Nacha reported an increase of 47% in Same Day ACH, handling 8.2 billion payments in Q1 2024.1 As volume grows, Nacha and its members approved new rules on March 18, 2024, designed to address credit-push fraud. The rules are geared toward establishing a baseline of ACH payment monitoring for all parties in the ACH Network.
Nacha, in its press release, highlighted business email compromise and vendor and payroll impersonation as examples of frauds that result in payments being “pushed” from a payer account to the account of a fraud operator.2 The rules are focused on enhancing fraud detection and recovery within the ACH Network.
The rules promote fraud detection from the origination at the originating depository financial institution (ODFI) to the point of receipt at the receiving depository financial institution (RDFI). This introduces, for the first time, requirements for the RDFI. Beginning with the rule introduction, RDFIs must reasonably intend to identify entries suspected of being unauthorized or authorized under false pretenses. Nacha further states that if the RDFI already has solutions, it must ensure that the existing processes and procedures meet the new requirements. The first wave of the new rules becomes effective March 20, 2026.
The new rules are introduced to reduce the incidence of successful fraud attempts and improve the recovery of fraud-identified funds. Monitoring for fraud can aid institutions in establishing “normal activity” baselines, allowing easier identification of outliers. Nacha is clear that the new rules do not shift the liability for ACH Payments.
Nacha’s new operating rule is broken down into two phases for the ODFI and RDFI.
Fraud Monitoring by Originators, Third-Party Service Providers (TPSPs), and ODFIs
The new rules are slated to take effect March 20, 2026, and apply to all ODFIs, non-consumer originators, TPSPs, and third-party senders with an annual ACH origination volume of 6 million or more in 2023. Effective Date Phase 2 is scheduled for June 19, 2026, and applies to all other non-consumer originators, TPSPs, and third-party senders. The new rules require establishing risk-based processes and procedures to identify ACH entries initiated due to fraud. The “commercially reasonable” standard will be eliminated, and it will be clarified that monitoring is not necessary for pre-processing. Additionally, reviewing processes and procedures will be required at least once a year.
RDFI ACH Credit Monitoring
The new rules for RDFIs also take effect on March 20, 2026; the rule will apply to all RDFIs with an annual ACH receipt volume of 10 million or more in 2023. Effective June 19, 2026, the rule will apply to all other RDFIs. The rule mandates that all RDFIs establish risk-based processes and procedures to identify credit entries initiated due to fraud, emphasizing communication and collaboration among compliance, operations, and relationship management teams. The rule aligns with regulatory obligations and anti-money laundering (AML) monitoring practices. Additionally, the rule requires an annual review of processes and procedures to ensure compliance with the regulations.
The rule’s benefits are intended to reduce the number of successful fraud attempts and improve funds recovery. Nacha recognizes that while potentially significant, the new rules for ODFIs and RDFIs are intended to reduce the incidence of fraud using ACH Payments.
The following are key takeaways that ODFIs and RDFIs should consider:
- Review your existing process: Have your fraud, AML, and compliance teams review the rules to determine your institution’s readiness level from a policy and procedure, fraud strategy, and compliance perspective.
- Be prepared to expand: The rules expand responsibilities to RDFIs, who were not previously tasked with monitoring inbound payments. New policies, strategies, and compliance procedures will take time to develop.
- Identify enhancements: Identify gaps in systems or tools needed to comply with the new rules.
Institutions that process ACH should start reviewing their processes now. In some cases, significant time and monetary investments may be required. For more information on the rules and how your institution may be impacted, contact me at [email protected].
- “Same Day ACH and B2B Propel ACH Network Growth in the First Quarter,” Nacha, April 23, 2024, accessed May 7, 2024, https://www.nacha.org/news/same-day-ach-and-b2b-propel-ach-network-growth-first-quarter. ↩︎
- Nacha, March 18, 2024, accessed May 7, 2024, https://www.nacha.org/news/new-nacha-rules-take-aim-credit-push-fraud. ↩︎
