Nacha Fraud Monitoring Updates, Risk Management

9 December 2025
Megan Williams
No comments
Categories: ACH, Lenders, Merchants, Payments

Nacha Fraud Monitoring Updates

As 2025 comes to a close, attention is shifting to 2026 and the next wave of changes in the ACH Network. Nacha has announced several upcoming rule amendments that strengthen risk management expectations, clarify existing requirements, and introduce new monitoring obligations for ACH participants. This article outlines the key updates so businesses can understand what to expect as these Rules take effect throughout 2026.

Some of the changes are minor clarifications that will have limited impact on most participants. Others, particularly those related to fraud monitoring, represent more meaningful shifts in expectations. Not all changes will apply to every Originator, Third Party Sender, or ODFI, but all ACH participants should be aware of what is coming.

Effective January 1, 2026

Use of Return Code R17 “Questionable”
This update clarifies the proper use of R17 rather than introducing a new return code. Under the revised definition, an RDFI may return an entry as “Questionable” when it believes the transaction or Receiver information is inaccurate, incomplete, or inconsistent with what it knows about the account. This change provides clearer guidance for RDFIs and creates earlier feedback for Originators when something about the entry appears suspicious.

Banking Day Definition Clarification
This is not a substantive change but a clarification. It confirms that a “Banking Day” is defined as a day on which the ACH Operator is open for business. The goal is to remove ambiguity and ensure uniform interpretation across the network.

RDFI Requirement to Provide Payment-Related Information
Several SEC Codes require RDFIs to provide Payment-Related Information to Receivers. These include CCD, CTX, CIE and IAT. The updated Rule clarifies that this requirement does not apply if these entries post to a consumer account. The expectation only applies when the Receiver is a non-consumer.

Company Entry Descriptions
These amendments take effect March 20, 2026 and apply to both credits and debits. Originators may adopt the new descriptions before the effective date. The changes support standardization and enhanced monitoring across the network.

ACH Credit Entry
The Company Entry Description for credits that represent wages or other compensation must contain the description PAYROLL.

ACH Debit Entry
For ACH WEB debits that represent the online purchase of goods, including recurring purchases first authorized online, the Company Entry Description must contain the description PURCHASE.

Risk Management Rule Updates
The most significant changes relate to fraud monitoring. Nacha is introducing new requirements for Originators, ODFIs, Third Party Service Providers, and Third Party Senders, along with a separate monitoring requirement for RDFIs. These Rules are being phased in during 2026.

Fraud Monitoring Obligations

These new expectations apply to ODFIs, non-consumer Originators, TPSPs, and TPSs. The requirements take effect in two phases.

Phase 1: March 20, 2026
Applies to participants with annual origination volume of 6 million or more in 2023.

Phase 2: June 19, 2026
Applies to all remaining non-consumer Originators, TPSPs, and TPSs not included in Phase 1.

The purpose of the amendment is to ensure participants establish and implement risk-based processes and procedures designed to identify potentially fraudulent entries. Routine monitoring is expected to reduce the likelihood of successful fraud attempts and strengthen the entire ACH ecosystem.

Today, Originators of WEB debits and users of Micro-Entries must utilize a “commercially reasonable fraudulent transaction detection system”. The updated Rule removes that terminology. The phrase “commercially reasonable” and the expectation of a “transaction detection system” are replaced with more practical language that focuses on processes and procedures.

This shift clarifies that Nacha is not prescribing specific technologies. Instead, entities must maintain documented processes that demonstrate how they reasonably identify and respond to fraud risks, based on the role they play in the ACH Network. The flexibility allows organizations of different sizes and risk profiles to implement approaches appropriate to their environments.

Nacha requires that these processes and procedures be reviewed at least annually, or sooner if material changes occur during the year.

RDFI ACH Credit Monitoring

This update adds new expectations for RDFIs related to monitoring of incoming ACH credits. The Rule does not impose new obligations on Viking Originators but is part of Nacha’s broader fraud prevention strategy.anges, reach out to your Viking representative today.

Preparing for 2026 and Beyond

As these updates take effect in 2026, ACH participants should take time to review their current practices, confirm that documentation is up to date, and ensure fraud monitoring processes align with Nacha’s expectations. While some of the changes are minor clarifications, others require operational adjustments that strengthen risk management across the network. Viking will continue to monitor these developments and support our clients through each phase of implementation to ensure a smooth and compliant transition.

