For fintech companies, ACH compliance is genuinely complicated. Obligations come from multiple directions: Nacha's Operating Rules, Regulation E, FinCEN's BSA/AML requirements, and the practical demands of sponsor banks. Most growing fintechs don't have a dedicated compliance officer who knows all of these layers well enough to manage them confidently. That gap creates real exposure.
This article breaks down exactly what ACH compliance requires, who it applies to, and what maintaining it actually looks like in practice.
TLDR
- Nacha writes and enforces the rules; ACH is the payment infrastructure those rules govern — they're not the same thing.
- Every party in an ACH transaction (Originators, ODFIs, RDFIs, Third-Party Senders) has distinct, enforceable obligations.
- Core requirements include proper authorization, account validation, return rate monitoring, data encryption, and annual audits.
- ACH compliance and BSA/AML obligations overlap: suspicious ACH activity can trigger SAR filing requirements.
- Nacha can fine non-compliant parties up to $500,000 per occurrence for egregious violations and suspend network access entirely.
ACH and Nacha: What's the Difference?
These two terms get used interchangeably, but they describe different things.
| ACH | Nacha | |
|---|---|---|
| What it is | The U.S. interbank electronic funds transfer network | The industry association and rulemaking body |
| Who operates it | Federal Reserve (FedACH) and The Clearing House (EPN) | Self-regulatory organization — not an infrastructure operator |
| What it does | Receives, sorts, and delivers payment files between banks | Writes the rules, enforces them, and handles arbitration |
ACH is the network. Nacha sets the terms for using it. The two operators — FedACH and EPN — handle the actual file processing. Nacha also administers professional credentials, including the AAP (Accredited ACH Professional) and APRP (Accredited Payments Risk Professional).
For fintechs and banks, the distinction has a direct compliance implication. Nacha's Operating Rules apply to every ACH participant regardless of which operator processes the transactions. Choosing FedACH over EPN doesn't change your compliance obligations. Your obligations are determined by your role in the transaction — Originator, ODFI, RDFI — not by which operator's rails your files travel.
Who Nacha Rules Apply To
Every ACH payment flows through a defined chain of parties. Nacha assigns specific, non-interchangeable obligations to each.
Originators
The Originator is the business or individual who initiates the ACH transaction — a SaaS company pulling subscription fees, a lender collecting loan payments, a payroll processor pushing direct deposits.
Key obligations:
- Obtain proper authorization before debiting any account — written, electronic, or verbal depending on the SEC code used
- Implement a commercially reasonable fraudulent transaction detection system for WEB debit entries
- Retain authorization records for at least two years from the date the authorization terminates or is revoked
- Render stored account data unreadable (via encryption, tokenization, or similar methods) if originating 2 million or more ACH payments annually
ODFIs (Originating Depository Financial Institutions)
The ODFI is the bank or credit union that accepts ACH instructions from Originators and forwards them to the network. They sit in the middle of the transaction chain and bear significant liability.
Key obligations:
- Conduct due diligence on Originators and Third-Party Senders before onboarding
- Warrant that all entries submitted to the network are properly authorized
- Register Third-Party Sender customers in Nacha's TPS Registry, with updates due within 45 days of any changes
- Monitor return rates and implement corrective action plans when thresholds are breached
RDFIs and Third-Party Senders
RDFIs (Receiving Depository Financial Institutions) are the banks that receive ACH entries and post them to consumer or business accounts. Key obligations:
- Post entries per Nacha rules and Regulation E
- Return unauthorized entries with correct reason codes
- Complete annual ACH compliance audits
Third-Party Senders transmit ACH entries on behalf of Originators — the standard structure in embedded finance and payments platforms. Their obligations include:
- Entering written agreements with both their ODFI and Originator clients
- Conducting formal ACH risk assessments
- Disclosing any nested Third-Party Sender relationships to their ODFI
- Completing annual ACH rules compliance audits
Core Nacha Compliance Requirements
Authorization Standards and SEC Codes
Every ACH debit requires proper authorization before the entry is transmitted. The type of authorization required depends on the SEC (Standard Entry Class) code used.
| SEC Code | Use Case | Authorization Type |
|---|---|---|
| WEB | Online/wireless consumer debits | Electronic, with account validation required |
| PPD | Prearranged consumer debits/credits | Written authorization required for debits |
| TEL | Telephone-initiated consumer debits | Oral authorization by phone |
| CCD | Business-to-business payments | Written or electronic |
| IAT | International ACH transactions | Additional addenda records required |
Authorization must specify the amount, timing, and purpose. Vague or incomplete authorizations are a common audit finding.
