Nacha's expanded ACH fraud monitoring rules take full effect on June 22, 2026. The shift from reactive return handling to proactive, risk-based monitoring across all 17 SEC codes is the biggest change to ACH compliance in a decade. Here's what your bank needs to know.
Take the Self-AssessmentNacha's updated rules fundamentally change how financial institutions must approach ACH fraud. The old playbook of monitoring return rates and reacting to chargebacks is no longer sufficient.
Nacha split the rollout into two phases. Phase 1 is done. Phase 2 is the one that catches institutions off guard.
Financial institutions must have baseline ACH fraud monitoring in place for WEB debit originations. Risk assessments updated. Monitoring systems operational. This phase established the minimum floor.
Effective — PassedMonitoring requirements expand to all 17 Standard Entry Class (SEC) codes. Institutions must demonstrate proactive, risk-based fraud detection — not just return rate tracking. Examiners will test detection capabilities, not just check for policy documents.
59 Days RemainingBased on recent regulatory guidance and examination trends, these are the areas where examiners are focusing their ACH compliance reviews.
Examiners are comparing stated risk profiles against actual origination volumes by SEC code. A risk assessment that says "low ACH risk" while processing $50M in WEB debits monthly will trigger findings. Your assessment must reflect reality, not last year's template.
FinCEN's effectiveness initiative has shifted examiner focus from "how many SARs did you file" to "are your SARs actually useful to law enforcement." Institutions must show that detection leads to quality narratives with actionable intelligence — not checkbox filings.
Examiners are increasingly asking about technology capabilities. If you're using AI or machine learning, you need model governance documentation. If you're not using advanced tools, you need to justify why manual processes are adequate for your risk profile.
High false positive rates signal an ineffective program — investigators waste time on noise instead of actual fraud. Examiners want to see documented thresholds, regular tuning cycles, and evidence that your team can separate signal from noise.
Static rule sets from 2020 do not address 2026 fraud patterns. Examiners expect evidence of regular rule updates, ideally quarterly. If your rules haven't changed since deployment, that's a finding waiting to happen — regardless of how good they were originally.
Check each statement that applies to your current fraud monitoring program. Be honest — this is for your team, not for us.
A BankerDetect compliance specialist will review your current ACH monitoring setup and identify specific gaps before the June 22 deadline.
Schedule Your Assessment