Return to Viking Resource Center

December 9, 2025

About Megan Williams

She is a dedicated payments professional with a passion for operational processes, efficiencies and a love for the Rules. She has been in the financial services industry since 2016, strengthening her understanding of the space and obtaining her ACH Certification (AAP). She specializes in optimizing operations, enhancing payment processes and ensuring compliance in all matters of her job and this industry. 

Learn More

Bigger Possibilities Await.

Contact Us


Read More

New ACH Rules: What Originators and RDFIs Must Know in 2025

17 July 2025
Megan Williams
No comments
Categories: ACH, Lenders, Merchants, Payments

New ACH Rules
What Originators and
RDFIs Must Know in 2025

With ACH fraud risks rising, Nacha has introduced key updates, some in effect now and others phasing in through 2026. Here’s what you need to know and act on today.

Credit Push Fraud Risk Management Framework

Credit push fraud, such as Business Email Compromise(BEC) or vendor impersonation, is a growing threat,  and Nacha has reinforced roles and protocols to combat it. In a typical BEC scenario, fraudsters gain access to or spoof a legitimate business email account to trick someone into sending an ACH credit or wire transfer to a fraudulent destination. These attacks often involve fake invoices, altered payment instructions, or urgent requests that appear to come from a trusted internal or external source. As these scams become more sophisticated, financial institutions and businesses must adapt their defenses accordingly.

Receiving institutions must now monitor incoming credits and have risk-based procedures to identify and act on suspicious entries.

ODFIs and RDFIs are encouraged to communicate when suspected fraud is identified. A secure exchange portal is now available for handling return requests, particularly under R06.

Institutions should also educate business and consumer clients about common fraud tactics to increase vigilance before a transaction is initiated.

False Pretenses Transactions

Nacha has introduced a new classification called False Pretenses (which is included in the R17 return code). This covers payments induced by misrepresentation of identity, authority, or account ownership. Examples include payroll impersonation and vendor fraud. It does not apply to scams involving fake products or services.

Return Reason Code R17 – “Questionable”

RDFIs can now use R17 to return entries they believe may be fraudulent, even if the receiving account is valid.

The word “QUESTIONABLE” must be included in the addenda record when this return reason is used.

Return Reason Code R06 – Broader Return Requests

ODFIs can now request returns through the Letter of Indemnity (LOI) process using R06 for other reasons that are applicable to the scenario, such as suspected fraud.

RDFIs must respond to R06 requests within 10 Banking Days. That response can be either a return or a formal status update. A secure exchange portal is available to facilitate these requests and responses.

WSUD Deadline Extended

The Written Statement of Unauthorized Debit (WSUD) no longer needs to be signed by the settlement date. It may now be signed on or after the effective date of the debit, offering greater flexibility for account holders disputing unauthorized transactions.

Fraud Monitoring Requirements for Originators and ODFIs

Beginning in 2026, Nacha will require risk-based fraud detection processes for all Originators and ODFIs. The requirement will take effect in two phases.

Phase 1 begins in March 2026 and applies to Non-consumer Originators (and vendors) with 2023 ACH origination volume of 6 million or greater.

Phase 2 begins in June 2026 and applies to all others.

Processes must be reviewed annually. There is no requirement to review each individual transaction or to conduct manual review before file submission. Instead, participants must establish reasonable procedures to flag suspicious activity based on patterns, amounts, frequency, or account behavior.

Credit Monitoring Requirements for RDFIs

Receiving institutions must implement a risk-based credit monitoring process and respond appropriately when suspicious activity is identified.

This process should be reviewed annually to ensure it remains effective. Monitoring does not require line-by-line transaction reviews, but should include logic to detect red flags such as:

  • SEC codes that do not match account types
  • Unusually large credit amounts
  • Multiple credits from different states

What You Should Do Now

  • Update your fraud detection processes
  • Train your staff on new classifications like False Pretenses and changes to R17 and R06
  • Ensure your systems support the new entry descriptions PAYROLL and PURCHASE
  • Prepare for the phased rollout of the fraud monitoring requirements
  • Review WSUD policies to allow for signature on or after the effective date
  • Test your response time and documentation process for R06 return requests

Final Thoughts

These updates strengthen the ACH ecosystem and clarify roles and responsibilities across all parties. With deadlines extending into 2026, now is the time to make adjustments, train your staff, and ensure your ACH operations align with Nacha’s evolving standards.

At Viking, we build solutions like VIKEngage, VIKExpress, and VIKEdge with these compliance needs in mind. Whether you need real-time monitoring, simplified return processes, or tools to minimize fraud risk, we’re here to help.

