2026 NACHA UPDATES

As an Originator of ACH transactions, you are required to comply with all applicable Nacha (National Automated Clearing House Association) Operating Rules. The following summary highlights select Rule amendments taking effect in 2026.

These amendments are part of Nacha’s broader Risk Management initiative intended to reduce the incidence of successful fraud attempts and improve the recovery of funds.

For the complete list and detailed descriptions of Rule changes, please visit www.nacha.org.

2026 Nacha Rule Updates for ACH Originators

Effective March 20, 2026

Standard Company Entry Descriptions

Two Rule amendments require the standardized use of newly defined Company Entry Descriptions for specific ACH transactions:

PAYROLL
For all PPD credit Entries used for the payment of wages, salaries, or similar compensation, the Company Entry Description field must contain PAYROLL.

PURCHASE
For all e-commerce purchases, the Company Entry Description field must contain PURCHASE.

An e-commerce purchase is defined as a debit Entry authorized by a consumer Receiver for the online purchase of goods, including recurring purchases initially authorized online. These transactions must use the WEB debit Standard Entry Class (SEC) code, except where permitted under the Standing Authorization Rule to use PPD or TEL debit SEC codes.

Fraud Monitoring Requirements

This new Rule amendment requires certain ACH participants to establish and maintain documented, risk-based processes and procedures reasonably designed to identify ACH Entries initiated due to fraud, including Entries that may be authorized under false pretenses (for example, business email compromise or vendor impersonation).

Note: Phase One of Nacha’s Risk Management package also introduces ACH credit monitoring requirements for certain RDFIs.

Phase One — Effective March 20, 2026

This Rule amendment requires all ODFIs, as well as each non-Consumer Originator, Third-Party Service Provider (TPSP), and Third-Party Sender (TPS) with annual ACH origination volume of 6 million or greater in 2023, to establish and implement risk-based fraud monitoring procedures.

Requirements include:

• Documented, risk-based fraud monitoring processes must be implemented
• Processes and procedures must be reviewed at least annually
• Organizations not currently performing fraud monitoring must implement appropriate controls

Phase Two — Effective June 19, 2026*

This Rule amendment expands the requirement to all ODFIs, non-Consumer Originators, Third-Party Service Providers, and Third-Party Senders, regardless of ACH origination volume.

Requirements include:

• Establishment and implementation of risk-based fraud monitoring procedures
• Annual review of fraud monitoring processes
• Implementation required for any ACH organization not currently performing fraud monitoring

*Because June 19, 2026, is a federal holiday, the effective date will be the next business day.

Recommended Next Steps for ACH Originators

Peshtigo National Bank encourages Originators to:

Review current ACH processing procedures

• Confirm proper use of Company Entry Descriptions
• Evaluate existing fraud monitoring controls
• Update internal policies and procedures as needed

For additional information regarding these updates, please visit www.nacha.org or contact your Peshtigo National Bank representative.