Nacha Rules

The Nacha Rules, formally the Nacha Operating Rules, are the rulebook for the ACH Network in the United States. They define how electronic credits and debits are authorized, formatted, sent, settled, returned and corrected, and they allocate responsibility among the banks and companies involved. The rules are written and maintained by Nacha, the industry association that governs the network, and are published in a new edition each year together with guidelines on how to apply them.

The rules are a private contract, not legislation. Every bank and credit union that takes part in the ACH system agrees to them, and businesses that originate payments are bound through their agreements with their banks. They operate alongside federal law, in particular the consumer protections of Regulation E, and where the two overlap the law prevails.

The rules assign duties by role. The company or person that starts a payment is the originator. Its bank is the originating depository financial institution, or ODFI, and the bank on the other side is the receiving depository financial institution, or RDFI. Processors and platforms that send payments for their own customers through an ODFI are classed as a third-party sender and carry many of an originator's obligations.

The central principle is the ODFI warranty. By sending an entry, the ODFI warrants to the rest of the network that the entry has been properly authorized and complies with the rules, and it is liable if that proves untrue. The ODFI therefore must vet its originators, set exposure limits for them, and can pass losses back to them under contract.

An originator must obtain the receiver's authorization before sending an entry, and for a consumer debit the authorization must be clear, must state how it can be revoked, and must be retained and produced on request. The form it takes depends on how the payment arises, and each kind of payment is labelled with a Standard Entry Class code. A PPD entry covers consumer payments under a standing written authorization, such as payroll deposits and regular bill debits. A WEB entry covers consumer debits authorized over the internet, and a CCD entry covers payments between businesses. Using the correct code matters because the receiver's return rights and the originator's obligations differ by type.

An RDFI that cannot or should not post an entry sends it back as an ACH return with a reason code. Most returns, for example for insufficient funds or a closed account, must be made so that they are available to the ODFI by the opening of business on the second banking day after the entry's settlement date. A consumer who states in writing that a debit was not authorized has a much longer window: the RDFI may return such an entry within sixty calendar days of settlement. Unauthorized debits to business accounts follow the short deadline, which is why businesses use debit blocks and filters.

Where an entry posted successfully but contained outdated details, the RDFI sends a notification of change, and the originator must correct its records before sending further entries. An originator may reverse an entry it sent in error, such as a duplicate or a wrong amount, within five banking days, and must notify the receiver.

The rules set limits on how often an originator's debits may be returned. The threshold for returns coded as unauthorized is 0.5 percent of debit entries. Returns for administrative reasons, such as invalid account numbers, are subject to a 3 percent level and all returns to a 15 percent level; exceeding these triggers a review by Nacha and can lead to a requirement to bring the rate down.

Other provisions target fraud directly. Originators of WEB debits must use a commercially reasonable fraudulent transaction detection system, which since 2021 has had to include validating the account number on first use, for instance by an ACH prenote or micro-deposit verification. Rule changes that took effect in two phases, in March and June 2026, extend monitoring duties so that originators, ODFIs and, for incoming credits, RDFIs must have risk-based processes to identify payments that are unauthorized or induced by false pretenses, such as business email compromise and payroll impersonation.

Parties that handle ACH data must protect it. The rules require originators, third parties and banks to have security policies covering the confidentiality and integrity of protected information, to verify the identity of those they deal with, and to send banking information over unsecured networks only when encrypted. Larger originators and third parties must also render account numbers unreadable when stored electronically. Banks and third-party senders must carry out an annual audit of their compliance with the rules.

Any participating bank can report a suspected violation by another. Nacha reviews the complaint and may issue a warning or refer the matter to its rules enforcement panel, which can impose fines under the National System of Fines. Penalties rise with the seriousness and repetition of the violation, and the most serious class can reach 500,000 dollars per occurrence and lead to an originator's suspension from the network. Fines are levied on the ODFI, which normally recovers them from the originator responsible. Disputes between banks over particular entries are resolved through the return process, arbitration procedures in the rules, or the courts.

• Nacha: Operating Rules