NACHA has approved new rules to reduce fraud, including business email compromise (BEC) and credit-push payments. For the first time, receiving financial institutions have a defined role in monitoring ACH payments.
Financial institutions should develop policies and procedures now to meet the 2026 requirements. This should include:
- Proactively monitoring outgoing and incoming debit and credit entries.
- Actively monitoring incoming credits for anomalies, including Verification of Payee (VoP).
- Monitoring for anomalies and return rates, and setting velocity and dollar limits for originators.
The new rules provide receiving institutions with tools to combat fraud when detected. They can:
- Delay funds availability for closer scrutiny of the payment.
- Proactively return a suspicious transaction without a request or customer claim.
The sending institution retains liability for the transaction. The new rules emphasize a whole-transaction approach to fraud prevention, requiring all financial institutions participating in the ACH Network to monitor transactions.
- Compliance: NACHA rules require participating financial institutions to comply. While NACHA is not prescriptive about the "how" of implementation, it is clear that it is reacting to the dramatic increase in credit-push fraud and industry and government pressure to protect consumers. It will likely use all available tools, including fines, to enforce these new rules.
- Consumer Confidence: If consumers lose confidence in traditional methods, they will turn to alternatives. Card processors are positioning themselves to take over payment rails and bulk processing, which would increase expenses for financial institutions and drain revenues.
- Future-Proofing: The same monitoring protocols in place for ACH could (and should!) be used for immediate payments. With the advent of FedNow, immediate payments are becoming mainstream in the US. By implementing robust fraud monitoring now for ACH, financial institutions can leverage these processes to combat the risks introduced by immediate payments.
March 20, 2026?- Fraud Monitoring Phase 1
- All originators with volume of more than 6 million (in 2023)
- All receivers with receipt volume of more than 10 million (in 2023).
June 19, 2026 - Fraud Monitoring Phase 2
- All originators and receivers regardless of volume. ?
