NACHA 2026 ACH Fraud Monitoring, Company Entry Descriptions, Funds Availability, & IAT Definition Updates

NACHA has approved several significant ACH Rule amendments taking effect
in 2026 as part of its broader Risk Management Strategy. These updates are
designed to address the continued rise in ACH fraud, including business email
compromise (BEC), vendor impersonation, and payroll diversion. The changes
affect Company Entry Descriptions, ACH Fraud Monitoring obligations for
Originators, Third-Party Service Providers, Third-Party Senders and ODFIs,
and ACH Credit Monitoring expectations for RDFIs, Funds Availability for non
Same Day ACH credits, and the definition of International ACH Transactions
(IAT). With compliance dates approaching, financial institutions and ACH
Originators should begin preparing now if they have not already.

Company Entry Descriptions (Effective March 20, 2026)

  • PAYROLL – For wages, salaries, and similar compensation, the
    Company Entry Description must contain “PAYROLL.”
  • PURCHASE – For e‑commerce purchases, the Company Entry
    Description must contain “PURCHASE.” An e‑commerce purchase is a
    WEB debit authorized by a consumer for online purchases (including
    recurring purchases first authorized online); certain TEL debits are
    included when used under Standing Authorizations.

Organizations may adopt these descriptions immediately; March 20, 2026, is
the mandatory compliance date. More information on Company Entry
Descriptions can be found here.

ACH Fraud Monitoring – ODFIs / Originators / TPSPs / TPS

Phase 1 (Mar 20, 2026): Applies to all ODFIs and to non‑consumer
Originators/TPSPs/TPSs with ≥6 million originated entries in calendar year
2023.

Phase 2 (Jun 22, 2026): Extends to all remaining non‑consumer
Originators/TPSPs/TPSs.

Beginning in 2026, fraud monitoring is no longer limited to WEB debits and
Micro-Entries. Affected parties must implement risk-based processes and
procedures to identify entries initiated due to fraud – including those authorized
under false pretenses (payer was deceived about identity,
authority/association, or account ownership) (e.g., BEC, vendor impersonation,
payroll redirection).

NACHA clarified that:

  • Fraud monitoring is not required pre‑processing; post‑processing
    monitoring is allowed.
  • The prior “commercially reasonable” standard has been removed.
  • Requirements apply “to the extent relevant to the role the entity plays,”
    and ODFIs may consider steps taken by other participants when
    determining their own controls.

Key expectations include:

  • Documented, risk-based fraud monitoring procedures
  • Annual review and update of fraud monitoring processes
  • ODFI oversight ensuring Originators and Third Parties maintain compliant
    procedures
  • Training and enhanced review of higher-risk areas warranting enhanced
    oversight, including:

    • Payments to new Receivers
    • Sudden changes to existing Receiver account information
    • Dual-control and approval practices
    • Secure handling of sensitive account data
    • Staff training and annual procedural reviews

ACH Credit Monitoring – RDFIs

Phase 1 (Mar 20, 2026): RDFIs with ≥10 million ACH received entries in 2023.

Phase 2 (Jun 22, 2026): All remaining RDFIs

RDFIs must implement risk‑based processes and procedures to identify
suspicious or anomalous ACH credit activity, including credits that are
unauthorized or authorized under False Pretenses, and must review and
update these processes at least annually.

Two response expectations to be sure to include in your procedures are:

  • RDFIs may return suspect credits using R17 “QUESTIONABLE”, which,
    as of January 1, 2026, may be used even after posting, provided
    “QUESTIONABLE” appears in the addenda.
  • RDFIs should contact the ODFI via the ACH Contact Registry when
    investigating potentially fraudulent inbound credits.

Funds Availability for Non–Same Day ACH Credits (Effective September 18, 2026)

NACHA has eliminated the prior 5:00 p.m. local time receipt condition. RDFIs
must make non–Same Day ACH credits available no later than 9:00 a.m.
(RDFI local time) on Settlement Date. Institutions should review core
processing windows (including the 6:00 a.m. ET ACH Operator file) and job
schedules to meet this timing.

International ACH Transactions (IAT) Revised Definition (Effective September 18, 2026)

NACHA has refined the definition of an IAT to be the U.S. ACH network
component of an international payment where the funds originate, transit, or
are delivered via an office or facility of a financial agency located outside the
U.S. The revised definition also clarifies that an IAT cannot be a Same Day
Entry. Review onboarding/classification logic, contracts, and exception
handling accordingly.

Recommended Preparation Steps

Banks and ACH Originators should begin preparing by:

1. Evaluating current fraud monitoring and authorization practices for gaps
2. Documenting risk-based fraud monitoring procedures and escalation
paths
3. Ensuring systems support the required Company Entry Descriptions
4. Updating policies related to new Receivers and account-change red flags
5. Training Staff on social engineering and verification expectations
6. Reviewing Originator and Third-party agreements for alignment with new
Rules

To support implementation, CCI has also provided a Change Management Log
for banks to track and document each required update. This tool helps ensure
that no steps are missed during the transition and provides banks with clear,
regulator-ready documentation of how the changes were implemented.

Download the Change Management Log Here: Change Management Log

CCI suggests sharing this update with your bank’s ACH Operations and/or
Treasury Management teams. Contact CCI for any implementation assistance
questions at inquiries@completecompli.com.

Jackie Smith, CRCM, FLE