Hot Topics - August 2025

by Kas Stewart, SVP & AAP

ISO20022 has been implemented. This was so much more than a system upgrade, it is a fundamental change to how we all move money. Processes have changed, which means we all must make some adjustments, but soon this will become routine and comfortable. 

NACHA will be adding five new rules in October 2025 through June of 2026 related to fraud risk. These apply to both originators, third party senders and receiving financial institutions at various dates during this timeframe.

The first implementation is for ODFIs, Third Party Senders and Third Party Service Providers, and Originating Financial institutions with more than 10,000,000 items in 2023. The deadline for this is March 2026.

The second phase of implementation is June 2026 and applies to all others. 

You may want to review the risk management framework on the NACHA website as well as the rules. There is also a webinar presented by Debbie Barr that provides great detail.

It will be up to each bank to decide how they will monitor and what solution they will use to carry out this process.

NACHA is not expecting technical solutions, although that is an option. What they expect to see is risk-based processes and procedures. Suggestions include beginning the process now by reviewing your ACH risk assessment and then also performing a Gap analysis, establishing some parameters/red flags based on certain entry class codes or monitoring for anomalies in the value of items received by customers. And beyond deciding how you identify fraud, the steps you will take after the fraud is detected. They will expect to see documentation when you perform your annual ACH audit.

There is no expectation that every transaction is checked. The monitoring does not have to be done prior to posting. Deciding that you have no risk and doing nothing is not acceptable. 

On a separate note, NACHA has also recommended a best practice for ACH returns. Use Same Day ACH files for return entries that were not received as same day ACH.