The two 2026 phases
Federal Reserve Financial Services summarized the new Nacha risk-management package in two phases. Phase 1 took effect March 20, 2026 for all ODFIs and larger non-consumer originators, service providers and receiving institutions. Phase 2 took effect June 19, 2026 and extended the requirements to the remaining covered non-consumer originators and RDFIs.
What the rules are trying to do
The rules require risk-based processes reasonably intended to identify ACH entries initiated because of fraud. For businesses, that moves fraud monitoring further upstream: payment files, vendor changes, payroll instructions and unusual credits should be reviewed as part of the operating process rather than treated only as a bank-side problem.
What businesses should review
Companies that originate ACH should review approval limits, dual controls, vendor-change verification, payroll file procedures, account alerts and escalation steps. Businesses receiving large ACH credits should also understand how their bank handles anomalous activity and return decisions.
Why bank choice can matter
Two banks may both support ACH but offer very different control depth. Positive pay equivalents, debit blocks, user permissions, anomaly monitoring, file validation and alerting can matter as much as the headline ACH fee.
Primary sources
Translate the headline into an operating decision.
Confirm how the change affects your bank, your account agreement and your internal workflow before changing providers or payment procedures.