Nacha Rule Changes 2026: What Merchants Need to Know

The Nacha rule changes 2026 brought in two things every business that pulls payments by ACH needs to act on: risk-based fraud monitoring for all business Originators, and a standard “PURCHASE” label on consumer debits for online purchases of goods. Both are already in force, faster funds availability took effect on September 18, 2026, and a higher Same Day ACH limit follows in 2027. This guide explains each rule in plain English, shows which ones apply to your business, and gives you a checklist to get compliant.

What are the Nacha rule changes 2026 merchants need to know?

Nacha is the organization that writes the Nacha Operating Rules, the rulebook for the ACH Network. Every bank that sends or receives ACH payments agrees to follow those rules. Banks then pass the rules on to the businesses they serve through account and processing agreements.

If you collect payments by bank debit, you are an Originator in Nacha terms. That holds whether you use ACH payment processing for recurring billing or one-time e-check payments at checkout. So the 2026 changes affect you even if your processor handles the technical side.

Most of the 2026 package is aimed at one problem: fraud where a criminal tricks someone into sending money. Think fake vendor invoices, payroll diversion, and business email compromise. Nacha’s response puts more responsibility on every party in the payment chain, including merchants.

Nacha 2026 and 2027 rule timeline at a glance

Here is every change on Nacha’s new rules page that matters to a typical online merchant, with what it means in practice.

Fraud monitoring: the biggest change for business Originators

Under the new rules, non-consumer Originators must “establish and implement risk-based processes and procedures reasonably intended to identify ACH Entries initiated due to fraud.” That language comes straight from Nacha’s Fraud Monitoring Phase 1 rule. Third-Party Senders, service providers, and banks have parallel duties.

Who had to comply, and when

Phase 1 began March 20, 2026. It covered all ODFIs (the banks that send ACH entries) and any business Originator, Third-Party Sender, or service provider with 2023 ACH origination volume of 6 million entries or more.

Phase 2 covers everyone else. According to Nacha’s Fraud Monitoring Phase 2 rule, the official date was June 19, 2026, but because that was a federal holiday the practical deadline was June 22, 2026. There is no volume floor. A small online store sending a few hundred debits a month is covered.

What “False Pretenses” means

The rules target payments that are unauthorized or made under False Pretenses. Nacha defines that as getting someone to pay by misrepresenting your identity, your authority to act for someone else, or who owns the account being credited. Business email compromise, vendor impersonation, and payroll impersonation are the classic cases.

The definition does not cover disputes over fake or poor-quality goods or services. Those are still handled through your normal refund and return processes.

What the rule does not require

Many merchants assume they need to buy expensive software or hand-check every payment. Nacha says otherwise. Its guidance states the rules do not require screening every entry one by one, and they do not require monitoring before entries are processed.

What they do require is a real process. Nacha notes a risk-based approach “cannot mean no monitoring.” At minimum, you should know which of your transactions are higher or lower risk, and you must review your procedures at least once a year.

What a practical fraud monitoring process looks like

For most small and mid-size merchants, a workable program is simpler than it sounds. It usually combines tools you already have with a few written steps:

• Account validation on new bank accounts before the first debit (already required for WEB debits, covered below).
• Velocity and amount rules in your payment gateway, such as flags for unusually large first orders or many accounts tied to one email.
• Return monitoring so a spike in unauthorized returns triggers a review. Our guide to ACH return codes explains which codes signal fraud.
• Payout and bank-change controls, such as calling a vendor at a known number before changing their bank details.
• A short written policy naming who reviews alerts, what triggers a hold, and when the annual review happens.

Your processor or bank may set extra requirements in your agreement. Ask them what they expect, and keep your written policy where you can share it quickly if asked.

The new “PURCHASE” Company Entry Description

Every ACH entry carries a short Company Entry Description. It is the label the customer’s bank can show on their statement. Starting March 20, 2026, Nacha’s Company Entry Descriptions rule requires two standard labels: “PAYROLL” for wage payments sent as PPD credits, and “PURCHASE” for consumer e-commerce debits.

For merchants, “PURCHASE” is the one that matters. Nacha defines an e-commerce purchase as “a debit entry authorized by a consumer Receiver for the online purchase of goods.” These entries normally use the WEB code. Nacha’s guidance describes the goods as tangible items.

Does “PURCHASE” apply to my payments?

Use this table as a quick guide. It is based on the examples in Nacha’s rule page. If your case is unclear, confirm with your processor before you change anything.

This change matters most for e-commerce brands and supplement and nutraceutical sellers that offer pay-by-bank at checkout or bill auto-ship orders by ACH. Nacha’s own example of a qualifying recurring payment is a monthly vitamin subscription signed up for online.

Note that Nacha says the ODFI “has no obligation to verify the presence or accuracy of the word ‘PURCHASE.'” In other words, getting the label right is on you and whoever formats your ACH files.

Older Nacha rules that still apply in 2026

The Nacha rule changes 2026 add to the rulebook. They don’t replace it. Two older rules work hand in hand with the new fraud monitoring duty.

WEB debit account validation

Since March 19, 2021, Nacha’s WEB debit fraud detection rule has required a fraud detection system that, at minimum, validates the account to be debited. That check applies to the first use of an account number and to any change in it. It confirms the account is open and can accept ACH entries.

