Payments
Nacha Operating Rules Changes from 2026-2028
NACHA OPERATING RULES | US
Nacha Elevating ACH Controls Through the 2026 Rule Amendments
Navigate through the upcoming changes in ACH compliance with this spotlight on Nacha Operating Rules changes from 2026 to 2028. This spotlight lays out a clear timeline of critical updates from phased fraud-monitoring requirements for financial institutions and third-party processors to expanded definitions and data fields for International ACH Transactions (IAT).
The Rules also introduce new fund availability rules, mandatory contact registration, and a sanctions-related return reason code (R90) that could reshape compliance protocols. Whether you are in operations, risk, or regulatory strategy, this offers a concise yet powerful roadmap to help you stay ahead of evolving standards.
Nacha Audit Guidelines of Third-Party Senders
NACHA OPERATING RULES | US
Nacha Operating Rules and Audit Guidelines
for Third-Party Senders
Third-Party Sender (TPS) is defined under the Nacha Operating Rules as a type of Third-Party Service Provider (TPSP) that acts as an intermediary in transmitting entries between an Originator and an Originating Depository Financial Institution (ODFI). The Nacha Operating Rules require a TPS to conduct an annual audit of their ACH compliance by December 31st each year to ensure adherence to Nacha’s ACH transaction guidelines.
Separately, outside of the annual Nacha audit requirement, typically, a Banking as a Service (BaaS) or For Benefit Of (FBO) master services agreement between a technology platform company and a regulated financial institution will require the submission of the audit to maintain compliance with the agreement.
PayFac Operational Challenges and Risk Mitigation Methods
PAYFACS | US
Risk Mitigation for Payment Facilitators
A payment facilitator (PayFac) is a company that helps simplify electronic payments processing for smaller merchants or businesses. This allows merchants to accept payments quickly and with minimal paperwork. The origin of PayFac can be traced in the early 2000’s when there was a demand to simplify payment processing among small businesses.
The PayFac industry continues to evolve due to a heavy emphasis on card-based transaction activity. The rise of PayFac-as-a-Service (PFaaS) is vital in streamlining payment facilitation, which allows businesses to provide payment solutions. However, the regulated financial institution behind the PayFac typically passes down certain regulated requirements as part of the contractual relationship.
European Union’s Payment Services Directive (PSD3) Reinvents PayFacs
PAYFACS | EU
Understanding PSD3, Requirements, and How European Union (EU) Reinvents PayFacs
The payment facilitation industry is rapidly evolving. The European Union (EU) region is not new to the ever-changing landscape of regulatory frameworks to address risks and build a future-proof environment of payment facilitators. One of the most current reforms is the transition from Payment Services Directive 2 (PSD2) to PSD3. These entail modernization in the payment ecosystem, enhance consumer protection, and combat financial crimes more effectively.
Under PSD3, the concept of diversification of safeguarding channels introduces a more robust framework of protecting client funds, especially for PayFacs. This entails a strategic shift from PSD2’s flexible approach to risk-sensitive, regulator-driven model.
Registration and Compliance Requirements for Canadian Payment Service Providers (PSPs)
PSP | CANADA
The Retail Payment Activities Act (RPAA) Requires Payment Service Providers to Register with the Bank of Canada
Approved by Parliament in June 2021, the RPAA established a legal framework for the central bank of Canada, the Bank of Canada (Bank), to supervise payment service providers (PSPs). The RPAA requires certain businesses, including money services businesses (MSBs) within scope to register as PSPs by November 15, 2024. Previously, PSPs only registered as MSBs with the Financial Transactions and Reports Analysis Centre of Canada (FINTRAC) and were primarily focused on anti-money laundering (AML) compliance.
A PSP is defined by the Bank as an “individual or entity that performs payment functions as a service business activity that is not incidental to another service or business activity.” Whether or not you have a place of business within or outside Canada, as long as you provide the following retail payment services below to end users in Canada, a business is considered a PSP within scope of the RPAA unless your business or the retail payment activities you offer are excluded.
Other Relevant Spotlights
CYBERSECURITY
Strengthening Cybersecurity in the European Union through Digital Operational Resilience
A Spotlight on the Implementation and Requirements of the Digital Operational Resilience Act (DORA)
DATA PRIVACY
Handling and Protecting Personal Sensitive Information
A Spotlight on the Global Regulatory Emergence of Consumer Privacy
KNOW YOUR CUSTOMER
Knowing Your Customer Data Journey
A Spotlight on Standards for Know Your Customer (KYC) Framework and Procedures
415.352.1060 2193 Fillmore Street, Suite 1
San Francisco, CA 94115

RISK | STRATEGY | CYBER COMPLIANCE MANAGEMENT
© 2026 Stratis Advisory LLC. All Rights Reserved.
Terms of Use | Privacy Policy
















