NACHA rule updates

Stay informed about upcoming NACHA Operating Rule changes that may impact ACH origination, authorization requirements, fraud monitoring, risk management, and transaction processing. Review the updates below to understand how these changes may affect your organization and any actions needed to maintain compliance and ensure uninterrupted ACH services. For additional details and industry guidance, visit nacha.org.

2026

Use of Return Reason Code R17 "questionable" for posted entries*

Definition of "Banking Day" — removal of reference to participating DFI

Clarification of RDFI requirement to provide payment-related information to non-consumer receivers of CCD, CTX, CIE, and IAT entries*

Risk Management topics — Company Entry Descriptions*

Effective March 20, 2026

This NACHA rule requires companies to use standard descriptions — "PAYROLL" for wages and "PURCHASE" for online goods purchases — when sending certain ACH transactions. This helps banks better identify the purpose of payments, improving fraud detection and risk monitoring. While banks can use this information to enhance controls, they are not required to act on it, and originating banks don’t have to verify that companies use the descriptions correctly.

Visit NACHA Risk Management topics — Company Entry Descriptions

Risk Management topics — (Fraud Monitoring Phase 1)*

Effective March 20, 2026

The rule requires these entities to implement risk-based fraud monitoring processes designed to detect ACH entries initiated through fraud. The goal is to reduce successful fraud attempts by establishing ongoing monitoring that identifies unusual activity. Previously, Nacha fraud detection requirements were limited primarily to WEB debits and Micro-Entries; this amendment expands fraud monitoring expectations across a broader range of ACH transaction types.

Applies to all ODFIs and non-consumer Originators, Third-Party Senders (TPSPs), and Third-Party Service Providers (TPSs) that originated 6 million or more ACH transactions in 2023.

Visit NACHA Risk Management topics — (Fraud Monitoring Phase 1)

RRisk Management topics — (Fraud Monitoring Phase 2)*

Effective June 19, 2026

Phase 2 expands the fraud monitoring requirements introduced earlier in March 2026 to cover all remaining participants in the ACH network, including smaller businesses and financial institutions.

It completes the rollout so that fraud monitoring is required across the entire ACH ecosystem. Applies to all remaining non-consumer originators and third parties not covered in Phase 1 requires them to implement fraud monitoring processes and procedures for ACH payments they initiate.

Visit NACHA Risk Management topics — (Fraud Monitoring Phase 2)

Funds availability requirements for non-same day credit entries*

Definition of IAT entries

Effective September 18, 2026

ACH payments will be more clearly identified as international if any part of the transaction involves a non-U.S. financial institution. This helps banks apply the correct processing and security requirements, which may mean some payments are handled differently to ensure compliance and safer cross-border transactions.

Visit NACHA definition of IAT entries

2027

Registration of IAT contacts in the ACH contact registry

Effective January 1, 2027

All banks (Participating DFIs) must add dedicated contact information for handling International ACH Transactions (IATs) to the ACH Contact Registry.

They must provide either, a primary and secondary contact person (name, title, email, phone), or a department contact (shared email and phone number).

These contacts must be actively monitored and available during normal business hours. This requirement follows the same structure already used for ACH operations and fraud contacts. Banks must also keep the information updated (within 45 days of changes) and verify it annually. The goal is to ensure banks can quickly reach the right contact at another institution when there’s an issue with an international ACH payment.

Visit NACHA registration of IAT contacts in the ACH contact registry

International ACH transactions (IAT)

Increasing the Same Day ACH dollar limit to $10 million*

Effective September 17, 2027

NACHA will increase the Same Day ACH transaction limit from $1 million to $10 million per payment, allowing much larger transfers to be processed the same day. This higher limit applies broadly to both credits and debits, for consumer and business payments, across all Same Day settlement windows, supporting use cases like large business payments and same-day reversals. However, international (IAT) transactions and certain check-based entries (ARC, BOC, POP, RCK, XCK) remain excluded or subject.

Visit NACHA increasing the Same Day ACH dollar limit to $10 million

2028

New Return Reason Code for sanctions compliance obligations*

Effective March 17, 2028

This NACHA rule introduces a new return code, R90, specifically for payments returned due to sanctions compliance, separating it from R16, which will now only indicate an account freeze or legal restriction. This change removes confusion by clearly identifying the reason for a return, allowing banks and businesses to take the correct actions more quickly. In addition, R90 returns must be processed within two banking days after a sanctions issue is identified, giving banks time to complete required screening while ensuring timely notification.

Visit NACHA new Return Reason Code for sanctions compliance obligations

* This NACHA rule update applies to Fremont Bank and may result in changes affecting Bank ACH processing and certain payment activities.