Strong authorizations matter just as much. Our guide to ACH authorization requirements covers what your online, phone, and recurring authorization forms need to include.

Return rate thresholds

Nacha’s Risk and Quality Rules fact sheet sets three return rate levels that can trigger scrutiny:

• Unauthorized returns: 0.5 percent
• Administrative returns (for example, closed or invalid accounts): 3.0 percent
• Overall returns: 15.0 percent

Good fraud monitoring and account validation help keep you under these lines. Merchants who stay well below them tend to have a smoother relationship with their processor and bank.

What changed in September 2026 and what comes in 2027

Faster funds availability (in effect since September 18, 2026). Nacha’s rule schedule shows that credits that are not Same Day ACH now must be available to the receiver no later than 9:00 a.m. in the receiving bank’s local time on the settlement date. The old 5:00 p.m. receipt condition is gone. For merchants, that means earlier access to ACH credits that land in your business account.

Higher Same Day ACH limit (September 17, 2027). The per-payment limit for Same Day ACH will rise from $1 million to $10 million. That mostly helps high-ticket and B2B sellers. For a full picture of settlement timing today, see our guide to ACH processing time.

Nacha compliance checklist for 2026

Use this checklist to put the Nacha rule changes 2026 into practice. Work through these steps once, then repeat the review each year.

1. Map your ACH flows. List every way you collect by bank debit: checkout, recurring billing, invoices, and payments taken over the phone through a virtual terminal.
2. Tag each flow by risk. Note which are higher risk, such as first-time customers, large orders, or account changes.
3. Confirm account validation. Make sure every new or changed account is validated before the first WEB debit.
4. Fix your entry descriptions. Use “PURCHASE” on consumer debits for online goods orders, including goods subscriptions that started online. Ask your processor how the field is set.
5. Turn on gateway fraud rules. Set limits for amount, velocity, and repeated failed attempts.
6. Watch your returns. Track unauthorized, administrative, and overall return rates monthly against Nacha’s thresholds.
7. Lock down payout changes. Verify any request to change vendor, contractor, or payroll bank details through a second channel.
8. Write it down. Put your process on one or two pages: owners, triggers, actions, and records kept.
9. Schedule the annual review. Put a date on the calendar to update the policy as risks change.

Common mistakes merchants make with the new rules

• Assuming the processor covers everything. Processors and Third-Party Senders have their own duties. The Originator duty is still yours.
• Thinking small volume means exempt. Phase 2 has no volume threshold.
• Using “PURCHASE” on everything. Service, membership, and B2B debits are outside the definition.
• Having tools but no written process. Nacha expects documented procedures and an annual review.
• Ignoring payouts. False Pretenses fraud often targets the money you send out, not just the money you collect.

If you’re setting up bank payments for the first time, our merchant account approval checklist shows the documents and policies underwriters usually ask to see, including refund and authorization terms.

Related guides and next steps

• Want to add bank payments to your checkout? See how ACH payment processing works with Payment Circle.
• Deciding between e-checks and ACH? Read e-check vs ACH: what’s the difference.
• Billing customers every month? Explore subscription payment processing for recurring revenue businesses.
• Running a SaaS platform? Learn about SaaS payment processing for card and ACH billing.
• Building your authorization forms? Use our guide to ACH authorization requirements.

Frequently asked questions

Do the Nacha 2026 fraud monitoring rules apply to small businesses?

Yes. Phase 2, which took effect June 22, 2026, covers all non-consumer Originators regardless of volume. If your business initiates ACH debits or credits, you need a risk-based fraud monitoring process and an annual review.

Do I need to review every ACH payment manually?

No. Nacha says the rules do not require screening each entry individually or monitoring before processing. You need a documented, risk-based approach that focuses attention on higher-risk transactions.

Does the “PURCHASE” description apply to subscription billing?

It applies to recurring consumer debits for tangible goods when the customer first authorized online, such as a monthly vitamin subscription. It does not apply to services, memberships, or B2B debits. If you sell digital subscriptions, confirm the right label with your processor.

Do the 2026 Nacha rules affect credit card payments?

No. Nacha governs the ACH Network only. Card payments follow card network rules and your processor agreement. Many merchants still use the same fraud tools for both.

When does the Same Day ACH limit increase to $10 million?

Nacha has set September 17, 2027 as the effective date. The limit applies per payment and rises from $1 million to $10 million.

Sources and further reading

• Nacha: Risk Management Topics – Fraud Monitoring Phase 1
• Nacha: Risk Management Topics – Fraud Monitoring Phase 2
• Nacha: Risk Management Topics – Company Entry Descriptions
• Nacha: Supplementing Fraud Detection Standards for WEB Debits
• Nacha: Risk and Quality Rules Fact Sheet
• Nacha: New Rules (effective dates)

Get ACH processing set up the right way

Payment Circle helps new U.S. merchants, software companies, and agencies set up ACH, e-check, and card processing with clear, interchange-plus pricing and NMI or Authorize.net gateways. If you want to add bank payments or review how your ACH setup fits the 2026 rules, start your application or call us at (571) 274-7950, 9:00 AM–6:00 PM Eastern. You can also contact our team with questions.