Nacha

Also called NACHA, National Automated Clearing House Association, ACH rules

The private organization that writes and enforces the ACH Operating Rules — the rulebook behind direct deposit and bank debits.

What it is

Nacha governs the ACH Network, the system that carries direct deposits, bank debits, vendor payments and most recurring bill payments in the United States. It is not a government agency and not a bank. It writes the ACH Operating Rules, runs education and accreditation programs, and enforces rule compliance across the financial institutions and originators that use the network. Every time a merchant debits a customer's checking account for a gym membership, an HOA assessment, a pest control route or a monthly invoice, that transaction runs under Nacha rules. Those rules govern authorization requirements, return codes and timeframes, return-rate thresholds that trigger enforcement, data security obligations and the mechanics of Same Day ACH. Two 2026 developments matter. Nacha announced that the Same Day ACH per-payment limit will increase to $10 million, dramatically expanding what can move same-day on the ACH rails. And new Operating Rules aimed at credit-push fraud — business email compromise and impersonation schemes — establish a base level of ACH payment monitoring obligations on all parties in the network except consumers.

Why it matters to your business

ACH at roughly 0.5% to 1% is dramatically cheaper than cards for large-ticket invoices — a $12,000 HVAC install costs $348 on a 2.9% card and a fraction of that on ACH. For any business with invoices over a few hundred dollars, offering ACH alongside cards is the fastest margin improvement available. But you have to get authorization right. Keep the signed or electronically captured authorization for every recurring ACH debit, with the date, amount and frequency stated. When a customer disputes, that record is your entire defense — and if your return rate climbs, your originating bank will notice before you do.

Where it gets contested

The friction merchants encounter with Nacha rules is almost always about authorization and returns. ACH gives the consumer strong revocation and dispute rights, and a merchant with a sloppy authorization process discovers this through returns, which count against thresholds that can get an originator shut off. Merchants often treat ACH as "cheaper cards" and are surprised that the authorization documentation requirements are stricter, not looser. The new credit-push fraud monitoring rules have drawn cost complaints from originators and financial institutions who argue the compliance burden falls on parties who aren't the fraud vector. Nacha's position is that business email compromise losses are large, growing and only detectable at the network level if everyone monitors. Both are defensible. The practical effect is more friction and more scrutiny on ACH origination, particularly for newer merchants. The deeper structural criticism of ACH generally is speed and irrevocability: it's slower than card rails and, unlike RTP or FedNow, ACH debits can be returned days later. That's protective for consumers and genuinely risky for merchants who ship goods or complete work before the return window closes.

How to check it yourself

Pick one recurring ACH customer and try to produce the authorization record: who agreed, when, to what amount, at what frequency, and how it was captured. If you can't produce it in two minutes for one customer, you can't produce it for a hundred, and that's your exposure.

Receipts

Claims above that are checkable, with where to check them. Published so you do not have to take anyone's word for it.

Nacha governs the ACH Network and announced the Same Day ACH per-payment limit will increase to $10 million (April 2026), alongside new Operating Rules establishing base-level ACH payment monitoring on all parties except consumers to reduce credit-push fraud such as business email compromise
nacha.org ↗
Roughly 1 in 3 B2B payments arrives late and the average B2B supplier accepts 5–6 payment forms
pymnts.com ↗