Nacha (the National Automated Clearing House Association) has approved a series of updated Operating Rules for the ACH Network intended to enhance fraud prevention, improve operational clarity, accelerate funds availability, and increase standardization across ACH transactions. Many provisions take effect in 2026, with others phased through 2027 and beyond. These changes impact financial institutions, ACH originators, third-party service providers, and ultimately corporate and commercial ACH users.

Nacha is significantly expanding fraud monitoring requirements across the ACH Network. The updates require ACH participants to implement risk-based processes and procedures reasonably designed to identify potentially fraudulent ACH entries. Previously, rules focused primarily on WEB debits; the new requirements extend monitoring to a broader range of entries and require documented, periodically reviewed controls.

• Two-Phase Implementation:

 

– Phase 1 (March 20, 2026) – Applies to all Originating Depository Financial Institutions (ODFIs), large Originators, Third-Party Service Providers (TPSPs), Third-Party Senders (TPSs), and large Receiving Depository Financial Institutions (RDFIs).

– Phase 2 (June 22, 2026) – Extends to all remaining Originators, TPSPs, TPSs, and RDFIs.

• Participants must develop processes reasonably intended to detect entries initiated due to fraud or authorized under false pretenses (e.g., BEC, vendor impersonation). • Controls must be reviewed at least annually and updated to adapt to evolving risk. • RDFIs, which historically played a passive role, now have explicit monitoring responsibilities for incoming credit entries.

 

New standardized company entry description requirements will help improve transparency and support fraud monitoring. These require specific terminology in the Company Entry Description field for designated payment types in ACH files.
Required Descriptions: • PAYROLL – For PPD credits relating to wages, salaries, bonuses, and similar compensation. • PURCHASE – For consumer-authorized e-commerce debit entries (typically WEB debits for goods/services).
These updates may require updates to ACH file templates and accounting or treasury systems.

 

To accelerate the availability of ACH credit funds: 

• The existing requirement tied funds availability to the RDFI’s receipt of ACH files by 5:00 p.m. local time the day before settlement is eliminated.

• Instead, all standard ACH credits must be made available by 9:00 a.m. local time on the Settlement Date. This change improves predictability and liquidity for receivers of ACH credits.

 

Nacha is enhancing the rules governing International ACH Transactions (IATs) to provide clearer definitions and expanded options for cross-border entries. 

These updates include:
• Clarification of what constitutes an IAT entry (effective September 18, 2026).

• Optional Date of Birth field for IAT entries (effective March 19, 2027).

• Inclusion of Non-Bank Foreign Financial Agencies in IAT entry processing (effective March 19, 2027).
These changes help originators and ODFIs consistently classify cross-border ACH transactions.

 

Participating DFIs must register primary and secondary ACH/IAT contacts in the ACH Contact Registry, including email and telephone information. This enhances communication for cross-border payments and risk management.

 

Nacha continues to adopt minor and housekeeping changes to clarify definitions, update language, and address administrative concerns. These changes are not expected to materially impact most ACH participants.

 

• Review internal ACH origination and monitoring processes to ensure compliance with the expanded fraud monitoring rules. 

• Update ACH file templates and treasury systems to incorporate the new Company Entry Descriptions.

• Coordinate with your financial institution (e.g., Diamond Bank Operations) to align on funds availability changes and IAT handling.

• Plan for contact registry updates and cross-border classification requirements in early 2027.