2026 Nacha rule changes: What community banks should know

In 2025, Nacha issued several updates to the ACH operating rules addressing changes in payment behavior and fraud risk that will be effective soon. These updates affect all participants in the ACH network, including community banks. While the changes introduce new expectations, they reinforce sound practices many community banks already follow. This article outlines key changes and tries to explain why they matter, along with practical considerations for community banks. .The rules were updated as ACH payments continue to grow in volume and importance, for instance, supporting payroll, vendor payments, bill payments, and online transactions. At the same time, fraud patterns have shifted and banks have suffered from an increasing number of losses from deceiving customers into sending payments directly rather than stealing customer information. Some examples of these fraud schemes include vendor impersonation, payroll diversion, and email credentials compromise. These situations often involve authorized transactions initiated based on false information. As such, the rule changes aim to: • Improve clarity and consistency of ACH transactions. • Accelerate funds availability while maintaining risk awareness and strengthen fraud prevention across the ACH network. For community banks, the balance lies in implementing reasonable fraud controls, clear documentation guidelines and generating staff awareness. One of the key changes in the rules is the expansion of fraud monitoring requirements. Under the updated rules, ACH participants must maintain risk-based processes designed to identify potentially fraudulent ACH transactions. It is important to mention that the rules do not mandate any specific software, models, or thresholds. Instead, they focus on whether ACH participants, such as community banks, have reasonable monitoring practices relative to their size, volume of transactions, and number of customers. The rule changes become effective in two phases: • March 20, 2026: For large and high-volume ACH participants (over 6 million ACH entries originated, or over 10 million credit entries received)• June 19, 2026: All remaining participants, including most community banks While most community banks already perform some level of ACH review, one of the key expectations is that these practices are formalized and documented. Some examples include documentation on the following activities:• Review activity from new or infrequent originators. • Identify sudden increases in transaction volumes or dollar amounts. • Assess ACH-related customer complaints. • Review unusual ACH origination activity. It is important to highlight that the expectation is not to eliminate all fraud through these tasks but to demonstrate intentional and consistent oversight and management of ACH risk. The new rules also update fraud-related definitions to reflect current risks. One change is the recognition of fraud occurring under false pretenses, where a payment is authorized but based on deception. Some examples include: • An employee changing payroll instructions due to impersonation• A consumer authorizing a payment after suffering a fraud, and • A business sending ACH credit after receiving a fraudulent vendor email. These cases were difficult to classify because the transactions were authorized. However, the new rule acknowledges this type of fraud is common and requires attention. For community banks, this new focus translates into the need to educate staff to recognize these patterns, establish clear escalation procedures, and educate and work with customers to establish awareness at all levels. Another relevant change affects the way in which some ACH transactions are labeled. The rules now require standardized Company Entry Descriptions for some type of transactions such as: • “PAYROLL” for payroll-related ACH credits or • “PURCHASE” for online consumer debit transactions. These descriptions aim to replace inconsistent or unclear labels that were used previously. As such, community banks should confirm whether their systems can support the required descriptions and communicate requirements, especially to commercial customers. Clear entry descriptions will help customers recognize transactions and help banks identify unusual activity more effectively and efficiently. One more change concerns the timing of funds availability. Effective Sept. 18, all non-same-day ACH credit entries must be made available to customers by 9 a.m. local time on the settlement date, regardless of when the file was received the prior day. To meet this new standard, community banks should review their funds availability policies and disclosures, end-of-day processing timelines, and the system implications of these changes. While faster availability enhances customer experience, it also increases the importance of proactive monitoring and customer communication. This is why documentation plays a vital role in aiding community banks to achieve compliance with the rule changes. Banks should be able to demonstrate: • Written ACH fraud monitoring procedures and processes, with emphasis on what steps will be taken when fraud is detected • Evidence that established procedures are followed• Clear assignments of roles and responsibilities• Periodic reviews and updates. Effective documentation does not need to be complex or lengthy but needs to reflect the day-to-day practices in place that allow the bank to operate consistently. Another cornerstone to facilitate success is early preparation, as it allows banks to address gaps and adjust processes before the changes take effect. Community banks can prepare by doing the following: • Review existing ACH monitoring activities. • Document and/or enhance current practices related to fraud prevention and control. • Educate staff on emerging fraud risks. • Communicate expectations to bank customers. • Coordinate with ACH vendors and processors as required. The 2025 Nacha rule changes aim to reflect the challenges of the current environment. They do not require community banks to adopt complex systems or make substantial changes to the way they operate. Instead, they reinforce the relevance of generating awareness, consistency and clarity through well-thought processes and documentation. We believe that community banks are well positioned to meet these expectations due to their close customer relationships and existing practices. By following these updated rules, community banks can continue to support ACH payments safely and efficiently within an ever-changing risk landscape. Vela is a compliance consultant for United Bankers’ Bank, Bloomington, Minn. He has more than 20 years of experience in risk and compliance, over half of which in banking. Visit Compliance Services-United Bankers’ Bank to learn about UBB’s Compliance Services Consulting.