Nacha compliance means following the Nacha Operating Rules every time your business originates or receives an ACH payment. Nacha is not a government agency: it writes the rules that financial institutions participating in ACH follow, and those rules reach your business through your bank or processor. In 2026, the practical change is fraud monitoring. Originators now need risk-based processes to detect ACH entries initiated through fraud, and large originators were on the clock first. This guide covers who is bound, what changed, what an audit looks at, and which controls to put in place.
The ACH Network is the payment rail. Nacha is the rule administrator. The Operating Rules define how an ACH entry is initiated, transmitted and settled, and Nacha describes its rulemaking as open, with input from financial institutions, the Treasury, the Federal Reserve and end-user businesses. The Federal Reserve and The Clearing House operate the network infrastructure, while Nacha governs the rules. Nacha is not a federal regulator, but that distinction offers little comfort: the rules are enforced through contracts, and a violation can cost you your ACH access.
The same Nacha page states that everyone using the network, from consumers and financial institutions to businesses and governments, has responsibilities under the Rules. For a business, the responsibilities arrive through three roles:
Nacha’s developer guidance notes that for business-to-business payments there must be an agreement between the two business partners, and both parties must be bound to the Nacha Operating Rules. In practice, your origination agreement with your bank or processor is where compliance becomes a contractual duty. Nacha’s own guidance says originators and their financial institutions must ensure that ACH payments comply with the Rules.
The ACH Network is a U.S. system, and the Operating Rules govern it. Cross-border payments that touch it are labeled International ACH Transactions (IAT) and carry extra data requirements. Nacha has an IAT rule set with an effective date of March 19, 2027, which adds an optional date-of-birth field and addresses non-bank foreign financial agencies. If you collect from customers in Canada or the UK, those markets run on their own rails and rules, which is why we maintain separate guidance for Canadian ACH processing and UK bank transfer payments.
The headline change is a pair of risk management rules that expand fraud monitoring from a narrow set of debits to a general duty. Before 2026, the rule was limited to a “commercially reasonable” fraud detection system for WEB debits. The new framework applies to credits and debits, and it is phased by volume.
| Phase | Who | Effective date | What it requires |
|---|---|---|---|
| Phase 1 | Large Originators, TPSPs and TPSs, plus ODFIs and large RDFIs | March 20, 2026 | Risk-based processes to identify ACH entries initiated due to fraud |
| Phase 2 | All other non-consumer Originators, TPSPs and TPSs | June 22, 2026 | Same duty, for entities under the Phase 1 threshold |
| Funds availability | RDFIs, for non-same-day ACH credits | September 18, 2026 | New funds availability requirements and exceptions |
Nacha’s Phase 2 topic page lists the effective date as June 19, 2026, while its summary page lists June 22. Both fall in the same week, and every date in this table has now passed. If you were not caught by Phase 1, you are inside Phase 2, and the practical answer is the same: have a documented, risk-based monitoring process in operation now.
Two points matter for most merchants. First, the rules do not prescribe a product. They require processes appropriate to your volume, your customer mix and your payment types. Second, your bank or processor is also bound, so expect new questions in your onboarding and annual reviews, and expect them to ask for evidence of your controls.
Nacha’s guidance for originators recommends risk-based controls such as dual controls, multi-factor authentication, account validation and monitoring for abnormal activity. Its recommended controls include dual controls for payment initiation, multi-factor authentication, account validation tools and out-of-band authentication for any change to payment instructions. Business email compromise, where a fraudster poses as a vendor and sends new bank details, is the scenario that last control addresses.
A workable program has five parts:
There is also a layer outside the ACH file itself. The people who can approve a payment or change payee details are the real attack surface, so layered security measures around the systems and staff accounts that touch payment instructions belong in the same plan. Nacha also tells businesses to talk to their financial services provider about monitoring practices, because each provider sets its own policies and qualifications for business customers sending ACH payments.
Monitoring only works if you watch the right numbers. Nacha’s originator guidance states that an originator’s unauthorized entries may not exceed 0.5% of its originated entries. Unauthorized return codes such as R05, R07, R10 and R29 feed that figure, and a merchant whose return rate climbs will hear from its ODFI long before Nacha is involved. Our guide to ACH return codes R01 to R85 explains which codes count toward which thresholds and what each one asks you to do.
Authorization is the other half. Keep a record for each SEC code you use (WEB, PPD, CCD, TEL), because the form of valid authorization differs by code. A subscription merchant debiting consumers online needs a clear, retrievable authorization that shows the amount, timing and cancellation terms. A B2B originator using CCD needs a signed agreement between the two businesses. When a return arrives, the authorization record is your defense.
Nacha requires participating financial institutions and third-party service providers and senders to conduct an annual Rules compliance audit, covering the Rules that apply to the participant’s functions. The audit is due by December 31 each year, so the work belongs in the fourth quarter. A merchant that is only an originator is not usually audited directly by Nacha, but your ODFI is, and it will pull your records into its own audit. If you are a TPS, the audit is yours.
