Pay on Dash

If your team recovers overdue balances and lets customers pay straight from a bank account, a set of rule changes from Nacha is about to land squarely on your desk. Beginning in 2026, the organization that governs ACH payments requires the businesses that originate those payments to actively watch for fraud — and by mid-year, that obligation reaches nearly everyone, no matter how little volume you process. Here is a plain-English guide to what is changing, who it affects, and what in-house accounts receivable and collections teams should do before the deadlines.

What’s changing: Nacha’s 2026 fraud-monitoring rules

Nacha (the National Automated Clearing House Association) writes the rulebook for the ACH network — the rails behind direct bank payments, including the “pay from your checking account” option many collections portals offer. For the first time, that rulebook makes fraud monitoring an explicit, enforceable duty for the companies that send ACH payments, not just the banks that move them. The rollout arrives in two phases.

Phase 1: March 20, 2026

Phase 1 applies to every ODFI (the banks that originate ACH entries) and to larger originators, third-party senders, and third-party service providers whose 2023 ACH volume exceeded 6 million entries. Receiving banks with more than 10 million entries in 2023 are covered as well. If you are a mid-size or enterprise biller, you may already fall inside this first wave. See Nacha’s Phase 1 summary.

Phase 2: June 19, 2026

Phase 2 removes the volume threshold altogether. Every non-consumer originator, third-party sender, and third-party service provider must comply — regardless of how few payments they process. In plain terms: if your organization accepts ACH payments and you were too small for Phase 1, June 19 is your deadline. See Nacha’s Phase 2 summary.

Why collections and AR teams can’t treat this as “the bank’s problem”

It is tempting to assume fraud monitoring is a job for your financial institution. Under the 2026 rules, responsibility explicitly shifts toward the party that originates the payment — which can mean your business, or the payment platform acting on your behalf.

The timing is not academic. More than three-quarters of U.S. organizations (76%) faced attempted or actual payments fraud in 2025, and ACH debits were targeted at roughly 30% of them, according to the Association for Financial Professionals. (AFP 2025 Payments Fraud Survey) Collections is a particularly attractive target: you move money from many different consumers, often quickly, sometimes across payment plans, and frequently through self-service tools where no staff member reviews each transaction by hand.

There is a direct cost to missing this. When a payment turns out to be unauthorized or fraudulent, it comes back as an ACH return, often weeks after you thought an account was resolved. That means reopening closed balances, reversing what looked like recovered revenue, absorbing return fees, and answering to a bank that is now watching your return rates. A monitoring program is not just a box to check for Nacha; it protects the cash-flow gains your recovery efforts are supposed to deliver.

What “risk-based fraud monitoring” actually requires

Nacha deliberately avoided a rigid checklist. Instead, the rules call for “risk-based processes and procedures reasonably intended to identify” ACH entries initiated as a result of fraud. That flexibility is a gift — but it also means you need a documented program you can show an auditor. In practice, a defensible program tends to include:

Baselines and anomaly detection. Know what normal payment behavior looks like for your accounts, and flag the outliers — unusual amounts, sudden velocity spikes, or mismatched names and bank details.
Account validation. Confirm that a bank account is open and belongs to the person paying before you pull funds.
Written procedures. Document how you detect, review, and respond to suspicious entries, and retain the records.
A response playbook. Define who investigates a flag, how you hold or reverse a payment, and how you handle returns.
Regular review. Revisit your risk assessment as fraud patterns — and your own payment mix — change over time.

The consumer-experience angle everyone forgets

Fraud controls have a reputation for adding friction, and in collections, friction is the enemy of getting paid. The real goal is to tighten security without turning a two-tap payment into a frustrating gauntlet. Done well, account validation and monitoring run quietly in the background: a legitimate customer still finishes paying in seconds, while genuinely suspicious activity gets stopped before it settles. Striking that balance protects both your recovered revenue and the customer relationships you are working hard to preserve.

Your 2026 readiness checklist

Confirm whether you — or your payment provider — originate ACH entries, and which phase you fall under.
Ask your provider, in writing, exactly how they support Nacha’s fraud-monitoring requirements.
Document your risk-based procedures before the deadline that applies to you.
Train the staff who handle payments and returns on the updated workflow.
Mark the dates: March 20, 2026 for Phase 1, and June 19, 2026 for Phase 2.

Turn a compliance deadline into an advantage

For most in-house teams, the smartest move is to let your payment platform carry the heaviest part of the load. Dash was built for exactly this environment: secure, self-service consumer payments backed by SOC 2 Type 2 and PCI DSS controls, with automation and real-time visibility into every transaction. That means you can keep offering easy bank and card payments, keep overdue accounts moving toward resolution, and meet the moment on fraud monitoring — without stitching together tools or standing up a compliance team of your own.

If you are mapping out your 2026 payments and compliance plan, see how Dash keeps recovery fast, secure, and compliant. Keep the revenue, keep the relationship, and stay ahead of the rules.

This article is for general information and is not legal or compliance advice. Confirm your specific obligations with your financial institution or qualified counsel.