As of June 22, 2026, Nacha’s Phase 2 risk rules apply to a much wider group of businesses than before. The first phase, back in March 2026, only applied to large, high-volume institutions. Phase 2 covers all non-consumer ACH originators, third-party senders, and businesses, no matter how many transactions they process.
What’s Changing
The big shift is that fraud monitoring is no longer optional or informal. Businesses now need documented, risk-based processes in place. The main target is credit-push fraud, things like business email compromise, payroll diversion, and vendor impersonation.
Nacha has also widened what counts as fraud. It now includes cases where someone is tricked into authorizing a payment under false pretenses, like a scammer posing as a vendor and asking for updated bank details.
Receiving banks have new responsibilities too. They now monitor incoming ACH credits for anything unusual, like a large deposit suddenly landing in an account that’s been inactive for a while, so suspicious funds can be flagged and recovered faster.
What This Means for ACH Originators
If your business handles payroll or pays vendors electronically, here’s what needs to be in place:
Verify bank detail changes by phone
If someone emails asking to change where payments get sent, don’t just reply to confirm it. Call them using a phone number you already have on file to verify the change.
Flag unusual payment activity
Payments that fall outside the normal schedule, unusually large amounts, or first-time payments to a new vendor should get a second look before they go through.
Put fraud policies in writing
Having informal best practices isn’t enough anymore. Written fraud procedures, reviewed at least once a year, should be ready to show your bank if asked during an audit.
A Related Reminder on Entry Descriptions
There’s also an earlier 2026 rule worth keeping in mind. Payroll files need to use the exact word PAYROLL in the Company Entry Description field, and online consumer purchases need to use PURCHASE. If your accounting software hasn’t been updated to use these exact terms, now’s a good time to fix that too.
Staying Ahead of It
These requirements raise the baseline for how ACH-originating businesses manage fraud risk. Reviewing verification processes, documentation, and entry description formatting now helps keep your ACH processing running smoothly.