Nacha Rule Changes 2026: What ACH Merchants Must Do

Three Nacha rule changes took effect in 2026, and two of them reach every business that collects payments by ACH or eCheck. Since June 19, 2026, every non-consumer ACH Originator must run risk-based fraud monitoring on the entries it originates, with no volume floor. And since March 20, 2026, consumer e-commerce debits for goods must carry the Company Entry Description "PURCHASE."

Neither of those two is aimed only at banks. If your business debits customer bank accounts, you are in almost every case the Originator under the Nacha Operating Rules — even when your payment processor is the party that transmits the file. This guide covers each 2026 change, who it applies to, what happens if you ignore it, and what to confirm with your processor.

What Are the New Nacha Rules for ACH Payments in 2026?

Four dates matter:

• March 20, 2026 — Phase 1 of the fraud monitoring rule took effect for all ODFIs and for non-consumer Originators, Third-Party Service Providers and Third-Party Senders with 2023 origination or transmission volume of 6 million entries or more.
• March 20, 2026 — The standardized Company Entry Descriptions "PAYROLL" and "PURCHASE" became mandatory for the payment types they cover.
• June 19, 2026 — Phase 2 removed the volume threshold. All non-consumer Originators, Third-Party Service Providers and Third-Party Senders are now in scope for fraud monitoring.
• September 18, 2026 — A separate change accelerates funds availability for non-Same Day ACH credits.

Are Nacha Rules Mandatory?

Yes. Nacha administers the ACH network and writes the Operating Rules that every participating financial institution agrees to follow. Your obligations flow through your ODFI and your origination agreement: the bank that sends your entries into the network is bound by the rules, and it binds you by contract. There is no opting out while you continue to originate ACH entries.

The official Operating Rules & Guidelines are published by Nacha and available directly from Nacha. A summary like this one is a starting point, not the rulebook.

What the Fraud Monitoring Rule Requires E-commerce Merchants to Do

The short answer: you must establish and implement risk-based processes and procedures, relevant to your role in authorizing or transmitting entries, reasonably intended to identify entries suspected of being unauthorized or authorized under false pretenses. You must also review those procedures at least once a year and update them for evolving risks.

Before 2026, the Nacha Rules required fraud detection in two narrow places: WEB debits and Micro-Entries. The 2026 amendment widens the obligation considerably.

Who Has to Comply, and Since When

The rule arrived in two phases. Phase 1, effective March 20, 2026, covered all ODFIs and the largest originators and third parties. Phase 2, effective June 19, 2026, eliminated the volume threshold entirely. That second date is the one that matters for most merchants: a business originating a few hundred eCheck debits a month was outside Phase 1 and is inside Phase 2. As of June 19, 2026, there is no size at which an ACH originator is too small for this rule.

A parallel requirement applies to RDFIs — the banks receiving entries — which must monitor incoming credit entries for fraud on the same two effective dates, with Phase 1 there set by a different threshold based on 2023 receipt volume.

How the Obligation Works in Practice

Nacha does not mandate any method or technology. It describes a risk-based approach: more scrutiny where you have assessed risk as higher, basic precautions where it is lower, and possible exemptions for very low-risk activity. The limit is explicit — a risk-based approach cannot be used to conclude that no monitoring is necessary at all. At minimum, you are expected to run a risk assessment separating higher-risk transactions from lower-risk ones.

The rules also let originating participants allocate these procedures among themselves. An ODFI may rely on what other participants in the origination chain are doing, provided the basis for that reliance is reasonable and clear — allocated by contract and verified by appropriate oversight. That does not make your obligation disappear; it means the work can be divided, and the division should be written down.

One point deserves flagging, because Nacha's own materials are not consistent about it. Its credit-push resource center describes the monitoring rules in terms of ACH credit entries initiated due to fraud, while the rule page and its FAQs describe the Originator obligation in terms of entries generally. If you originate debits and nothing else, the safe reading is that you are in scope.

