Payments

Get Clued In: 2025 ACH Rule Changes and Updates

Andi Crockett

13 Feb 2025 • 9 min read

Grab your trench coat…it’s time to investigate the upcoming ACH rule changes and updates!

It’s certainly not a secret that the Nacha Operating Rules and Guidelines change each year to ensure compliance and efficiencies as more and more transactions are processed through the ACH Network. But what credit unions do have to use their sleuthing skills to determine is the impact those changes will have on their payments operations and how to incorporate them into their daily processes.

So, without further ado, let’s round up those magnifying glasses and take a closer look at ACH rule changes and updates that will cross paths with credit unions in 2025.

Secrets of the Past: Rule Review 2024

Any good investigator knows that the past provides insights into the present and the future, so ACH Rules from 2024 (and even further back) certainly apply to the transactions we process today. As we look back, 2024 was a big year for ACH Rules, particularly in an effort to reduce payment risk. Perhaps you’ll recall these changes:

Expanded use of Return Reason Code R17

Return code R17 (File Record Edit Criteria), which was originally intended to denote an error, missing piece or discrepancy of information, was permitted for use if the RDFI suspects potential fraud. To be clear, it is not required, but rather, allowable by the rules, as a return reason at the discretion of the RDFI.

In the October 2024 rule change, Nacha set forth the requirement that the Return Addenda Record must contain a note that the transaction is “QUESTIONABLE.” In addition, the expansion of this code included the use of “False Pretenses,” which, according to Nacha, is “the inducement of a payment by a Person misrepresenting (a) that Person’s identity, (b) that Person’s association with or authority to act on behalf of another Person, or (c) the ownership of an account to be credited.”

Overall, this change was put into place to help institutions recover funds more easily in a fraudulent situation and, like any good investigator, outsmart the bad actors.

Expanded Use of Return Reason Code R06

Also effective in October 2024, Nacha allowed an expanded use of return code R06 (ODFI Request for Return) to request a return from the RDFI for any reason the ODFI sees fit under the requirements that the ODFI indemnifies the RDFI for compliance with request. As with return code R17, this enhanced usage improves the odds of recovering funds should fraud occur.

While this expansion was made in 2024, there is an update to return code R06 that will take place in the spring of 2025 (which is likely to turn up as you scroll through this blog post – so keep your eye out, sleuths!).

Additional Funds Availability Exception

Also in the name of risk management, Nacha provided an additional exemption from funds availability requirements. Within this exemption, credit entries are included if an RDFI suspects that the transaction was originated under the newly defined False Pretenses that was laid out in the expansion of return code R17.

While the exemption provides a tool for institutions to manage questionable entries, funds availability exceptions for RDFIs are still subject to Reg CC requirements, require an obligation to promptly make funds available as prescribed by the rule and must take reasonable steps to notify the ODFI quickly using return code R17 or a note to contact the ODFI, which can be done through the ACH Contact Registry.

Timing of Written Statement of Unauthorized Debit

This rule, which was intended to improve the process for unauthorized debits and limit harm to receivers, allows a Written Statement of Unauthorized Debit (WSUD) to be signed and dated by the receiver on or after the entry is presented to them, even if the debit has not yet been posted. Under this rule, RDFIs still have a requirement to obtain a WSUD.

Prompt Return of Unauthorized Debits

In the same realm of unauthorized debits, this rule update provides a specification as to the timing of the return time frame. As such, the rule requires that an RDFI return ACH debits as “unauthorized” or “improper” in the extended return time frame by the opening of the sixth banking day following the completion of its review of the receiver’s signed WSUD. As with the previous rule, RDFIs are still required to obtain the WSUD.

This rule was updated particularly for the purposes of improving the recovery of funds and reducing future fraud occurrences, as well as alerting the ODFI and originator that the potential for fraud and/or other problems exists within the transaction.

Follow the Evidence: What’s to Come in 2025?

While 2024 saw a lot of ACH Rules changes and updates, 2025 is far less busy. In fact, the only upcoming change this year will be a timing caveat to the expanded use of return code R06. In this rule update, RDFIs will be required to respond to an ODFI’s request for return within 10 banking days. Take down this clue – this change will go into effect on April 1, 2025!

