ACH Credit Monitoring Is Coming

​Credit unions must implement enhanced ACH credit monitoring by June 19 to meet new Nacha fraud prevention requirements. 

By Crystal Streeper, ViClarity
 
As the payments landscape continues to evolve, the expectations around fraud prevention and risk management must align.
 
Credit unions with more than 10 million ACH receipts in calendar year 2023 have already started the first phase of ACH credit monitoring, which was effective on March 20, 2026.  Effective June 19, 2026, the second phase of Nacha's Risk Management rules requires all remaining credit unions to implement enhanced ACH credit monitoring. While many credit unions already have ACH risk controls in place, these updates raise the bar and reinforce something we’re hearing across the industry every day: ACH fraud monitoring can no longer be treated as a back-office function alone.
 
For credit unions, this is both a compliance deadline and a good opportunity to reassess ACH controls, strengthen fraud response procedures, and confirm your institution is positioned to meet the new standard confidently.
 
What’s Changing
Nacha’s rule update requires credit unions to establish risk-based monitoring for ACH credit transactions, specifically aimed at identifying suspicious activity and helping reduce fraud exposure within the ACH network.
 
Historically, ACH monitoring efforts often focused heavily on debit activity. These new expectations make clear that credit entries require active oversight as well, particularly as fraud schemes continue shifting toward faster-moving payment channels.
 
In practical terms, credit unions should expect regulators and examiners to look for:

• Ongoing monitoring of ACH credit activity
• Processes for identifying unusual or potentially fraudulent patterns
• Timely review and escalation procedures
• Clear documentation of monitoring thresholds and controls
• Staff awareness and accountability
• Board and management oversight appropriate to the institution’s risk profile

 
The rule is intended to be risk-based, meaning expectations may look different based on the size of your organization and ACH volume. But the expectation to monitor and to demonstrate how monitoring is being performed will apply broadly.
 
Why This Matters for Credit Unions
Many credit unions already monitor ACH transactions in some capacity. The challenge is often less about whether controls exist and more about whether they are:

• Formalized
• Consistently documented
• Calibrated appropriately
• Reviewed regularly
• Supported by written procedures

 
From a compliance perspective, examiners increasingly expect institutions to show how operational controls tie back to policy and risk assessments. Operationally, ACH credit fraud also tends to move quickly. A delayed review can narrow options for response and recovery.
 
We’re also seeing more credit unions evaluate ACH controls through a broader lens that includes:

• Fraud prevention
• BSA/AML monitoring coordination
• Member experience
• Vendor oversight
• Incident response readiness

 
That cross-functional approach tends to work well, especially when ACH monitoring touches multiple departments.
 
What Credit Unions Should Do Now:
With the June 19 deadline quickly approaching, now is a good time to work through a practical readiness review.
 
1. Review Your ACH Monitoring Procedures

• Are ACH credits actively monitored today?
• Who reviews exceptions?
• How frequently?
• What thresholds trigger escalation?
• Are procedures documented?
• Are reviews retained for audit or exam purposes?

 
If the answer depends heavily on institutional knowledge or is something like “the operations team handles it,” this may be a good time to tighten up documentation.
 
2. Revisit Your ACH Risk Assessment
It should reflect:

• Credit origination and receipt volumes
• Member/business ACH activity
• Higher-risk account types
• Third-party/vendor dependencies
• Fraud trends and prior incidents

 
3. Validate System and Vendor Capabilities
For institutions relying on core processors or ACH monitoring vendors, confirm:

• ACH credit monitoring is included
• Reporting is accessible
• Documentation supports exam readiness
• Implementation timelines align with the June 2026 deadline

 
Notably, a number of institutions are finding this is the step that takes the longest.
 
4. Train Key Staff
Staff should understand:

• What suspicious ACH credit activity may look like
• Escalation expectations
• Internal reporting procedures
• Member communication protocols

 
We encourage credit unions to create talking points or outlines to assist frontline staff.
 
5. Document Board and Management Oversight
Consider reporting on:

• ACH monitoring readiness
• Risk assessment updates
• Vendor implementation progress
• Policy or procedure changes

 
That documentation can be valuable during examinations and audits.
 
ViClarity Perspective
ViClarity has been working with credit unions nationwide to effectuate compliance. Across the industry, it appears that credit unions have been able to meet the halfway point but still are working towards implementing NACHA standards. Some of the things that credit unions generally struggle with are:

• Formal documentation
• Consistency
• Vendor clarity
• Demonstrating the control environment during an exam

 
We have found that credit unions who maintain a more proactive approach have had more opportunities to streamline workflows and strengthen fraud controls before NACHA deadlines arrive.
 
If you have questions about establishing your members-only account with ViClarity, click here for detailed instructions or contact George McDonald.