Account Validation for WEB Debits
Originators must validate a consumer's bank account before its first use for WEB debit entries — and again before any change to that account number. This rule has been in effect since March 19, 2021.
Nacha is technology-neutral on method. Accepted approaches include:
- Instant account verification (open banking / bank-linked verification) — fast, but requires consumer consent to connect their bank
- ACH micro-entry verification — low-cost, but takes 1-3 business days
- Commercially available database checks — quick, but coverage varies by provider
Each has tradeoffs in speed, cost, and consumer friction. The right choice depends on your product and volume. Poor validation decisions here have a direct downstream effect: they're one of the most common drivers of elevated unauthorized return rates.
Return Rate Thresholds
Nacha monitors return rates for all Originators. Exceeding these thresholds triggers a formal inquiry and corrective action process:
- Unauthorized return rate: 0.5% (calculated over the preceding 60 days; covers codes R05, R07, R10, R11, R29, R51)
- Administrative return rate: 3.0% (codes R02, R03, R04)
- Overall debit return rate: 15.0%
If an ODFI acknowledges an unauthorized rate above 0.5%, it must submit a remediation plan within 30 days. Nacha then monitors for an additional 180 days, and persistent non-compliance proceeds to the National System of Fines.
Elevated return rates are rarely a technical problem. They almost always signal poor authorization practices or outright fraud.
Data Security and Record Retention
Non-financial institution Originators and Third-Party Senders that process 2 million or more ACH payments annually must render stored deposit account information unreadable. "Rendered unreadable" means encryption, tokenization, truncation, or destruction (Nacha doesn't mandate a specific method).
This threshold applies on a rolling basis: any entity reaching 2 million payments in a calendar year has until June 30 of the following year to comply.
Record retention: Authorization records must be kept for a minimum of two years from the date the authorization is terminated or revoked. For single oral authorizations, the clock starts from the authorization date itself.
ACH Fraud Prevention Under Nacha Rules
Nacha's fraud monitoring amendments require Originators, ODFIs, RDFIs, and Third-Party Senders to establish risk-based processes for identifying entries suspected of being unauthorized or originated under false pretenses. These procedures must be reviewed and updated at least annually.
The rollout is phased:
- Phase 1 (effective March 20, 2026): Applies to all ODFIs, non-consumer Originators/TPSPs/Third-Party Senders with 6 million or more 2023 ACH originations, and RDFIs with 10 million or more 2023 ACH receipts
- Phase 2 (June 19, 2026): Covers remaining parties
Egregious Violations and Enforcement Consequences
Nacha classifies the most serious misconduct as "Egregious Violations" — defined as willful or reckless actions involving at least 500 entries or multiple entries aggregating at least $500,000. The consequences escalate quickly:
- Class 3 sanctions can reach $500,000 per occurrence
- Nacha can direct an ODFI to suspend an Originator or Third-Party Sender from the network
- Suspension eliminates ACH origination access entirely — a critical operational loss for any payment business built on the network
Practical fraud controls that satisfy Nacha's requirements include:
- Real-time transaction monitoring across ACH activity
- Multi-factor authentication for payment system access
- Employee training on payment fraud schemes
- Complete audit trails for all ACH entries
How ACH Compliance Intersects With BSA and AML Obligations
ACH channels are attractive for money laundering precisely because of their volume and speed. Structuring, rapid fund layering, and unusual return patterns are all red flags that a BSA/AML program must be equipped to catch. Nacha's fraud monitoring rules and FinCEN's SAR obligations are complementary — but they're not the same thing, and satisfying one doesn't satisfy the other.
The FFIEC BSA/AML Manual requires banks to file SARs for transactions aggregating $5,000 or more when a suspect is identified ($25,000 or more when no suspect is identified), generally within 30 calendar days of initial detection.
