Compliance · Checklist
Nacha 2026 ACH fraud monitoring checklist for accounting firms
Published Jun 3, 2026 · About 9 min read
Phase 2 deadline: June 22, 2026
This checklist covers the minimum controls needed to satisfy Nacha's Phase 2 fraud monitoring requirements. It is designed for outsourced bookkeeping firms and vCFO practices that originate ACH payments on behalf of clients.
Nacha's 2026 fraud monitoring rule does not specify a technology stack or a particular software product. It requires a functioning, documented fraud detection program. This checklist covers what that looks like in practice for a QBO- or Xero-based bookkeeping firm — from the one-time program setup to the weekly pre-release cycle to quarterly maintenance.
Use this as your working compliance document. If you need to demonstrate your program in a dispute, insurance claim, or ODFI audit, this checklist — plus your fraud review log — is your evidence.
Program foundation (complete once)
Write a one-page ACH fraud monitoring SOP describing your review process
Describe what triggers a review, who performs it, and how decisions are documented. Must be in writing — verbal procedures do not satisfy Nacha.
Confirm your ODFI has you registered as a Third-Party Sender
Call your bank and ask whether your firm is registered in the Nacha TPS Registry. If not, ask about registration requirements.
Designate a primary reviewer for each client portfolio
Name the person responsible for fraud review on each client. This is the person who signs off on the audit trail.
Create a fraud review log template
A simple spreadsheet or document with columns: Date, Client, Vendor, Change Type, Review Method, Reviewer Name, Decision, Notes.
Before every ACH release cycle (weekly)
Pull the vendor change report for each client
In QBO: Audit Log filtered by "Vendor" entity changes. In Xero: equivalent audit trail. Note any vendor with a routing number, account number, or payment method change since the last cycle.
For each changed vendor: call the vendor to verify
Phone call only. Number must come from your existing file for the vendor — not from the change request email. Confirm: account holder name, routing number, account number. Log: date, time, number called, who you spoke to, what was confirmed.
For each changed vendor: hold the next ACH payment
Do not release ACH payments to a vendor with recently changed bank details until the phone verification is complete and logged.
Identify any vendors added in the last 30 days
Flag all new vendors. First ACH payment to each new vendor requires a secondary review before release.
For each new vendor: verify with the client before releasing first payment
Contact your client contact (not the vendor's contact on the invoice) and confirm they authorized this vendor and the payment. Log the confirmation.
Flag anomalous payments for client confirmation
Any payment more than 50% above that vendor's historical average, or to a vendor that hasn't been paid in 90+ days. Call or email your client contact to confirm authorization before release.
After each ACH release cycle
Log the completed reviews in your fraud review log
Date, client, what was reviewed, who reviewed it, outcome (cleared / held / escalated). This is the audit trail Nacha requires.
Note any holds or escalations for follow-up
If a payment was held pending verification, log when the verification is expected and who is responsible for clearing it.
Monitor for ACH returns that might indicate fraud
R02 (account closed), R03 (no account), R10 (unauthorized) return codes can indicate fraud that slipped through. Investigate immediately if returns appear on recently changed vendor accounts.
Quarterly review
Review vendor roster for each client — remove inactive vendors
Dormant vendor records with payment details on file are fraud vectors. Archive or delete vendors that haven't been paid in 12+ months.
Audit your fraud review log for completeness
Confirm every vendor change in the quarter has a corresponding verification log entry. Gaps in the log are compliance gaps.
Update your SOP to reflect process changes
If your review process changed — new tools, new staff, new client onboarding steps — update the written procedure.
Brief your team on recent fraud patterns
What attack patterns are emerging in the bookkeeping space? VEC (Vendor Email Compromise), ISO 20022 migration scams, etc. Keep your team current.
The documentation you need to keep
Nacha's documentation requirement is satisfied by two artifacts:
Your written SOP
A 1-3 page document describing your fraud monitoring process — what you check, when, who is responsible, and how decisions are made. Updated quarterly. This is your program.
Your fraud review log
A timestamped record of every review performed — date, client, vendor or payment, what was checked, reviewer name, outcome. This is your evidence. Keep it for at least 2 years.
What manual compliance looks like at scale — and where it breaks
For a 5-client firm, this checklist is manageable with a spreadsheet and disciplined calendar reminders. For a 20-client firm with 15-20 vendors each, manual execution of the weekly pre-release cycle takes 3-5 hours per payment cycle — before you touch the actual bookkeeping.
The firms handling this efficiently have connected their QBO and Xero clients to automated monitoring that surfaces flags — vendor changes, new vendors, anomalous amounts — before each release, so the reviewer is working a short list of flagged items rather than scanning every vendor across every client manually.
For a deeper look at how compliance monitoring works at portfolio scale, see Nacha 2026 fraud monitoring rules for accounting firms or the full Nacha 2026 ACH compliance guide.
FAQ
What does a Nacha-compliant ACH fraud monitoring program require?
A Nacha-compliant program under Phase 2 (effective June 22, 2026) requires: (1) a written fraud monitoring procedure, (2) vendor bank change verification before ACH releases, (3) new vendor scrutiny for first payments, (4) anomalous payment review, and (5) a timestamped audit trail of all fraud reviews performed.
Is a checklist enough for Nacha 2026 compliance?
A checklist helps, but Nacha requires a functioning program — meaning the checklist must actually be followed consistently and produce documentation. The compliance evidence is the audit trail showing reviews were performed, not just the existence of a procedure.
How often should I run the Nacha fraud monitoring checklist?
The vendor bank change and new vendor checks should run before every ACH release cycle. For most bookkeeping firms, this means weekly (aligned with your payment processing schedule). The anomaly review can be batched weekly. The SOP documentation review is annual.
Automate this checklist across your client portfolio
Vantirs runs the vendor change, new vendor, and anomaly checks automatically across every QBO and Xero client — surfacing a reviewable flag list before each payment cycle, with a timestamped audit trail that satisfies Nacha Phase 2 documentation requirements.
This checklist is for informational purposes only and does not constitute legal or compliance advice. Nacha Operating Rules are administered by Nacha. Consult your ODFI or a qualified compliance professional for guidance specific to your firm.