Nacha's 2026 ACH rules: fraud monitoring, PAYROLL and PURCHASE descriptions

In 2026 Nacha's rules started requiring nearly everyone in the ACH network to monitor for payments sent because of fraud. Two new standard entry descriptions also arrived. Here is what changed and why your bank may ask more questions.

Rashidatou K.Payments editor

Published: 14 July 2026
Reading time: 2 min read

ACH moves most of the money in the US economy: payroll, supplier payments, bills, tax. Its rulebook is written by Nacha, the association that governs the network. A set of rules adopted in 2024 started applying in 2026, and they shift some of the burden of spotting fraud onto everyone in the chain, including the businesses that send payments.

Why the rules changed

ACH fraud has moved away from stolen account numbers and toward tricking people into sending money themselves. The payment is authorized, so the old controls missed it. Nacha calls these payments made under false pretenses: fake invoices, changed bank details, impersonated bosses. Our invoice fraud guide shows how they work.

Fraud monitoring, in two phases

Every originator (a business that sends ACH payments), its bank (the ODFI), third-party senders and processors, and receiving banks (RDFIs) must have risk-based processes to identify ACH entries made under false pretenses. Receiving banks must also watch incoming credits for signs that the money came from fraud.

Phase	Start date	Who
1	20 March 2026	Non-consumer originators, ODFIs, third parties and RDFIs with ACH origination over 6 million entries in 2023
2	22 June 2026	All other non-consumer originators, ODFIs, third parties and RDFIs

Nacha leaves the method to each participant. The rules require a reasonable, risk-based process, not a specific tool.

New entry descriptions

Also from 20 March 2026:

PAYROLL: required on PPD credits for wages, salaries and similar pay.
PURCHASE: required on e-commerce purchase debits.

These labels let receiving banks apply different checks to different kinds of payment. Payroll software should handle this for you; check that it does.

What you will notice

More questions on new payees. Your bank or provider may hold a first payment to a new account while it checks.
Questions about unusual payments. A payment much larger than normal, or to a new country, may be paused.
Faster fraud recovery in some cases. Receiving banks that monitor credits are better placed to freeze stolen money.

What to do as an originator

Write down your payment approval process, even if it is short. Who enters payees, who approves, how bank-detail changes are confirmed.
Confirm every new or changed payee by phone on a known number.
Answer your provider's questions quickly; a held payment is released faster.
Check that payroll batches carry the PAYROLL description.

Our ACH vs wire guide covers how ACH timing and returns work.

ACH on Rivet

A Rivet USD account receives ACH and wires in your company's name, and pays out on ACH, same-day ACH, RTP and wire. Every payout is priced and approved before it leaves. See Payouts.

Questions people ask

What is false pretenses fraud in ACH?

A payment that the account holder authorized, but only because they were tricked: a fake invoice, a fake change of bank details, or an impersonated executive. The payment is technically valid, which is why the new rules ask everyone to look for warning signs.

Do the 2026 Nacha rules apply to small businesses?

Businesses that originate ACH payments, such as payroll or supplier payments, are covered as originators. Their banks will set the specific monitoring. In practice, most small businesses notice it as extra questions or holds on unusual payments.

What does the PAYROLL entry description do?

It labels the batch so the receiving bank knows these are wage payments. That makes it easier for receiving banks to spot payroll fraud, such as an employee's direct deposit being switched to a fraudster's account.

Does Nacha regulate payments outside the US?

No. Nacha sets the rules for the US ACH network. International ACH transactions, IATs, follow the same rulebook for the US leg.

Sources

Written by

Rashidatou K.

Payments editor

Rashidatou writes Rivet's guides to how money moves between countries: the payment rails, what each one costs, and the account details a company needs to get paid in another currency. Every figure in Rashidatou's articles is traced to the scheme rulebook, the regulator or the provider's published price list, and those sources are listed at the end.