Summary of Nacha Rule Changes
Beginning March 20, 2026, non-consumer ACH Originators must implement risk-based ACH fraud monitoring controls and use standardized entry descriptions for certain transaction types.
What this means for your business:
Businesses who originate ACH payments must:
- Establish risk-based ACH fraud monitoring procedures
- Review and document those procedures at least annually
- Apply stronger controls to higher-risk payments, such as payroll and vendor changes
- Payroll Entry Description Update: All payroll-related ACH deposits must use the entry description PAYROLL.
Actions needed:
• Replace legacy descriptions such as SALARY, WAGES, or PAY
• Update payroll templates before March 20, 2026
• Coordinate changes with your payroll provider or software vendor - Additional Entry Description Requirement: Online sale of goods (eCommerce purchases) made with an ACH withdrawal, must use the standardized description PURCHASE
Examples of fraud monitoring procedures and controls:
- Dual authorization for ACH files
- Independent verification of vendor or employee account changes
- Monitoring for unusual dollar amounts or transaction patterns
- ACH prenotes or account validation for new payees
- Multi-factor authentication (MFA)
- Ongoing employee fraud awareness training