Source: https://rivet.global/blog/nacha-2026-ach-rules
Published: 2026-07-14 · Updated: 2026-07-14 · By Rashidatou K.

# Nacha's 2026 ACH rules: fraud monitoring, PAYROLL and PURCHASE descriptions

Nacha's 2026 ACH rules explained: fraud monitoring for originators and banks, the PAYROLL and PURCHASE descriptions, and what they mean for businesses.

## Key takeaways

- Nacha's risk management rules require originators, their banks, third-party processors and receiving banks to run risk-based processes to spot ACH payments made under false pretenses.
- Phase 1 started on 20 March 2026 for the largest participants, those that originated more than 6 million ACH entries in 2023.
- Phase 2 started on 22 June 2026 for everyone else in scope.
- From 20 March 2026, PPD credits for wages must use the company entry description PAYROLL, and e-commerce purchase debits must use PURCHASE.
- Expect your bank or payment provider to ask more about unusual ACH payments and new payees.

ACH moves most of the money in the US economy: payroll, supplier payments, bills, tax. Its rulebook is written by Nacha, the association that governs the network. A set of rules adopted in 2024 started applying in 2026, and they shift some of the burden of spotting fraud onto everyone in the chain, including the businesses that send payments.

## Why the rules changed

ACH fraud has moved away from stolen account numbers and toward tricking people into sending money themselves. The payment is authorized, so the old controls missed it. Nacha calls these payments made under false pretenses: fake invoices, changed bank details, impersonated bosses. Our [invoice fraud guide](/blog/invoice-fraud-payment-detail-scams) shows how they work.

## Fraud monitoring, in two phases

Every originator (a business that sends ACH payments), its bank (the ODFI), third-party senders and processors, and receiving banks (RDFIs) must have risk-based processes to identify ACH entries made under false pretenses. Receiving banks must also watch incoming credits for signs that the money came from fraud.

| Phase | Start date | Who |
|---|---|---|
| 1 | 20 March 2026 | Non-consumer originators, ODFIs, third parties and RDFIs with ACH origination over 6 million entries in 2023 |
| 2 | 22 June 2026 | All other non-consumer originators, ODFIs, third parties and RDFIs |

Nacha leaves the method to each participant. The rules require a reasonable, risk-based process, not a specific tool.

## New entry descriptions

Also from 20 March 2026:

- **PAYROLL**: required on PPD credits for wages, salaries and similar pay.
- **PURCHASE**: required on e-commerce purchase debits.

These labels let receiving banks apply different checks to different kinds of payment. Payroll software should handle this for you; check that it does.

## What you will notice

- **More questions on new payees.** Your bank or provider may hold a first payment to a new account while it checks.
- **Questions about unusual payments.** A payment much larger than normal, or to a new country, may be paused.
- **Faster fraud recovery in some cases.** Receiving banks that monitor credits are better placed to freeze stolen money.

## What to do as an originator

1. Write down your payment approval process, even if it is short. Who enters payees, who approves, how bank-detail changes are confirmed.
2. Confirm every new or changed payee by phone on a known number.
3. Answer your provider's questions quickly; a held payment is released faster.
4. Check that payroll batches carry the PAYROLL description.

Our [ACH vs wire guide](/blog/ach-vs-wire-transfer) covers how ACH timing and returns work.

## ACH on Rivet

A Rivet USD account receives ACH and wires in your company's name, and pays out on ACH, same-day ACH, RTP and wire. Every payout is priced and approved before it leaves. See [Payouts](/payouts).

## Questions

### What is false pretenses fraud in ACH?

A payment that the account holder authorized, but only because they were tricked: a fake invoice, a fake change of bank details, or an impersonated executive. The payment is technically valid, which is why the new rules ask everyone to look for warning signs.

### Do the 2026 Nacha rules apply to small businesses?

Businesses that originate ACH payments, such as payroll or supplier payments, are covered as originators. Their banks will set the specific monitoring. In practice, most small businesses notice it as extra questions or holds on unusual payments.

### What does the PAYROLL entry description do?

It labels the batch so the receiving bank knows these are wage payments. That makes it easier for receiving banks to spot payroll fraud, such as an employee's direct deposit being switched to a fraudster's account.

### Does Nacha regulate payments outside the US?

No. Nacha sets the rules for the US ACH network. International ACH transactions, IATs, follow the same rulebook for the US leg.