The new Nacha rules represent a pivotal change in the fight against ACH fraud and the March 20 deadline to comply is less than two months away. Are you ready to intercept scams initiated through the ACH network?
ACH has become a cornerstone of the U.S. payments system — the total volume of payments made through the ACH network increased to 33.6B in 2024. This means there are more fraudulent ACH payments as well; fraudsters who successfully take over accounts through BEC scams will send payments in the same format to avoid scrutiny.
By the time the fraud is discovered, the funds have often disappeared from the receiving account. To combat this, Nacha has built new rules for receiving institutions to detect these frauds — before the funds are unrecoverable.
How Nacha’s Updated Rules Help Stop ACH Scams
Nacha’s rule changes expand what receiving institutions must do when suspicious credits hit customer accounts. Under the new guidelines, RDFIs are given the authority to hold suspicious ACH entries automatically — without waiting for a dispute or customer complaint.
This includes monitoring conditions such as:
- Whether the SEC code matches the transaction’s purpose.
- Unusual amounts for the receiving account.
- The age of the receiving account and whether the activity fits expected patterns.
- Repeated, similar credits posted within a short timeframe.
- Funds moving into newly opened or dormant accounts.
Institutions must meet these requirements by March 20, 2026. An exception will be made for institutions with low payment volumes (less than 6 million originating or 10 million received). These institutions will have until June 19, 2026 to implement the new rules.
Because these rules address the full journey of an ACH payment — from origination to receipt — they help reduce successful BEC, vendor impersonation, payroll diversion and other scams where fraudsters trick legitimate users into authorizing payments.
Nacha’s New Rules: A Compliance Checklist
Before you take action, review the upcoming changes to identify where your institution’s controls may fall short. If you originate and receive ACH payments, your processes will need to be updated.
Here’s a starting point:
For RDFIs
- Put risk‑based monitoring in place to catch suspicious incoming ACH credits.
- Strengthen cross-institutional collaboration to support recovery when fraud occurs.
- Update and document ACH procedures as part of your annual audit cycle.
For ODFIs
- Evaluate and strengthen outbound ACH payment monitoring.
- Align with your originators and any third‑party senders to ensure they follow fraud‑detection expectations.
- Review internal procedures regularly to stay aligned with Nacha’s evolving standards.
Preparing for the deadline is meaningful work. And once ongoing monitoring begins, you’ll be reviewing far more alerts — unless you deploy technology that can reduce false positives while highlighting truly high‑risk payments.
Are You Ready to Meet the Nacha Deadline?
These rule changes represent one of the most significant upgrades to ACH fraud oversight in years. With the milestone approaching quickly, institutions that stall could face penalties, including being removed from the Nacha network.
Nasdaq Verafin has developed a solution to ensure you meet these requirements confidently. By combining behavioral evidence, consortium intelligence and real‑time transaction analysis, our solution strengthens defenses against APP fraud, BEC schemes and other threats hiding within ACH flows.
This is more than a compliance deadline — it is an opportunity to modernize your approach, reduce fraud losses and protect the financial ecosystem.
Your ACH requirements are getting harder to meet. Make them easier, instead. Learn more about Nasdaq Verafin’s ACH solution to get started.
