Your business needs an automated clearing house (ACH) fraud monitoring procedure. Since June 22, 2026, the Nacha fraud monitoring rule has covered every business that sends ACH payments, whatever its size. It requires risk-based processes to identify suspected fraud, plus a review of those processes at least once a year. A short written procedure is a practical way to show you do both.
This post gives you a fill-in template sized for a business of 10 to 200 people. First comes a plain look at what the rule requires, what it doesn’t, and how to decide which payments deserve more attention.
Does the Nacha Fraud Monitoring Rule Apply to Small Businesses?
Yes. Nacha phased the rule in during 2026, starting with phase 1 on March 20, 2026. Phase 1 covered every bank that originates ACH payments and senders with 6 million or more entries in 2023. It also covered receiving banks with 10 million or more entries in 2023 (Nacha).
Phase 2 removed the volume threshold. Since June 22, 2026, the rule covers every non-consumer Originator, Third-Party Sender (TPS), Third-Party Service Provider (TPSP), and receiving bank (Nacha). The official date was June 19, a federal holiday, so the first banking day under the rule was June 22.
A non-consumer Originator is any organization that sends ACH payments: a business, nonprofit, school, or public agency. If you pay employees by direct deposit, pay vendors by ACH, or collect from customers by ACH debit, the rule applies to you.
What Does the Rule Require?
The rule has two parts. First, you need risk-based processes, suited to your role, reasonably intended to identify entries that may be unauthorized or sent under false pretenses. Second, you must review those processes at least once a year and update them as risks change (Nacha).
“False pretenses” has a defined meaning in Nacha’s rules, added on October 1, 2024. It covers payments you’re tricked into making by someone misrepresenting who they are, whom they act for, or who owns the receiving account (Nacha). That is the pattern behind business email compromise, vendor impersonation, and payroll impersonation. Disputes over fake or poor-quality goods fall outside it.
Nacha is just as clear about what the rule does not require (Nacha):
- You don’t have to screen every payment individually. Monitoring can be risk-based.
- You don’t have to monitor before processing. Catching fraud before release gives you a better chance to stop it, though.
- Nacha doesn’t prescribe a method. You choose processes that fit your business.
- The rule doesn’t change liability. It creates no duty to prevent all fraud and doesn’t shift who bears a loss.
What “risk-based” doesn’t allow is deciding that no monitoring is needed. At a minimum, Nacha expects you to separate higher-risk payments from lower-risk ones and give the riskier ones more attention.
| Item | Required by rule or good practice | Where it comes from |
|---|---|---|
| Risk-based processes to identify entries suspected of being unauthorized or sent under false pretenses | Required since June 22, 2026 | Nacha fraud monitoring rule |
| A review of those processes at least once a year | Required | Nacha fraud monitoring rule |
| “PAYROLL” in the company entry description of direct-deposit wage credits | Required since March 20, 2026 | Nacha company entry description rule |
| Account validation before the first WEB (internet-initiated) debit to an account, and after an account number changes | Required for WEB debits since March 19, 2021 | Nacha WEB debit rule |
| A written procedure | Good practice: it shows how you meet the rule | ReliaFund recommendation |
| Verifying bank-detail changes by calling a number already on file | Good practice | Nacha tips for Originators |
| Dual control, where one person prepares and another releases | Good practice | Nacha tips for Originators |
| Multi-factor authentication on banking and payment portals | Good practice | Nacha tips for Originators |
| Screening every payment before release | Not required | Nacha fraud monitoring rule |
What Counts as “Risk-Based” Monitoring?
Risk-based monitoring means your checks match the risk of each payment. Nacha’s guidance calls for more effort on higher-risk payments and basic precautions on lower-risk ones. Its credit-push fraud resource center lists methods such as velocity checks, anomaly detection, and pattern recognition (Nacha).
For many small businesses, changes to payment details carry more risk than routine payments. Nacha’s own example of monitoring for Originators is change controls on vendor and payroll payment instructions (Nacha, December 2025). Those changes are where impersonation schemes try to redirect your money.
A request to “update” a vendor’s bank account deserves a call back, even when the email looks right. Nacha’s payroll checklist puts it simply: confirm any change request through a separate channel, using contact information you already have (Nacha).
What Must a Written Procedure Include?
A written procedure names an owner and describes your ACH activity and its risks. It lists your controls before and after release, says what you do when something looks wrong, and sets the annual review. The template below covers each part in plain language.
Fill in the brackets, delete what doesn’t apply, and keep it to a few pages. A procedure your team actually follows is worth more than a long one nobody reads.
The Template
ACH Fraud Monitoring Procedure: [Company name]
Version [1.0] · Effective [date] · Owner: [name, title] · Approved by: [name, title]
1. Purpose and scope. This procedure explains how [Company name] identifies ACH payments that may be unauthorized or sent under false pretenses. The Nacha Operating Rules require this of every non-consumer Originator. It covers these payment types: [payroll direct deposit, vendor payments, customer debits, refunds]. We originate ACH payments through [processor or bank name].
2. Roles.
- Procedure owner: [name, title]. Owns this document and the annual review.
- Payment preparers: [names or roles]. Set up payees and payments.
- Approvers: [names or roles]. Approve and release payment files. An approver never approves a payment they prepared.
- Backup: [name]. Covers when the owner or an approver is out.
3. Our ACH activity and risk assessment.
- Typical monthly volume: [number] payments worth about $[amount].
- Usual payment range: $[low] to $[high]. Payments above $[threshold] are higher-risk.
- Higher-risk payments: first payments to new payees, bank-detail changes, payments above the threshold, urgent or off-cycle requests, and new customers’ first debits.
