results
• Assess ACH file creation processes to ensure proper use of the PAYROLL and PURCHASE Company Entry Descriptions

Have questions or want to know more? Contact ViClarity’s compliance services team at compliancesupport@viclarityus.com.