Nacha FAQs

Fraud Monitoring FAQs

All ODFIs, and non-consumer Originators, Third-Party Senders (TPS), and Third-Party Service Providers (TPSPs) that perform ACH origination functions.
  • Phase 1: March 20, 2026, for parties meeting certain 2023 volume thresholds.
  • Phase 2: June 19, 2026, when the volume thresholds drop and all remaining parties must comply.
Participants must establish and implement risk-based processes and procedures to reasonably identify ACH entries that are unauthorized or authorized under “False Pretenses”. These must be reviewed at least annually.
No – the rules do not mandate screening every entry individually nor require monitoring before processing.
A payment induced by a person misrepresenting their identity, authority, or the ownership of the account to be credited. It covers such frauds as vendor impersonation, BEC (business email compromise), payroll redirection – but not scams involving fake or poor-quality goods/services.
RDFIs with ACH receipt volumes of 10 million+ in 2023 must establish risk-based monitoring of incoming ACH credit entries under Phase 1. Phase 2 applies to all RDFIs regardless of volume.
No. The rules do not alter or expand liability under UCC Article 4A or create new duties beyond compliance with the Nacha Rules.

Company Entry Description FAQs

Yes – Originators must use the descriptor “PAYROLL” for all PPD credits that pay wages, salaries, or similar compensation no later than March 20, 2026. The date is a “no later than” deadline, and early adoption is encouraged.
Yes – It applies to all types of compensation payments, regardless of employment status (employee, contractor, etc.).
It helps RDFIs better identify compensation payments, which supports their risk-monitoring and fraud-mitigation efforts (especially for payroll redirections).
Yes – As long as “PAYROLL” appears in the leftmost 7 characters of the 10-character field, the remaining characters (up to three) may be used for additional description.
No – RDFIs may use the descriptor to enhance risk intelligence, but they are not required to take action solely because the entry uses “PAYROLL.”
The Company Entry Description is a 10-character field in positions 54–63 of the Company/Batch Header Record. It describes the purpose of the payment, and certain pre-defined values like “PAYROLL” or “PURCHASE” will become mandatory for specific transaction types no later than March 20, 2026.
Yes – Payroll deductions deposited to an HSA are considered compensation payments and must carry the “PAYROLL” descriptor.