NACHA Rules Update

This section provides a summary of changes to the NACHA Operating Rules & Guidelines (the “NACHA Rules”). For further information, we recommend that you obtain a copy of the 2026 NACHA Operating Rules & Guidelines. The NACHA Rules are published annually and may be referenced or ordered through the opens in a new windowNACHA Store. More detailed information regarding these changes may be found at opens in a new windowNACHA Rules.

SUMMARY OF REVISIONS TO THE 2026 NACHA OPERATING RULES

Overview of the 2026 NACHA rule changes
NACHA has announced updates to the ACH Operating Rules effective in 2026. These changes impact fraud monitoring, transaction descriptions, and Originator responsibilities. Please review and prepare accordingly to ensure
compliance. The NACHA Operating Rules are the foundation for every ACH payment. These rules ensure that millions of payments occur smoothly and easily each day.

What changed on March 20, 2026?
Phase 1
Starting March 20, 2026: Applies to non-consumer originators and third parties with
ACH origination volume exceeded 6 million in 2023; NACHA requires maintaining risk-based monitoring processes designed to identify unauthorized transactions and payments authorized under false pretenses, including
social-engineering and business email compromise scams.

Standardized Company Entry Descriptions
Also effective March 20, 2026. NACHA requires standardized Company Entry Descriptions: PAYROLL
for PPO credit payroll payments and PURCHASE for WEB debit consumer e-commerce transactions (Burke & Herbert Bank does
not currently offer WEB debit entries for ACH Originators. For questions or additional information, please get in touch with your Treasury Management Consultant)

What changed on June 22, 2026?
Phase 2
Starting June 22, 2026: Applies to all remaining non-consumer originators and third parties. These entities should
establish risk-based ACH fraud-monitoring requirements regardless of volume.

What Do You Need to Do?
By March 20, 2026 – Update the company Entry Descriptions in your ACH Software or Templates to ensure accuracy and compliance. By June 22, 2026 – Establish a risk-based fraud detection protocol for your ACH-originated transactions, with procedures subject to annual review and update.

FAQs
Who must comply with the 2026 NACHA rule changes?
All ACH participants-including businesses, financial institutions, and third-party providers-must comply. By June 22, 2026, the requirements apply to all non-consumer ACH participants.

Do Businesses need to monitor every ACH transaction?
NACHA requires risk-based fraud-monitoring programs, not real-time or transaction-by-transaction review.

What happens if a business does not comply with NACHA rules?
Failure to comply may result in formal NACHA rule violations, financial penalties, or restrictions on ACH origination.

Where can businesses learn more about the NACHA rule changes?
For further information,, we recommend you obtain a copy of the 2026 NACHA Operating Rules & Guidelines.

The NACHA Rules are published annually and may be referenced or ordered through the NACHA Store. NACHA also offers educational seminars and a guide to upcoming rule changes.