Banks Face a New ACH Fraud Test as Nacha Rules Take Effect

Fraud deadlines arguably don’t attract much attention outside compliance departments. This year’s changes to the Nacha Operating Rules reshape how banks are expected to identify suspicious ACH activity before losses accumulate.

Fraud no longer arrives through one payment type or one customer relationship. Criminals move across accounts, payment channels and institutions, often relying on stolen credentials, account takeover and business impersonation schemes. That broader threat picture is now reflected in the rules governing the ACH Network.

The most significant practical change from Nacha is that fraud monitoring expectations have expanded beyond the narrower requirements that previously applied to specific ACH transactions.

Under the new Risk Management Topics rules, effective as of this week for the first phase affecting receiving financial institutions, receiving depository financial institutions (RDFIs) are expected to establish and maintain risk-based processes and procedures reasonably intended to identify ACH credit entries suspected of being unauthorized or authorized under false pretenses. The broader Risk Management package also requires originating institutions and certain third-party participants to implement comparable risk-based fraud monitoring processes. Phase Two extends the requirements to additional institutions as of June 19.

The guidance makes clear that institutions are not expected to review every transaction individually or perform mandatory pre-posting screening. Instead, they are expected to maintain monitoring programs that are appropriate for their risk profile and capable of identifying suspicious patterns.

That represents an important departure from previous requirements, which largely focused on commercially reasonable monitoring for WEB debits and Micro-Entries. The new framework expands fraud monitoring expectations across a much broader range of ACH activity.

For banks, the practical consequence is that fraud programs can no longer examine credits and debits in isolation. Suspicious activity may only become visible when viewed across multiple customers, accounts and payment flows.

Unauthorized Fraud Now Drives Most Losses

The timing of the rule changes aligns with how fraud itself has evolved.

According to the PYMNTS Intelligence report “2025 State of Fraud and Financial Crime in the United States,” done in collaboration with Block, unauthorized-party fraud now represents 71% of fraud incidents and dollar losses, reversing the prior year’s pattern in which authorized-party scams accounted for the larger share. Credential theft, account takeover and misuse of payment information now dominate institutional losses.

The report also illustrates why institutions can no longer rely solely on static transaction rules.

Nearly half of financial institutions report that fraud schemes have become substantially more sophisticated. Forty-seven percent cite growing regulatory pressures and at the same time, 68% increased fraud-detection spending during the past year.

Those trends reinforce the premise behind the new Nacha requirements: fraud monitoring must become more adaptive because fraud itself has become more adaptive.

AI Helps Detect Behavioral Patterns

Artificial intelligence (AI) is becoming less a competitive advantage than a basic operational requirement.

The PYMNTS Intelligence research found that machine learning and behavioral analytics have become widely deployed across financial institutions, particularly among large banks and FinTechs. Rather than replacing existing rules engines, these technologies complement them by identifying unusual payment behavior that fixed thresholds often overlook.

Behavioral models can establish a customer’s normal payment activity and identify transactions that differ materially from those patterns. That capability becomes particularly valuable when criminals possess legitimate credentials, allowing fraudulent payments to resemble ordinary account activity.

Account validation is becoming another important element of fraud prevention.

Many unauthorized-payment schemes begin with altered account information, business email compromise or payment redirection. Verifying account ownership before funds move can interrupt those schemes before settlement occurs.

The Nacha materials also noted that monitoring may consider factors including transaction velocity, anomalies, account characteristics and historical account activity when evaluating incoming credits. Those factors extend beyond simple payment authentication and reflect a broader, risk-based assessment of account behavior.

Information Sharing Becomes Operational

The new expectations also place greater emphasis on coordination inside financial institutions.

The Nacha guidance noted that RDFIs may need stronger information sharing among compliance, operations, product management and relationship teams to identify suspicious activity effectively. Fraud patterns often emerge only when information from multiple parts of the organization is considered together.

That mirrors broader industry trends documented by PYMNTS Intelligence. Modern fraud prevention combines technology, operational coordination and intelligence gathered across payment channels.

For many institutions, that will mean combining traditional transaction monitoring with AI-driven analytics, behavioral modeling, account validation and stronger internal information sharing.  The June implementation deadline therefore marks more than another compliance milestone. It reflects a broader change in supervisory expectations.