Find the Clues: Rules Disguised Until 2026

Speaking of clues, Nacha is busy laying the groundwork for new rules in 2026 – and they’re leaving lots of breadcrumbs for institutions to start preparing now. Here’s the rundown, secret agents:

Fraud Monitoring by Originators, Third-Party Senders, Third-Party Service Providers and ODFIs

As we’ve seen, fraudulent transactions within the ACH Network are a major concern of Nacha and all governing bodies, which will carry over into the new rules for 2026.

In this new rule, Nacha is making it a requirement for non-consumer originators, third-party senders (TPSs), third-party service providers (TPSPs) and ODFIs to establish and implement risk-based processes and procedures to identify ACH entries that are initiated under fraudulent circumstances. It’s an expansion of the current rule that requires originators to use a commercially reasonable fraud detection system to screen WEB debits – ACH transactions that are initiated online – while utilizing micro-entries.

While fraud monitoring will be a requirement when this rule goes into effect, all participants in the ACH Network are encouraged to implement systems to prevent and detect fraudulent activity.

Rule Considerations

The new rule does not require monitoring to be performed prior to the processing of entries. Instead, the monitoring can come into play prior to posting, which will increase the odds of early fraud detection/prevention.
If a transaction is deemed suspicious, institutions must:
- Confirm the validity of the transaction through a consultation with the transaction originator using the ACH Contact Registry.
- Determine all the flags raised by the transaction by consulting internal teams and contacting the RDFI for receiver account red flags. This may lead to a request for return of funds or a freeze of the funds or even the account.
Monitoring is necessary and required – there will be no exceptions.

Effective Dates: March 20, 2026 (Phase 1) and June 19, 2026 (Phase 2)

Please note that this rule will have a phased approach to implementation. In the first phase, which will be effective March 20, 2026, all ODFIs will be required to implement a fraud monitoring system. In addition, non-consumer originators, TSPSs and TPSs with an annual origination volume greater than six million (as of 2023) must also meet this requirement by March 20, 2026.

The second phase, effective June 19, 2026, will require all other non-consumer originators, TPSPs and TPSs (those that do not meet the six million or greater volume level) to implement fraud monitoring.

ACH Credit Monitoring for RDFIs

In a similar fashion as the previous rule, this rule will require RDFIs to implement and establish risk-based processes and procedures with the intention of identifying fraudulently initiated ACH credit entries. With the application of this rule, Nacha is looking to reduce the number of fraudulent transactions that pass through the Network successfully and, conversely, increase the incidence of funds recovery.

Rule Considerations

The new rule does not require monitoring to be performed prior to the processing of credit entries or screening of each ACH credit entry individually.
The intention is to more easily identify indicators that an ACH credit was initiated under False Pretenses, so institutions should determine the following:
- Does the SEC Code align with the receiving account type?
- Does the transaction follow the baseline of normal activity for the receiving account, or does it contain an unusually high dollar amount?
- Has there been an increase in similar credits over a period of time?
- Are there any oddities in use of the account? For example, is the account suddenly active after being unused for an extended period of time? Is the account holder a new member? Are credits being received and then immediately moved into another account or to an entirely different institution?

Effective Dates: March 20, 2026 (Phase 1) and June 19, 2026 (Phase 2)

Please note that this rule will have a phased approach to implementation. In the first phase, which will be effective March 20, 2026, RDFIs with an annual receipt volume of 10 million or greater (as of 2023) must be in compliance. Per the 2023 ACH Volume Survey, this would apply to approximately 70 percent of RDFI participants in the ACH Network.

The second phase, effective June 19, 2026, will require all other RDFIs (those that do not meet the 10 million or greater volume level) to implement this framework.

Standard Company Entry Description – PAYROLL

A new rule will be introduced that will aim to standardize company entry descriptions for payroll transactions via ACH. For PPD credits – including wages, salaries and/or other types of compensation – the company entry description should be PAYROLL. The idea behind this new rule is to give RDFIs better information regarding ACH credits for new or even multiple payroll payments in a receiver account. This can also play a role in the RDFI’s decision to provide early funds availability and help reduce fraud through payroll redirection.

