Am I Nacha 2026 compliant?

Do you originate ACH payments — paying vendors, running payroll, or initiating bank transfers for yourself or clients?

If you only receive ACH payments and never send them, Phase 2 probably does not apply to you. Confirm with your ODFI.

Do you have a written ACH fraud monitoring procedure — a documented SOP describing what you check and how?

A verbal or informal practice does not satisfy Nacha. You need a document — even one page — describing your review process.

Before releasing ACH payments, do you check whether any vendors have changed their bank account details since the last payment cycle?

Vendor bank account changes are the most common ACH fraud vector. Nacha requires verification (typically a phone call to a number from your existing records) before releasing payment to changed accounts.

Do you apply extra scrutiny to the first ACH payment to any new vendor — confirming the vendor is legitimate before the payment releases?

New vendors with no payment history are a common fraud entry point. Phase 2 requires review of first payments before release.

Do you review anomalous payments — amounts significantly above that vendor's historical average — before releasing them?

A sudden increase in invoice amount from a familiar vendor is a common fraud signal. Nacha requires a process for identifying and reviewing these before payment.

Do you maintain a timestamped log of fraud reviews performed — recording what was reviewed, when, by whom, and what was decided?

The audit trail is how you prove your program is running. Without it, compliance cannot be demonstrated to your ODFI, an insurer, or in a dispute.

If you are an outsourced bookkeeping firm or accounting practice: have you determined whether your firm qualifies as a Nacha Third-Party Sender (TPS)?

TPS classification triggers additional obligations including possible ODFI registration. If you originate ACH on behalf of clients, call your bank and ask directly.