The Nacha Operating Rules are the private-sector rulebook that governs every payment moving through the Automated Clearing House (ACH) Network. They tell originators, third-party senders, and financial institutions who can participate, how to obtain authorization before debiting an account, how to protect account data, when to audit their own compliance, and what happens when a rule is broken. Enforcement sits with an industry panel, not a federal agency, and penalties escalate when the same violation keeps recurring.
Who Has to Follow the Rules
Every ACH transaction involves four parties, and the rules put specific duties on each. The Originator is the business or person that starts the payment. The Receiver is the account holder on the other end. The Originating Depository Financial Institution (ODFI) accepts the entry from the Originator and is responsible for making sure every debit it sends has valid authorization behind it. The Receiving Depository Financial Institution (RDFI) holds the Receiver’s account and posts the entry on settlement day.1National Credit Union Administration. Automated Clearing House (ACH) Overview The ODFI and RDFI carry the heaviest compliance load.
Third-Party Senders
Many originators don’t connect to an ODFI directly. They route payments through a Third-Party Sender (TPS), such as a payroll processor or payment platform. ODFIs must register each TPS customer with Nacha within 30 days of sending the first entry on its behalf. If an ODFI later realizes an existing customer qualifies as a TPS, the registration deadline shortens to 10 days. Any change to the registered information must be reported within 45 days.2Nacha. Third-Party Sender Registration
Standard registration requires only the TPS’s name and principal business location, the ODFI’s routing number used for the transactions, and the TPS’s Company Identification. During a “risk event,” where Nacha identifies elevated risk of financial loss or excessive returns, the ODFI has 10 banking days to provide more detail, including the TPS’s taxpayer identification number, the names and titles of its principals, and the approximate number of originators it serves. Failure to register a TPS is classified as a Class 2 rules violation.2Nacha. Third-Party Sender Registration
Authorization Before Any Debit
No ACH entry can enter the network until the Originator has explicit consent from the Receiver. The authorization has to spell out specific elements: the Receiver’s account number, the routing number, the dollar amount (or the range for variable payments), and the date or frequency of scheduled transfers. For recurring payments, the authorization must also explain how the Receiver can revoke consent.3Nacha. WEB Proof of Authorization Industry Practices
Written, electronic, and oral formats are all acceptable if each meets its own verification standards. Electronic authorizations must comply with the Electronic Signatures in Global and National Commerce Act to be enforceable.4Federal Deposit Insurance Corporation. Consumer Compliance Examination Manual – X-3 The Electronic Signatures in Global and National Commerce Act (E-Sign Act) The Originator must give the Receiver a copy at the time of signing and keep the authorization on file for at least two years after the Receiver revokes it or the arrangement ends.
WEB Debit Account Validation
Internet-initiated debits, coded WEB, get extra scrutiny. Every WEB debit originator must run transactions through a commercially reasonable fraud detection system, and that system must include account validation the first time any new account number is used. Validation confirms the account is legitimate, open, and capable of receiving ACH entries. Acceptable methods include prenotification entries, micro-transaction verification, third-party validation services, and API-based account verification tools.5Nacha. Supplementing Fraud Detection Standards for WEB Debits
A fraud screening tool without an account validation step does not satisfy the rule, no matter how sophisticated it is otherwise. The requirement applies going forward to new account numbers; accounts already in use for WEB debits don’t need to be re-validated.5Nacha. Supplementing Fraud Detection Standards for WEB Debits
Revocation vs. Stop Payment
A Receiver can revoke a recurring authorization at any time, but revocation does not automatically pull back a payment already in flight. To block a specific upcoming debit, the Receiver has to notify the RDFI at least three banking days before the scheduled transfer date, verbally or in writing. Revoking the authorization tells the Originator to stop sending future entries; a stop payment order tells the bank to reject one that may already be on its way.