The IAT and OFAC Dimension
International ACH Transactions (IAT entries) add another compliance layer. Each IAT entry requires between 7 and 12 mandatory addenda records to support BSA Travel Rule compliance and OFAC screening. All four participant roles must screen IAT transactions against the OFAC SDN list — and none can contractually shift that liability to another:
- Gateway Operators
- Originators
- ODFIs (Originating Depository Financial Institutions)
- RDFIs (Receiving Depository Financial Institutions)
For fintechs operating as Third-Party Senders or working through sponsor banks, ACH compliance gaps compound quickly. A weak ACH policy can surface as a finding in a BSA program assessment, a sponsor bank audit, or a regulatory examination. Each gap feeds the next: a Nacha deficiency identified during an exam often triggers a deeper BSA review.
That's where an integrated monitoring approach matters. Fraxtional builds AML programs that treat ACH activity as part of a unified monitoring framework — incorporated into threshold-setting, alert logic, and SAR workflow governance alongside other payment rails, not tracked separately from them.
Practical Steps to Maintain ACH Compliance
Build a Written ACH Policy
Every ACH participant — Originator, ODFI, RDFI, or Third-Party Sender — should maintain a documented ACH policy covering:
- How payments are initiated, authorized, and approved
- Return rate monitoring procedures and escalation thresholds
- Data security controls for stored account information
- Record retention schedules
- Annual audit process and ownership
The policy needs to be reviewed and updated at least annually. Sponsor banks and examiners will ask for it.
Track Nacha Rule Changes Proactively
Nacha updates its Operating Rules annually, with a public comment process and clearly announced effective dates. Assign someone internally to own that tracking. Non-awareness is not a defense in a compliance audit or enforcement proceeding — and the fraud monitoring phase-in dates (March and June 2026) are close enough that companies without a compliance owner should be acting now.
Know When to Bring in Expert Support
Many fintechs — especially seed-to-Series B companies and embedded finance platforms — don't have an in-house BSA Officer or CCO with deep ACH expertise. The compliance obligations covered in this article span authorization, fraud controls, data security, return rate management, annual audits, and BSA/AML integration.
Without dedicated expertise, those gaps don't stay hidden. Sponsor banks conduct onboarding reviews, and regulators examine program documentation — incomplete or absent controls get flagged quickly.
That's the gap Fraxtional fills. The firm provides fractional compliance leadership (including BSA Officer and CCO roles) for exactly this profile of company, with three engagement models built around the way growth-stage fintechs actually operate:
- On Demand Advisory — flat-fee engagements for discrete projects like policy builds or audit prep
- Subscription Advisory — ongoing retainer access for weekly or monthly compliance support
- Fractional Advisory — a dedicated Director with named title use (CCO, BSA Officer, CRO) for companies that need embedded leadership
All three give growing fintechs director-level compliance oversight and sponsor bank alignment without the cost of a full-time hire.
Frequently Asked Questions
What is ACH compliance?
ACH compliance means following Nacha's Operating Rules — covering how payments are initiated, authorized, secured, and monitored — plus federal requirements including Regulation E and BSA/AML obligations. Every party in the ACH transaction chain is covered.
What does ACH mean in banking?
ACH stands for Automated Clearing House — the U.S. interbank electronic network used to process direct deposits, bill payments, payroll, and business-to-business transfers. It's operated by the Federal Reserve and The Clearing House and processes trillions of dollars in transactions annually.
What is ACH in AML?
In an AML context, ACH refers to the use of ACH payments as a potential vector for money laundering. Financial institutions must monitor ACH activity for suspicious patterns — structuring, rapid fund movements, unusual return rates — and file SARs with FinCEN where the applicable thresholds are met.
What are the penalties for violating Nacha rules?
For egregious violations, Nacha can impose fines up to $500,000 per occurrence and direct an ODFI to suspend an Originator or Third-Party Sender from the ACH network. Lower-level violations are handled through the National System of Fines on a graduated basis.
Who enforces Nacha compliance?
Nacha enforces its Operating Rules directly through its risk and enforcement framework. Federal regulators — OCC, FDIC, Federal Reserve, and CFPB — oversee compliance at the bank level, and FinCEN governs BSA/AML obligations. Sponsor banks separately review ACH compliance for their fintech partners.
How often do Nacha rules change?
Nacha updates its Operating Rules annually. Changes go through a public comment process and are assigned clearly announced effective dates. Businesses should monitor Nacha's published rule summaries and assign an internal owner for tracking changes — the fraud monitoring amendments taking effect in 2026 make that ownership especially important right now.
