Hot Topics

ACH RISK Management Rules

The clock is ticking. Are you prepared? Are you preparing?

Phase One:   March 20, 2026

On this day, the rule applies to non-consumer Originators, ODFIs, Third-Party Senders; and Third-Party Service Providers with annual ACH origination volume of six million or greater in 2023.

Phase Two: June 19, 2026

The rules go into effect for all other Non-Consumer Originators, Third-Party Senders and Third-Party Service Providers.

What changes?

NACHA currently requires RDFIs screen Web Debits and Micro entries.  The amendment will require all ODFI, each non-consumer originator, Third-Party Service Providers and Third-Party senders to establish risk based processes and procedures to identify ACH items that are fraudulent.

What are the new responsibilities?

Many Financial Institutions already use systems for AML or BSA that could be extended to ACH monitoring.  There are also Fraud Detection Platforms that would allow you to check velocity limits, anomalies, etc.  There will be a new emphasis on mule accounts, dormant or inactive accounts, originator behavior, new senders, unexpected behavior or amounts.

How do I prepare?

How can you implement smarter, faster, risk-based processes and procedures?

• Do you want to develop this internally?

• Do you need to consider outside tech or vendor products?   

• Have you approached your core provider?

• Educate your originators. Are they using multi-factor authentication or physical tokens?

• Do they authenticate requests for changes to existing files?

Consider:

Whatever you decide to do, monitoring must be consistent, auditable, and scalable.

Your annual ACH Audit will now include a review of your process and procedures. Monitoring does not have to be done prior to processing.

If you would like more detailed information search for The Payments Professor, Kevin Olsen, and his presentation, New Fraud Monitoring Rules (ACH), on YouTube.

by Kas Stewart, SVP & AAP