Nacha's fraud monitoring rules, in plain language

If your business sends ACH payments, such as supplier payments or payroll, Nacha's 2026 rules expect you to have a process for spotting payments you were tricked into making. Here's what the rules say and where VouchSafe can fit.

What changed in 2026

• Phase 1, effective March 20, 2026: all ODFIs, plus non-consumer Originators, Third-Party Service Providers and Third-Party Senders with 2023 ACH origination volume of 6 million or more.
• Phase 2, effective June 19, 2026 (Nacha notes the practical date is June 22, because the 19th is a federal holiday): every other non-consumer Originator, Third-Party Service Provider and Third-Party Sender, regardless of volume.
• Each covered business must have risk-based processes and procedures, relevant to its role, reasonably intended to identify entries suspected of being unauthorized or authorized under False Pretenses, and review them at least once a year.
• The rules don't prescribe a method, don't require screening every entry, and don't require monitoring before processing. Nacha gives change controls over vendor and payroll payment instructions as an example.

Sources: Nacha, Risk Management Topics – Fraud Monitoring Phase 1 and Phase 2.

"False Pretenses" is the scam VouchSafe was built for

Nacha defines False Pretenses as inducing a payment by misrepresenting your identity, your authority to act for someone else, or who owns the account being paid. Nacha's examples include business email compromise and vendor and payroll impersonation. It doesn't cover disputes over fake or poor-quality goods.

Those are the requests VouchSafe is designed to stop: a "supplier" with new bank details, an "employee" changing their direct deposit, an "executive" who needs a payment today.

Where VouchSafe can fit in your process

• Change control for payment instructions. A new or changed bank account for a supplier or employee becomes a case. It isn't used until someone confirms it through a callback on a number already on file.
• A second approver above your threshold, who can't be the person who opened the case or made the callback.
• A record you can show. The hash-chained audit log, exported as CSV, documents what was checked, by whom and when. That can help when your bank asks how you monitor, and when you do your annual review.

What it doesn't do: VouchSafe doesn't see or screen your ACH files, isn't connected to your bank, and can't stop an entry once it's sent. Use it alongside your bank's own controls, such as positive pay and dual authorisation in online banking.

A simple process you could write down

1. Every new payee, and every change to a payee's bank details, opens a VouchSafe case.
2. The change is confirmed through a callback on a number from your own records, never one from the request.
3. Payments above your threshold need a second, different approver.
4. Review the audit log and your thresholds at least once a year, and after any incident.

Adapt this to your own business and agree it with your bank. It's an example, not a compliance template.