Nacha’s audit materials point to these scope areas: policies and procedures for ACH processing, risk management practices, data security compliance, customer due diligence and onboarding, error resolution and transaction monitoring and reporting. Nacha also moved to an automated proof-of-audit process: a registered administrator at the financial institution attests through the Risk Management Portal, gives the audit completion date or says it was not completed, and no additional documentation is required for that attestation. The attestation is light, but the audit behind it still needs to be real and retained.
A practical evidence file, based on an ACH audit checklist from an audit specialist, includes:
Keep the file organized by quarter so that the year-end audit is an assembly job, not a reconstruction.
Nacha accepts reports of possible violations and evaluates them through a formal system of warnings and fines. Nacha’s originator guidance puts the ceiling for egregious violations at $500,000 per month, and notes that financial institutions may contractually pass fines on to Originators. Read your origination agreement for indemnification and pass-through language. For most merchants, the more common consequences arrive earlier: reserve increases, lowered exposure limits, or an ODFI that ends the relationship.
We see Nacha compliance in underwriting files more often than in compliance departments. When a merchant that Stripe, PayPal or Square has frozen comes to us, the ACH question is rarely whether the business knows the acronym. It is whether the business can show a bank that it monitors its own flows.
Our view is that the 2026 fraud monitoring rules reward merchants who treat controls as an operating discipline: documented return-rate tracking, account validation before the first debit, and a clear owner for payee changes. A sponsor bank reads that file the way it reads a chargeback ratio, and a clean one shortens the path to approval.
That is why we are transparent about reserve structures and quote-based pricing up front. A merchant who knows the terms can design its controls to stay inside them, and a merchant with multi-bank, multi-rail resilience is not exposed when one relationship tightens. For high-risk and B2B merchants, compliance is the thing that keeps processing stable.
Joshua Benedetti
If you originate ACH and your current provider has frozen, capped or declined you, our ACH and eCheck processing is built for B2B and high-risk volume, with underwriting support through sponsor banks. Merchants with recurring B2B, government or aerospace payments can review our B2B and B2G payment processing, and those who need a primary account can start with our high risk merchant account page. Pricing is quote-based, and we state reserve terms in the quote.
If you are still choosing between rails, our comparison of eCheck and ACH, the walkthrough of 1 to 3 day ACH processing and the explanation of FedACH cutoff times cover the operational detail that your compliance program has to account for.
Use this as a recurring calendar rather than a one-time project:
One caution applies to every point above: the Rules are amended on a recurring schedule and effective dates for future changes move. Treat Nacha’s own rule pages as the authority for current dates, and treat your origination agreement as the document that binds you. Ask your ODFI’s compliance contact or an ACH-experienced attorney about your specific SEC codes and agreements.
Anyone who uses the ACH Network, including originators, third-party service providers and senders, and the banks on each side. Most businesses are bound through their origination agreement with a bank or processor, which requires them to follow the Operating Rules.
No. Nacha is a rule administrator, not a government agency, and the U.S. Treasury notes that participating institutions follow rules developed by Nacha. The Rules still carry real weight because they are enforced through contracts and Nacha’s system of warnings and fines.
The main change is fraud monitoring. Large originators and their providers came under Phase 1 on March 20, 2026, and all other non-consumer originators, TPSPs and TPSs came under Phase 2 in June 2026. New funds availability requirements for non-same-day ACH credits followed on September 18, 2026.
Financial institutions and third-party service providers and senders must complete an annual Rules compliance audit by December 31. If you are an originator only, your bank audits itself and will likely ask you for authorizations, return reports and risk records. Keep that evidence file current either way.
Every merchant's processing setup is different, so the right answer depends on your industry, sales channels, average ticket size and chargeback history. CARDZ3N's payments specialists review those details with you and match your business with the right sponsor bank, gateway and risk tools, whether you sell online, in store, by invoice or on a recurring subscription.
We work with merchants across the USA, Canada, the UK and the EU, including high-risk, B2B and fast-growing businesses that traditional processors often turn away. If you would like a second opinion on your current rates, contract terms or approval options, contact our team for a free, no-obligation processing review.
Joshua Benedetti is the CEO of CARDZ3N, a Las Vegas-based merchant services provider specializing in high-risk payment processing and B2B payment technology.
Joshua Benedetti on LinkedInCARDZ3N Inc is headquartered in Las Vegas, Nevada, and provides merchant services to businesses that traditional processors turn away. Backed by top-tier sponsor banks and processors, CARDZ3N combines institutional stability with the speed of a specialized team that understands high-risk industries. Services include high-risk account underwriting and placement, gateway solutions across the major gateway platforms, POS integrations, ACH and check processing, chargeback prevention through ChargebackZ3N, and business lending and working capital. Its AerospacePay division serves OEMs, MROs, FBOs, and repair stations with B2B and B2G payment processing. CARDZ3N serves merchants in the USA, Canada, the UK, and the EU.
Start protecting your revenue from chargebacks today — schedule your complimentary consultation with CARDZ3N’s dispute management specialists.