Protecting Stored Account Numbers
Any non-bank Originator, Third-Party Sender, or Third-Party Service Provider that processes more than 2 million ACH entries in a calendar year must render account numbers unreadable when stored electronically. Entities that cross the threshold in a given year have until June 30 of the following year to comply.6Nacha. Supplementing Data Security Requirements
The rule is technology-neutral. Encryption, truncation, tokenization, or having the financial institution store and tokenize the numbers on your behalf all qualify. Password-protecting a file or restricting physical access to a server does not. The data itself has to be unreadable, not simply locked behind a login.6Nacha. Supplementing Data Security Requirements
Active use is treated differently from storage. If a service representative pulls up an account number to help a caller, that data is “active” and doesn’t need to be unreadable during the interaction, as long as access controls limit who can see it. Once the task is done, the data has to return to its protected state. Scanned paper authorizations fall under the same rule: a signed form stored as a digital image is still electronic storage of an account number.6Nacha. Supplementing Data Security Requirements Banks and credit unions are excluded from this particular rule because their federal examiners already impose separate data security standards.
The Annual Compliance Audit
Every participating financial institution, every Third-Party Service Provider, and every Third-Party Sender must complete an ACH Rules Compliance Audit each year. The audit is scoped to the functions the participant actually performs. An RDFI-only bank is audited against RDFI obligations, not the full rule set.7Nacha. ACH Rules Compliance Audit Requirements
The audit is not optional and does not quietly lapse. A missed audit becomes an obvious enforcement target on its own, and investigators looking into a separate violation will often find that the audit was never done.
Returns and Unauthorized Debits
When an RDFI cannot complete an entry, it sends it back using a standardized return reason code. Unauthorized transactions get their own codes with a longer return window. R10 applies when the Receiver says the Originator was never authorized to debit the account. R11 applies when authorization existed but the entry didn’t match its terms, such as the wrong amount. Both carry a 60-day return window, and the RDFI must obtain a Written Statement of Unauthorized Debit from the Receiver before sending either return.8Nacha. Differentiating Unauthorized Return Reasons
Nacha’s rules are private standards, not federal law. Consumers disputing an unauthorized ACH debit also have rights under Regulation E, which implements the Electronic Fund Transfer Act. Reporting an unauthorized transfer within two business days of discovering it caps consumer liability at $50. Reporting later than two days but within 60 days of the statement raises the cap to $500. After the 60-day window closes, the consumer can be liable for the full amount of subsequent unauthorized transfers the bank can show it would have prevented with timely notice.9Consumer Financial Protection Bureau. Regulation 1005.6 – Liability of Consumer for Unauthorized Transfers The two protections run in parallel, so notifying the bank immediately preserves both the Regulation E rights and the Nacha return window.
How Enforcement Works
Enforcement starts with a Report of Alleged Violation filed with Nacha. Only depository financial institutions and ACH Operators can file directly; a business or consumer that believes a rule was broken has to work through their financial institution. The report has to be submitted within 90 days of the alleged violation and must include transaction detail: SEC code, settlement date, dollar amount, trace number, and copies of relevant records.10Nacha. Report of Alleged Violation of the ACH Rules
Nacha’s compliance department then investigates, and each party gets a chance to respond. Most first-time cases end in a warning letter. Repeat problems are escalated to the ACH Rules Enforcement Panel, a body of seven primary and seven alternate members drawn from banks and credit unions of varying sizes, ACH Operators, and payments associations. The Panel, not Nacha’s board, decides whether a violation occurred and whether to impose a fine.11Nacha. How Nacha Enforces Rules, Promotes ACH Network Quality
Infractions are grouped into three severity levels. Class 1 covers minor violations, Class 2 covers more significant breaches (failing to register a Third-Party Sender, for example), and Class 3 covers the most serious misconduct. The fine amount in any given case depends on the class, the egregiousness of the conduct, and how the institution responded once the problem was identified.11Nacha. How Nacha Enforces Rules, Promotes ACH Network Quality Nacha publishes a National System of Fines framework that structures these penalties, though the specific dollar ranges are not public outside the Operating Rules themselves.10Nacha. Report of Alleged Violation of the ACH Rules
Warnings are common, but they create a record. The second or third time the same violation shows up, it lands in front of the Panel, where fines become realistic. Institutions that fix the underlying problem quickly and cooperate with the investigation tend to come out of the process in better shape than those that treat early warnings as noise.