Every Bank Sending ACH Payments Now Has to Watch for Fraud: What Nacha's New Rule Actually Requires

If a client pays you by direct bank transfer, the payment almost certainly moves through the ACH network, the same rail that handles payroll deposits and most B2B transfers in the US. As of this year, every institution touching that payment has a new, tighter obligation to watch for fraud before the money moves.

What Nacha’s new rule requires

Nacha, the organization that governs ACH rules, rolled out a new fraud-monitoring requirement in two phases during 2026. Phase 1, effective March 20, covered the largest players: originating depository financial institutions and non-consumer Originators, Third-Party Senders, and Third-Party Service Providers whose ACH volume exceeded 6 million transactions in 2023. Phase 2, effective June 22, extended the same requirement to every remaining ODFI, Originator, Third-Party Sender, and Third-Party Service Provider, regardless of volume.

The standard itself changed too. Nacha eliminated the old “commercially reasonable” language and replaced it with a requirement to maintain documented, risk-based processes specifically designed to detect and prevent fraudulent ACH activity, reviewed at least annually.

What actually changed, phase by phase

	Before March 20, 2026	After June 22, 2026
Fraud monitoring standard	”Commercially reasonable” processes	Documented, risk-based processes
Who it covers	No formal universal requirement	Every ODFI, Originator, Third-Party Sender, Third-Party Service Provider
Review cadence	Not specified	At least annually

The two-phase rollout gave the highest-volume institutions a head start, then closed the gap for smaller banks and payment processors that handle a fraction of the transaction volume but are exactly the kind of institution a freelancer’s client or payment processor might use.

What this does and doesn’t protect you from

This rule sits with the institutions moving the money, not with you. Your bank and your client’s bank are now required to run documented fraud-detection processes on the ACH transfers that pass through them. That is a real improvement in the overall system’s defenses against fraudulent ACH activity, but it is not a guarantee that a specific payment intended for you will be caught before it goes wrong.

It also does nothing about business email compromise, the scam where a fraudster impersonates you or your client to redirect a legitimate payment to a different account entirely. That fraud happens before the ACH transfer is even initiated, at the point where someone verifies payment details, which is outside what any bank’s transaction-monitoring system can catch.

Your own payment details still need their own verification step

Nacha’s rule strengthens the rails. It does not replace the basic discipline of sending payment instructions through a channel a client can trust and verify. A BillyPaid payment link attached directly to your invoice gives a client one verified place to pay you, rather than a bank routing number typed into an email that a bank’s fraud monitoring, however improved, was never built to police.