2026 NACHA rules changes: What you need to know

NACHA is releasing updates to the NACHA operating rules in 2026 to improve fraud prevention and ACH payments across the U.S. These changes will significantly impact the payments industry. As a result, organizations will need to manage compliance, risk, and operational processes differently. If your company is currently producing ACH files for either Vendor or Payroll payments, a change to your current ERP system setup may be needed.

To reduce fraud and increase transparency, NACHA is introducing two standardized company entry descriptions:

• Payroll: For ACH credits related to employee wages and compensation.
• Purchase: For ACH debits authorized by a consumer for the online purchase of goods, including recurring purchases first authorized online.

These descriptions must be included for all ACH entries. Therefore, the data and information in the ACH files must be updated accordingly to ensure compliance. They must also be included in the company entry description field of ACH files. Be sure to update your ACH systems to comply with these NACHA rules.

NACHA is rolling out a phased approach to fraud detection:

• Phase 1 (March 20, 2026): Large originators and third-party senders (TPS) must have fraud detection systems in place. This requirement applies to both originators and third-party senders.
• Phase 2 (June 22, 2026): All other originators and receiving depository financial institutions (RDFIs) must implement similar fraud monitoring.

These rule amendments require all ACH network participants to implement processes to identify fraudulent transactions within the ACH network. Participants need to understand these changes and ensure compliance with the new requirements.

The new measures are designed to detect and prevent fraudulent transactions, including business email compromise (BEC) and vendor impersonation scams. This helps organizations comply with NACHA rules while protecting against payment fraud.

Review your current ACH processes and update them as needed to comply with the new NACHA rules. Organizations should adopt the updated formats provided by NACHA to ensure full compliance. This includes updating ACH file formats for the new company entry descriptions and ensuring your fraud detection systems meet the new requirements.

Develop procedures for monitoring and responding to suspicious activities. Create new processes and protocols tailored to your organization’s needs. Ongoing work is required to maintain compliance and adapt to evolving threats. Using a third-party service can further strengthen your fraud prevention efforts by providing specialized expertise and tools. Organizations are encouraged to take proactive steps such as staff training, policy updates, and investing in technology to detect and prevent fraud.

Keep records of all compliance activities, including system updates, training, and fraud monitoring. Each user should maintain documentation of their access and authentication activities. Documentation should also include information about rights and access related to ACH transactions, as well as relevant regulatory content, such as updates to the NACHA operating rules. Proper documentation proves compliance during audits.

The 2026 NACHA rules are a major step toward stronger fraud prevention and standardized ACH. Organizations that update their systems, implement fraud detection procedures, and maintain thorough documentation will comply with the new NACHA rules and be protected from payment risk.

Not sure about your setup or need guidance with the new NACHA rules? Contact us to review your ACH processes, ensure compliance, and protect your organization.