Navigating the 2026 NACHA Rules: What Every ISO Reseller Must Ensure Their Merchants Know

ACH Fraud Prevention Is Becoming Everyone’s Responsibility

Historically, most merchants treated fraud monitoring as a process handled primarily by banks or processors. When a challenge occurred, they left it in the hands of their banks, allowing them to track down potential fraud and handle any problems. The 2026 NACHA changes, however, reinforce a broader model: multiple participants across the ACH ecosystem are responsible for detecting and responding to potentially fraudulent activity. For ISO Resellers, this creates an important merchant-education opportunity. Compliance isn’t just an obligation for resellers, merchants, and banks and processors. It’s a critical part of operating ACH responsibly.

What Changed in 2026?

As of 2026, new requirements have been issued to a variety of operators within the ACH ecosystem, including:

• Originators
• ODFIs
• Third-party service providers / third party senders

All of these organizations must have risk-based processes and procedures that can identify ACH transactions initiated because of fraudulent activity. Phase 1 targeted larger-volume organizations and went into effect on March 20; Phase 2 expanded the requirement regardless of origination volume beginning in June. For most merchants, that may mean the need to institute new systems or processes to ensure that they remain in compliance.

NACHA does not prescribe one specific fraud detection technology or method. Rather, controls should reflect each organization’s unique needs, including its size, risks, and operational complexity.

The Biggest Message for Merchants: “My Processor Handles Fraud” Is No Longer Enough

Previously, merchants may have put the full burden of dealing with potential fraud directly on the processor. Now, however, that’s no longer enough.

Fraud Prevention Liability

Merchants can’t just turn over the process of dealing with fraud prevention to the processor or financial institution – from the mental processes necessary to keep up with those demands to the actual processes that detect, report, and manage fraudulent activity. While the exact controls will differ by merchant, businesses need processes appropriate to the transactions they originate.

ISO Reseller Responsibility

As a reseller, you don’t need to become the merchant’s compliance attorney. You can’t force merchants into compliance, nor can you dictate the steps they must take to meet it. However, you do need to help your merchants understand that ACH comes with operational responsibilities. That includes providing clear insight into what they’re responsible for and what they can expect as they continue to operate and use those systems.

What Should ISO Resellers Be Discussing With Merchants?

Whether you’re working with a new merchant or making sure that your current clients understand their responsibilities, there are several key areas you need to cover.

Know the Payment Workflow

Talk to your merchants about these key factors in the payment workflow, including:

• Who initiates payments?
• Who can change bank account information?
• Where are approvals required?

By making sure they understand every checkpoint in that workflow, they can identify places where potential problems can arise.

Look for Abnormal Activity

There are several red flags that may indicate potentially fraudulent activity. Many merchants, however, may not be familiar with them, or may not have had to look for them before. Encourage them to keep an eye on:

• Unusual dollar amounts
• Unexpected account changes
• Payment behavior inconsistent with normal patterns

Merchants often know their clients well. Any time their patterns change, particularly without prior notice or a direct communication from the client, they may notice a problem and under these new regulations, it’s their responsibility to take note of it.

Protect Account-Change Requests

Business email compromise is a major source of payment fraud. Emails are all too easy to spoof, and many providers fail to verify where the email is coming from before they take action based on those emails. Independent verification of suspicious bank account changes can, in many cases, prevent fraud and setting that verification process in place helps merchants protect their clients.

Establish Internal Controls

Putting together effective internal controls can go a long way toward reducing overall fraud risk. That starts with separating duties where appropriate, rather than leaving one member of the team in charge of every step in the approval or transaction process and setting approval processes in place for higher-risk transactions. Staff training can also serve as a key fraud prevention measure for many merchants.

Review the Process Regularly

Risk controls shouldn’t be static. New fraud behaviors and patterns arise all the time and, in many cases, they require businesses to adjust their processes to avoid being scammed. NACHA specifically frames the 2026 change as a move toward risk-based fraud monitoring across the ecosystem rather than prescribing a single technology, but that means that merchants must create solutions that work for their needs and continue to improve their fraud prevention efforts over time.

Why This Is an Opportunity for ISO Resellers, Not Just a Compliance Conversation

Merchants don’t necessarily want another vendor who simply gives them processing services. They value partners that help them understand payments, fraud risks, and the tools they need to protect themselves and their brands. A reseller that proactively discusses ACH risk demonstrates expertise in the industry and their commitment to aiding their merchants – and that’s where you can stand out.

The onboarding process is a fantastic opportunity to discuss payment workflows and help merchants understand critical elements of the process, including authorization, fraud monitoring, and operational controls. This simple step builds trust and differentiates you from competitors selling purely on price.

Questions Every ISO Reseller Should Be Able to Ask a Merchant

From the sales conversation to the onboarding process, there are several key questions you may need to ask merchants to get a stronger understanding of their needs and compliance requirements.

• What types of ACH transactions will you originate?
• Who initiates or approves them?
• How do you verify new or changed bank information?
• What activity would be unusual for your business?
• Who reviews exceptions or returns?
• When was your fraud process last reviewed?

With these simple questions, you can often create openings to better discuss the needs of those merchants, providing them with tools and support that can help them meet their compliance requirements more effectively.

How VCI Supports Our Reseller Partners

Our experienced support teams understand ACH and reseller relationships, and we’re here to provide the guidance you need to help your merchants operate ACH programs responsibly. We provide processing technology alongside reporting and risk-management capabilities: a package that helps ISO resellers give merchants a stronger ACH experience without having to become ACH infrastructure experts themselves.

The 2026 rules give you another reason to make ACH education part of every merchant conversation. Talk to VCI about the processing technology, support and resources available to our partners.