What Counts as Fraud: False Pretenses and the Red Flags to Watch

The amendments introduced a defined term, False Pretenses: the inducement of a payment by a person who misrepresents their own identity, their association with or authority to act on behalf of someone else, or the ownership of an account to be credited. That covers business email compromise, vendor impersonation, payroll impersonation and other payee impersonations. It sits alongside the existing rules on unauthorized entries, which cover account takeover.

The red flags worth monitoring for follow directly from those fraud types: a vendor or employee asking to change the bank account on file, payment instructions arriving outside your normal channels, entries that spike in velocity or dollar amount against an account's history, and authorizations tied to identities you cannot verify.

There is a boundary merchants tend to get backwards. Nacha states the definition does not cover scams involving fake, non-existent or poor-quality goods or services. A customer claiming the product never arrived is a dispute, not a False Pretenses event under this rule. The obligation is about payments initiated by someone who is not who they say they are.

Do You Need a Specific Platform to Comply?

No. Nacha does not prescribe a vendor, system or technology. What the rule expects is that the controls you run — velocity checks, anomaly detection, dollar thresholds, change controls on payment instructions and vendor or payroll details — match the risks you have assessed in your own flow, and that they are written down. If you accept cards alongside ACH, the fraud screening built into your merchant account handles the card side; the ACH monitoring obligation is yours to document regardless.

What Happens If You Fail to Meet the Monitoring Obligations?

Enforcement runs through the network. Your ODFI answers to Nacha for the entries it originates on your behalf, so rules-enforcement pressure reaches you through that bank and your origination agreement.

The nearer-term consequence is commercial. Processors and sponsor banks reassessing an account can reasonably ask to see your written fraud monitoring procedures, and an originator that cannot produce them is a harder account to keep. For a business that leans on ACH because card acceptance is the part that keeps getting withdrawn, that rail is worth protecting. Our ACH merchant accounts built for high-risk industries are underwritten with these obligations in view, and we will tell you what your file needs before a bank asks.

The PURCHASE and PAYROLL Company Entry Descriptions

The Company Entry Description is a ten-character field in the Company/Batch Header Record — positions 54 through 63 — that tells the receiver what a payment is for. Usually the Originator picks the wording. As of March 20, 2026, two more values are mandated, giving receiving banks a consistent signal to monitor against.

When PURCHASE Applies

Any Originator collecting a consumer ACH debit for an online purchase of goods must put "PURCHASE" in the field. Nacha's examples:

• A one-time online purchase of a tangible good — clothing or jewelry, for instance.
• A recurring monthly payment for a tangible product where the subscription was signed up for online, such as a monthly vitamin subscription.
• An online purchase of a tangible good paid in multiple installments, such as Buy Now Pay Later.

These are WEB debits, except where the Standing Authorization rule permits the TEL code instead.

When It Does Not

Services are outside the rule. Nacha's examples of payments that should not carry the descriptor: one-time online payments for a service (a telehealth co-pay, shipping fees), recurring service payments authorized online (telephone and internet service, utilities, rent or lease, installment loans), licenses, monthly insurance payments, and gym memberships. Any business-to-business transaction is also excluded — if most of your volume is invoices between companies, business-to-business payment processing is the better fit for how those payments are classified and priced.

The distinction is what the consumer is buying, not how the payment recurs. A recurring debit for a physical product shipped monthly takes the descriptor; a recurring debit for a membership does not.

Digital Goods: Where the Guidance Disagrees

Nacha's FAQ defines a qualifying e-commerce purchase as a debit authorized online by a consumer for tangible, hard goods. Stripe's documentation describes the condition as physical or digital goods. Nacha writes the rule, so "tangible" is the safer reading — but if you sell downloads, digital subscriptions or software, do not settle this from a blog post, including this one. Ask your processor in writing how it classifies your transactions.