If you have questions about your readiness or need support implementing these changes, reach out to your Viking representative today.

Return to Viking Resource Center

July 17, 2025

About Megan Williams

She is a dedicated payments professional with a passion for operational processes, efficiencies and a love for the Rules. She has been in the financial services industry since 2016, strengthening her understanding of the space and obtaining her ACH Certification (AAP). She specializes in optimizing operations, enhancing payment processes and ensuring compliance in all matters of her job and this industry. 

Learn More

Bigger Possibilities Await.

Contact Us


Read More

Common ACH Audit Findings

22 June 2025
Tracey Gibson
No comments
Categories: ACH, Lenders, Merchants, Payments

Common ACH Audit Findings
and How to Stay Compliant

Every year, businesses that originate ACH transactions are subject to an ACH audit, as required by the NACHA Operating Rules. While many audits go smoothly, there are a handful of recurring issues that pop up year after year. Some are simple, others potentially serious. Whether you’re preparing for an upcoming audit or looking to tighten up your existing ACH practices, understanding these common findings is a smart place to start.

Below are some of the most frequent ACH audit findings, along with insights and recommendations for how to avoid them:

NACHA Guidelines, Chapter 56

Chapter 56 of the NACHA Rules covers the audit requirements that every ACH Originator and Third-Party Sender must follow. It requires an annual audit to ensure compliance with the NACHA Operating Rules and recommends documentation for each key function. Failure to perform this audit or maintain documentation can result in non-compliance findings.

Tip: Make sure your audit is performed annually by a qualified party and that you retain clear documentation of the audit scope, findings, and corrective actions taken.

Annual Review of NACHA Contact List

NACHA requires that each company maintain and annually review its contact information in NACHA’s database. This ensures that your organization can be contacted in the event of a network or transaction issue.  [When working with Viking, this information is located on Schedule E of your ACH Origination Agreement]

Tip: Set a calendar reminder to review and update your NACHA contact list every 12 months.

Annual ACH Risk Assessment Must Include Risk Ratings

The Risk Assessment is more than a formality. NACHA expects a formal risk assessment document that includes risk ratings for each threat and control in your ACH process.

Tip: Document not only risks, but also the impact, likelihood, and controls in place. Assign risk levels to each category, such as Low, Medium, or High.

Proper Use of SEC Codes

Improper use of Standard Entry Class (SEC) Codes, such as using PPD instead of WEB for internet-authorized transactions, is a frequent finding.

Tip: Confirm that every transaction is being coded appropriately. For example:
• PPD: Prearranged payment and deposit (consumer, pre-authorized)
• WEB: Consumer-initiated internet or mobile transactions
• TEL: Telephone-initiated

Origination Agreements Missing or Incomplete

Originators are required to have signed agreements with all parties involved in ACH transactions, including clear authorization language and responsibilities.

Tip: Review your agreements annually and ensure all parties are documented and acknowledged in writing.

Failure to Act on Notice of Change (NOC)

When a financial institution issues a Notice of Change, you’re required to update your records before the next transaction or within six banking days, whichever comes first.

Tip: Assign ownership of NOC monitoring and include this step in your daily ACH processing checklist.

Return Processing Inconsistencies

ACH returns must be processed quickly and accurately. A delay in responding to unauthorized debits or incorrect return coding is a compliance risk.

Missing “RETRY PYMT” Code for Reinitiated Payments

If a payment is reinitiated due to insufficient funds, NACHA rules require the word “RETRY PYMT” in the Company Entry Description field. Without it, the transaction could be flagged as unauthorized.

Tip: Automate the insertion of “RETRY PYMT” into all reinitiated NSF entries to ensure compliance.

Lack of a Business Continuity Plan

Many businesses fail to create or test a formal Business Continuity Plan for ACH operations, which is a NACHA expectation.

Tip: Draft a documented plan outlining how ACH processing will continue in the event of a disruption. Test it annually and keep logs of those tests.

Missing or Outdated Reg E Disclosures

The Electronic Funds Transfer Act (Regulation E) requires specific consumer disclosures, such as dispute rights and liability limits. These must appear on account statements or statement backers.

Tip: Review your Reg E disclosures annually and confirm that consumers receive them through appropriate channels.

Terms and Conditions Lacking ACH Language

Many merchant agreements and consumer-facing Terms and Conditions lack clear language about ACH authorization, dispute procedures, and usage of recurring entries.

