American CBA LLC

The ACH Network is entering a period of meaningful operational change. Financial institutions are now working through major fraud-monitoring requirements that took effect during 2026, while preparing for a new round of Nacha Rules changes in 2027 involving International ACH Transactions, Same Day ACH, ACH contact registration and data requirements. Additional changes are already scheduled for 2028.

The session will begin with a look back at key 2026 developments, including the phased implementation of new fraud-monitoring requirements for ODFIs, non-consumer Originators, Third-Party Senders, Third-Party Service Providers and RDFIs. These changes require risk-based processes and procedures reasonably designed to identify ACH credits that may have been initiated through fraud or false pretenses, making fraud detection and internal coordination an increasingly important part of ACH compliance.

The primary focus will then shift to 2027 implementation priorities. Effective January 1, participating DFIs must register appropriate IAT-handling contacts in the ACH Contact Registry, while Nacha will also formally document the character set accepted by ACH Operators.

Beginning March 19, 2027, new IAT rules will permit an optional date-of-birth field for certain parties to an IAT and expand the Rules to better accommodate non-bank foreign financial agencies.

Later in the year, one of the most significant operational changes arrives on September 17, 2027, when the Same Day ACH per-entry limit increases from $1 million to $10 million.

The webinar will also preview 2028, including the new R90 return reason code for entries returned because of sanctions-compliance obligations. This change will distinguish sanctions-related returns from traditional R16 “Account Frozen” situations and will introduce a separate return framework for sanctions-related activity. 

Key Takeaways

• Understand the 2026 fraud-monitoring requirements and how they affect ODFIs, Originators, Third-Party Senders, Third-Party Service Providers and RDFIs.

• Prepare for January 2027 requirements, including IAT contact registration and updated ACH data standards.

• Apply the March 2027 IAT changes, including the optional date-of-birth field and expanded treatment of foreign financial agencies.

• Prepare operationally for the $10 million Same Day ACH limit taking effect September 17, 2027, including impacts on limits, controls, fraud monitoring and customer use cases.

• Preview the 2028 R90 sanctions return code and understand how it will differ from R16.

• Apply ACH authorization requirements and distinguish valid reversals from prohibited corrections.

• Process returns and Notifications of Change accurately and within required timeframes.

• Communicate ACH responsibilities clearly to Originators and internal stakeholders.

• Identify policies, procedures, controls and training that should be updated before new rules become effective.

• Strengthen documentation and implementation practices to support audit and examination readiness.