Third-Party Sender Requirements Must Be Completed by December 31, 2026
2026 Nacha Fraud Monitoring Phase 1 and Phase 2 Requirements are Live
Nacha oversees the Automated Clearing House (ACH) Network and issues annual Operating Rules and Guidelines (Rules) requiring all Third‑Party Senders (TPS)(top) and Nested Third‑Party Senders (NTPS)(bottom) to perform an ACH risk assessment, maintain a risk‑based ACH risk management program, and complete an annual Rules Audit by December 31. An NTPS is a TPS that originates ACH transactions through another TPS rather than directly with the Originating Depository Financial Institution (ODFI).
Roles and Responsibilities
- ODFI: A regulated bank or financial institution that accepts and processes the ACH entry on behalf of the Originator.
- TPS: Originates ACH transactions on behalf of an Originator through its contractual relationship with an ODFI.
- NTPS: A type of TPS that originates ACH transactions through another TPS rather than directly with an ODFI.
Nacha Compliance Requirements
- Annual Risk Assessment: Conduct a comprehensive review of ACH activities annually. The assessment should identify potential risks such as fraud exposure, operational weaknesses, regulatory gaps, and reputational concerns.
- Risk Management Program: Establish and maintain a documented risk management program that includes internal controls, transaction monitoring, fraud detection measures, and sanctions screening.
- Annual Nacha Rules Audit: Undergo a formal audit of compliance with the Rules no later than December 31, annually. Audit documentation must be retained and made available to regulators, ODFIs, or Nacha.
Stratis Nacha Compliance Support is Ready and Available to Help You:
- Assess and document ACH risks, mitigating controls, and residual risks in an ACH Risk Assessment.
- Implement and document risk- and scale-appropriate ACH Program.
- Fraud risk management and monitoring.
- Conduct Nacha Operating Rules Audit by December 31, annually.
- Complete bank and/or payment partner self-certification process, annually.
For assistance with completing your Nacha compliance requirements by December 31, contact us:
Third-Party Senders Obligations under the Nacha Operating Rules
NACHA OPERATING RULES | US
Third-Party Senders Obligation to Implement Risk-based Controls in ACH Operations
A Third-Party Sender (TPS) initiates Automated Clearing House (ACH) payments on behalf of Originators through an Originating Depository Financial Institution (ODFI), creating an indirect link to the ACH Network. Nacha Rules govern this flow by requiring TPSs to maintain origination agreements, register promptly, and conduct independent risk assessments and annual audits. TPSs are also accountable for ensuring compliance with applicable Nacha requirements affecting both ODFIs and Receiving Depository Financial Institutions (RDFIs) across all ACH transactions.
Fraud risk management has long been a core operational and financial responsibility for TPS. Recent Nacha Operating Rules (Rules) amendments between 2025 and 2026 have increased the need for proactive monitoring and swift response, positioning fraud oversight a critical priority in maintaining compliance and safeguarding integrity of ACH activities.
The annual ACH Rules Compliance Audit is a Nacha requirement to be completed by December 31 each year designed to verify that each participant’s ACH activities align with the Rules. The ACH Rules Compliance Audit is critical in enforcing accountability, strengthens risk management, and ensures the integrity of the ACH Network.
Nacha Operating Rules Changes from 2026-2028
NACHA OPERATING RULES | US
Nacha Elevating ACH Controls Through the 2026 Rule Amendments
Navigate through the upcoming changes in ACH compliance with this spotlight on Nacha Operating Rules changes from 2026 to 2028. This spotlight lays out a clear timeline of critical updates from phased fraud-monitoring requirements for financial institutions and third-party processors to expanded definitions and data fields for International ACH Transactions (IAT).
The Rules also introduce new fund availability rules, mandatory contact registration, and a sanctions-related return reason code (R90) that could reshape compliance protocols. Whether you are in operations, risk, or regulatory strategy, this offers a concise yet powerful roadmap to help you stay ahead of evolving standards.
Nacha Audit Guidelines of Third-Party Senders
NACHA OPERATING RULES | US
Nacha Operating Rules and Audit Guidelines
for Third-Party Senders
Third-Party Sender (TPS) is defined under the Nacha Operating Rules as a type of Third-Party Service Provider (TPSP) that acts as an intermediary in transmitting entries between an Originator and an Originating Depository Financial Institution (ODFI). The Nacha Operating Rules require a TPS to conduct an annual audit of their ACH compliance by December 31st each year to ensure adherence to Nacha’s ACH transaction guidelines.
Separately, outside of the annual Nacha audit requirement, typically, a Banking as a Service (BaaS) or For Benefit Of (FBO) master services agreement between a technology platform company and a regulated financial institution will require the submission of the audit to maintain compliance with the agreement.
RISK | STRATEGY | CYBER COMPLIANCE MANAGEMENT