Tip: Add a section to your Terms and Conditions that explains how ACH transactions are authorized and handled. Include clear consent language.

Final Thoughts

Being prepared for your next ACH audit starts with awareness. These common findings don’t just reflect compliance oversights, they point to real operational risks that could lead to fines, returns, or customer dissatisfaction.

Want help tightening up your ACH processes? Reach out to your Viking representative today.

Return to Viking Resource Center

June 22, 2025

About Tracey Gibson

She is an accomplished compliance executive with extensive experience in overseeing and managing compliance functions and initiatives of an organization. She has expertise in ensuring organizations comply with regulatory requirements and brings a strong background in ethical business practice, risk management, privacy, employee management and customer service.

Learn More

Bigger Possibilities Await.

Contact Us


Read More

Understanding ACH Reversals: When and How to Use Them

27 May 2025
Megan Williams
No comments
Categories: ACH, Lenders

Understanding ACH Reversals
When and How to Use Them

The Automated Clearing House (ACH) network facilitates millions of financial transactions daily, making it an essential component of the U.S. payment system. However, errors can occur, necessitating the use of ACH reversals. Understanding the Rules and appropriate use of ACH Reversals is crucial for Originators to ensure compliance and maintain transaction integrity.

What is an ACH Reversal?

An ACH Reversal is the process of correcting a previously processed ACH transaction by withdrawing the funds from the recipient’s account and returning them to the Originator. This process is governed by specific rules outlined by Nacha (National Automated Clearing House Association) to prevent misuse and ensure that Reversals are only used in legitimate circumstances.

When Can ACH Reversals Be Used?

ACH Reversals can only be initiated under specific conditions, as defined by the Nacha Operating Rules and Guidelines. According to Nacha, these conditions include:

  1. Duplicate Transactions: When a single transaction is processed more than once.
  2. Incorrect Amount: When the amount of the transaction is incorrect.
  3. Incorrect Account: When the transaction is credited to the wrong account.
  4. Payment Originator Error: Any error that is attributable to the originator of the transaction, such as entering incorrect transaction information.

It is important to note that ACH Reversals are time-sensitive. Nacha rules stipulate that reversals must be initiated within five banking days from the settlement date of the original transaction.

Differences Between ACH Reversals and ACH Returns

While ACH Reversals are initiated by the Originator to correct errors, ACH returns are typically initiated by the receiving financial institution (RDFI). ACH returns occur when the recipient’s bank is unable to process the transaction due to reasons such as insufficient funds, closed accounts, authorization concerns or fraud.

Process of Initiating an ACH Reversal

The process of initiating an ACH Reversal involves several steps:

  1. Identify the Error: Determine the nature of the error that necessitates a Reversal.
  2. Notify the Receiving Party: Inform the recipient of the erroneous transaction and the forthcoming Reversal.
  3. Initiate the Reversal Entry: The Originator’s financial institution (ODFI) will create a reversing file entry using the appropriate ACH information.
  4. Include “REVERSAL” in Description: It is mandatory to include the word “REVERSAL” in the Company Entry Description field of the Reversal entry.
  5. Compliance Check: Ensure that the Reversal complies with Nacha Rules, including the five-day timeframe and the specific conditions under which Reversals are allowed.

Best Practices for Managing ACH Reversals

To effectively manage ACH Reversals and minimize potential disputes or compliance issues, Originators should adopt the following best practices:

  • Accurate Data Entry: Ensure that all transaction data is accurate before initiating ACH transactions.
  • Timely Action: Act promptly to identify errors and initiate Reversals within the permissible timeframe.
  • Clear Communication: Maintain transparent communication with all parties involved in the transaction, especially when an error occurs.
  • Regular Audits: Conduct regular audits of ACH transactions to quickly identify and rectify any discrepancies.
  • Minimize Use: Only allow authorized staff to initiate.

By understanding and adhering to Nacha’s rules on ACH Reversals, Originators can efficiently correct transaction errors while maintaining compliance and minimizing the risk of disputes. For further details on the rules and best practices related to ACH Reversals.

Return to Viking Resource Center

May 27, 2025

About Megan Williams

She is a dedicated payments professional with a passion for operational processes, efficiencies and a love for the Rules. She has been in the financial services industry since 2016, strengthening her understanding of the space and obtaining her ACH Certification (AAP). She specializes in optimizing operations, enhancing payment processes and ensuring compliance in all matters of her job and this industry. 

Learn More

Bigger Possibilities Await.

Contact Us


Read More