How the Field Is Populated

For payroll credits, "PAYROLL" must sit within the leftmost seven characters, with the remaining three free for your own use — "PAYROLL 02" works. That allowance is specific to PAYROLL. Two enforcement limits are worth knowing: the ODFI has no obligation to verify the presence or accuracy of "PURCHASE," and RDFIs are not required to act on either descriptor. Neither makes it optional for you — the requirement falls on the Originator regardless of whether anyone downstream checks.

How This Differs From Mastercard's Fraud Monitoring Program

The two are easy to run together, but they are separate regimes. Nacha's rules govern ACH entries. Card networks run their own fraud monitoring programs on card transactions — Mastercard's Fraud Monitoring Program among them — with thresholds the networks set and adjust themselves. The 2026 Nacha changes do not alter any card-network program. If you accept both cards and ACH, you are managing two distinct sets of monitoring obligations, and the current card-network thresholds that apply to your account are a question for your processor, not for the Nacha rulebook.

Where Regulation E and UCC Article 4A Fit

The 2026 amendments change the Nacha Operating Rules — private network rules — not federal regulation or state law. Consumer ACH debits also sit under Regulation E, which gives consumers rights around unauthorized debits and error resolution; corporate credit transfers sit under UCC Article 4A. Your monitoring has to operate alongside both frameworks: an unauthorized consumer debit still comes back as a return whatever your procedures say, and it pays to understand how ACH disputes and return codes work before one lands.

Why This Lands Harder on High-Risk Merchants

Businesses in verticals that mainstream processors decline lean on ACH and eCheck harder than most, precisely because card acceptance is the part that keeps getting withdrawn. That makes these rules an operating requirement on a rail you may depend on.

• You are almost certainly the Originator. Working through a Third-Party Sender does not shift the obligation onto them by default — it makes the allocation a question your contract should answer.
• Subscription and continuity merchants have a classification decision. Nacha's own example of a qualifying recurring purchase is a monthly vitamin subscription, so nutraceutical and physical-product continuity programs sit inside the PURCHASE requirement, while membership and service programs sit outside it.
• The annual review is a standing obligation, not a one-time project, and it presumes something written to review. Sponsor banks and processors reassessing an account can ask to see it.

A Practical Checklist

1. Confirm whether you originate ACH debits, credits, or both, and under which SEC codes.
2. Run a written risk assessment separating higher-risk from lower-risk transactions in your own flow.
3. Write down the monitoring you actually do — velocity checks, anomaly detection, dollar thresholds, and change controls on payment instructions and vendor or payroll detail changes.
4. Put a recurring calendar entry on the annual review so it does not lapse.
5. Ask your processor, in writing, how the Company Entry Description is set on your debits and whether your transactions are classified as goods or services.
6. Check a recent ACH file or processor report to confirm the descriptor your entries actually carry, and read your origination agreement for how fraud monitoring duties are allocated.

September 18, 2026: Earlier Funds Availability

A separate change took effect on September 18, 2026, and it affects when money lands rather than how you monitor it. RDFIs must make funds available for all non-Same Day ACH credits — next-day and two-day credits — by 9 a.m. local time on the settlement date, removing the old condition that the credit had to arrive by 5 p.m. the previous day. The obligation sits with the receiving bank, not with you, but if your business receives ACH credits — invoice payments, refunds, processor cashouts — it can mean earlier access to funds. A narrow exception covers certain RDFIs east of the Atlantic time zone and west of the international date line, including Guam and the Northern Mariana Islands.

The Bottom Line

As of June 19, 2026, there is no volume floor left on ACH fraud monitoring — if your business originates ACH debits, the rule reaches you. What it asks for is proportionate: assess your risk, write down the controls you run, review them once a year, and make sure whoever transmits your entries labels them correctly.

The two things most merchants still need to do are confirm with their processor how the Company Entry Description is populated, and get their fraud monitoring procedures onto paper. If ACH or eCheck is a meaningful part of how you collect, both are worth handling before someone asks to see them. If your current processor cannot answer those questions in writing, contact us — high-risk ACH is work we do every day, and we will tell you what your setup needs within one business day.