Rule Consideration

According to Nacha, “The ODFI has no obligation to verify the presence or accuracy of the word ‘PAYROLL’ as a description of purpose or employment status.”

Effective Date: March 20, 2026

Standard Company Entry Description – PURCHASE

Along those same lines, a new rule will be established to standardize the identification of e-commerce purchases, where debits are requested for the online purchase of goods, whether through WEB debits, PPD or TEL (telephone-initiated) debits. To do this, the company entry description should be PURCHASE.

Rule Consideration

The rule includes language that details the obligations of the ODFI to determine the originator’s proper usage. According to Nacha, “The ODFI has no obligation to verify the presence or accuracy of the word ‘PURCHASE’ as a description of purpose.”

Effective Date: March 20, 2026

Additional Proposals: Magnifying What’s Beyond 2026

As we continue looking to the future, we find that Nacha is making a list of potential rule updates beyond even those we’ve discussed already. With that, they gathered feedback and data from institutions by mid-December 2024 to aid in their development, so let’s investigate these even further, shall we?

Fourth Daily Same-Day Window Processing

After receiving feedback, Nacha may choose to expand Same-Day ACH (SDA) processing to include a fourth window. If implemented, this expanded rule would give institutions an increased time frame of approximately 3.25 hours to submit same-day ACH (SDA) entries. This window would be open Monday-Friday and through the close of business within the Pacific Time zone. The goal of this potential rule would help to increase SDA volume, include additional use cases and maybe even encourage faster returns.

Considerations

All RDFIs would need to implement the receipt of SDA files and meet funds availability for SDA credits.
RDFIs would need to pay close attention to their net-debit position during settlement and funds their accounts as needed.
Consumer and business receivers would need to monitor their accounts for funding to avoid negative balances or returns of SDA entries.

Accelerated Funds Availability

After receiving feedback, Nacha may choose to update the conditions of accelerated funds availability. If implemented, this update would eliminate the condition of RDFI receipt by the local 5:00 p.m. cutoff time, as well as the funds availability requirement at 9:00 a.m. local time on the day of settlement for non-SDA credits. Please keep in mind that this would only apply to certain ACH credits and may not make a difference for the many RDFIs that make funds available now, even though they are not bound by a requirement of the rules.

Considerations

Potential for consumers and businesses to receive earlier funds availability for ACH credits, including payroll, refunds, benefit payments, etc.
Could accelerate funds availability for ACH credits currently received after 5:00 p.m. local RDFI time and not currently made available until 9:00 a.m. local RDFI time.
RDFIs should review and update processes and procedures for next-day ACH credits received after 5:00 p.m. local RDFI time (although some may already be doing this).

Two-Day ACH Credits

Nacha collected information to explore the viability of a rule designating two-day ACH credits that could eliminate the use of Effective Entry Dates that are three and four banking days in the future for ACH credits.

Same-Day Returns

Nacha collected information to gain a better understanding of why there is generally low usage of same-day processing for returns when all are currently eligible.

Well, there you have it, sleuths…a look back at last year’s changes, insight what’s to come in 2025 and a peek at the path ahead for 2026! And remember to keep your spy investigative skills keen for the proposed rule changes we discussed.

For additional information on these ACH rule changes and updates, I also invite you to watch the recording of the recent Vizo Financial webinar, 2025 ACH Rule Changes and Updates.

Until next year…

Andi Crockett is the product manager of EFT at Vizo Financial/MY CU Services. Her role involves developing and implementing EFT services — including ACH for Business, ACH Contingency, ACH Receipt and Returns, ACH Originations, ACH Settlement, Domestic and International Wires and Foreign Check Collection — for credit unions. She also participates in planning efforts for business development, works with members and clients to manage implementation expectations and manages relationships with vendors. Andi is also an active member of the Diversity, Equity and Inclusion (DEI) Champions team at Vizo Financial.