- Lower-risk payments: [recurring payroll to unchanged accounts; repeat vendor payments at normal amounts].
4. Controls before we release payments.
- Bank-detail changes. We verify every change to a vendor’s or employee’s bank details by calling a number already in our records. We never use a number given in the request. A second person approves the change before the next payment.
- New payees and customers. We validate the account before the first payment or debit, using [prenotification, micro-entries, or an account validation service].
- Dual control. One person prepares each payment file, and a different person approves and releases it.
- Amount checks. Payments above $[threshold], or [x]% above a payee’s usual amount, need [a second approval, a call back].
- Access. Everyone who can create or release payments uses multi-factor authentication. We review user access every [quarter] and remove it the day someone leaves.
- Payroll descriptor. Direct-deposit wage credits carry “PAYROLL” in the company entry description. [Our payroll provider handles this; confirmed on (date).]
5. Monitoring after release.
- We reconcile ACH activity to our bank or processor reports every business day.
- We review returns [weekly] by return code and look into any unauthorized return (R05, R07, R10, R11, or R29) the same day.
- Each month, we compare our debit return rates with Nacha’s thresholds: 0.5% unauthorized, plus inquiry levels of 3% administrative and 15% overall.
- We review alerts from [processor name] the day they arrive.
6. When something looks wrong.
- Stop: don’t release the payment, and pause the file if it hasn’t gone out.
- Verify through a separate channel, using contact details already in our records.
- If a payment has gone out, call [processor or bank] at [phone number] right away and ask it to request a return. Recovery isn’t certain, so speed matters.
- Report business email compromise and other fraud to the FBI’s Internet Crime Complaint Center (IC3).
- Keep the emails, call notes, and payment records, and add the incident to our exceptions log.
- Review what happened and update this procedure.
7. Training. Everyone who prepares, approves, or releases ACH payments completes yearly training in [month] on this procedure and the warning signs of impersonation requests.
8. Records. We keep this procedure, its review log, and our exceptions log for [period set by our records policy].
9. Annual review. The owner reviews this procedure at least once a year. We also review it after a fraud attempt, a new payment type or system, a change of approvers, or a Nacha rule change.
| Review date | Reviewed by | What changed | Next review |
|---|---|---|---|
| [date] | [name] | [changes made] | [date] |
How Often Must the Procedure Be Reviewed?
At least once a year. The rule sets the annual review as a minimum, and Nacha notes that your circumstances may call for more frequent reviews (Nacha).
Tie the review to a date you already keep, such as your year-end close or each June, when phase 2 took effect. Review sooner after a fraud attempt, a new payment system, or new staff with release rights. Record each review in the log so you can show when it happened and what changed.
What to Do Next
- Name an owner this week. One person should be accountable for the procedure.
- List every ACH payment type you send, and who can create or release each one.
- Sort your payments into higher-risk and lower-risk, using the examples above.
- Fill in the template, then ask your processor which of its controls you can rely on.
- Train everyone who touches payments, including backups.
- Confirm the PAYROLL descriptor on your direct-deposit credits, especially if a payroll provider sends them.
- Put the annual review on the calendar, and start the review log.
For the wider set of controls, from account validation to business email compromise, read our guide to ACH fraud prevention for businesses. Our post on guarding against business email compromise covers the warning signs to train on.
How ReliaFund Helps
Our ACH processing includes encryption, fraud filters, and tokenization to store account information securely. Reporting goes down to the transaction level, with real-time status updates, alerts, and notifications.
We’re a member of the Third Party Payment Processors Association (TPPPA). Clients can call customer service at 1-763-226-2003, where a team member answers and directs your call. If you’re not a client yet, call 1-866-243-5040.
Frequently Asked Questions
Does the rule require a written procedure? The rule requires processes and procedures and an annual review, but it doesn’t prescribe a format. Writing them down is a practical way to show your bank, your processor, or an auditor what you do.
Can we rely on our processor’s fraud monitoring? Partly. Nacha lets parties on the sending side rely on each other’s controls when the basis is reasonable, clear, and backed by appropriate oversight. A contract is one example. But only you see some risks, like an email asking you to change a vendor’s bank account.
Does the rule cover ACH debits or only credits? The rule refers to entries in general. Much of Nacha’s focus is credit-push fraud, where a business is tricked into sending money. For debits you collect, account validation and return monitoring are the core controls. Our guide to ACH return codes explains what each return tells you.
What if a payroll provider sends our direct deposits? A provider that originates payments for you is also covered, as a Third-Party Sender or service provider. You still control who can change employee bank details in your own systems, so keep those controls in your procedure.
How does Nacha enforce the rule? Nacha enforces its rules through the banks that originate payments. Your origination agreement requires you to follow the rules, so your bank or processor may ask to see your procedure.
This article is general information. It isn’t legal or compliance advice. Confirm your obligations with your bank and legal counsel.
Sources
- Nacha: Fraud Monitoring Phase 1 and Fraud Monitoring Phase 2, including the phase 2 FAQ
- Nacha: Risk Management Topics, October 1, 2024 (false pretenses definition)
- Nacha: Company Entry Descriptions (PAYROLL and PURCHASE, March 20, 2026)
- Nacha: Supplementing Fraud Detection Standards for WEB Debits
- Nacha: Credit-Push Fraud Monitoring Resource Center
- Nacha: Tips for Originators to Comply with the 2026 Risk Management Rules (December 2025)
- Nacha: A Checklist Approach to Reduce Fraud in Payroll Origination (April 2023)
- Nacha: ACH Network Risk and Enforcement Topics (return rate thresholds)