Get ready, because the world of ACH payments is about to get a whole lot smarter—and a little tougher on fraudsters.  

Phase One of Nacha’s updated fraud monitoring rules takes effect on March 20, 2026. These amendments are part of a broader risk management initiative designed to curb successful fraud attempts and strengthen the recovery of funds when fraud does occur.  

Below is a summary of the new rules:  

Fraud Monitoring by Originators, TPSPs and ODFIs

This rule amendment will require all ODFIs and each non-Consumer Originator, Third-Party Service Provider, and Third-Party Sender with an annual ACH origination volume in 2023 of 6 million or more to establish and implement risk-based processes and procedures reasonably intended to identify ACH Entries initiated due to fraud. 

• The amendment is intended to reduce the incidence of successful fraud attempts.
• Regular fraud detection monitoring can establish baselines of typical activity, making atypical activity easier to identify.

RDFI ACH Credit Monitoring

This rule will require RDFIs with an annual ACH receipt volume of 10 million or greater in 2023 to establish and implement risk-based processes and procedures designed to identify credit Entries initiated due to fraud. 

• A risk-based approach to monitoring can consider factors such as transactional velocity, anomalies (e.g., SEC Code mismatch with account type), and account characteristics (e.g., age of account, average balance, etc.). This aligns with current AML monitoring practices. 
• Based on its monitoring of incoming credits, an RDFI may decide to return an entry or contact the ODFI to determine the validity of a transaction.
• This rule is intended to reduce the incidence of successful fraud and better enable the recovery of funds when fraud has occurred.

Learn More 

For complete technical details, impact, and FAQs about the Phase 1 rules, visit Nacha’s Risk Management Topics – (Fraud Monitoring Phase 1) webpage.