US ACH payments · checked 16 October 2026
Nacha's 2026 "false pretenses" rules, in plain English
Nacha, which runs the US ACH network, adopted new risk-management rules taking effect in phases during 2026. Among other things, businesses that send ACH payments are expected to have risk-based processes to identify payments sent under "false pretenses": exactly what a fake vendor bank change is.
This is a summary for orientation, not legal advice. Read Nacha's own pages on the rules and ask your bank how it applies to you.
What the rules aim at
- "False pretenses" covers payments the sender authorised, but only because they were tricked: business email compromise, vendor impersonation, payroll diversion and similar.
- Who: the rules apply to financial institutions and to non-consumer originators (businesses that originate ACH credits, such as paying suppliers or payroll), third-party senders and others in the chain.
- When: Nacha set a first phase in March 2026 for the largest originators and a second phase in June 2026 for everyone else.
- What: establish and keep up risk-based processes and procedures to identify such payments, reviewed at least annually.
What a reasonable process looks like for a small business
- A written policy for bank-detail changes (template).
- Call-back verification on a known number, and a second approval.
- A check of each payment file against verified details before it's sent.
- Records showing the process ran, and a yearly review.
Your bank may ask what you do. PayeeGuard gives you all four, with a log you can show.