The Biggest Fraud-Related Change This Year Is a Change in Responsibility

The biggest fraud-related change this year is a change in responsibility.

From June 20th, every organisation that originates ACH payments must have documented, risk-based processes to identify potential fraudulent payments.

We are talking about 35.2 billion ACH payments worth $93 trillion that were processed in 2025.

Historically, fraud prevention has often been viewed as the responsibility of banks and payment providers. The new Nacha Rules make it clear that businesses originating payments also have responsibility for preventing fraud before payments enter the network.

That's an important change in mindset.

From response to prevention

Good fraud prevention is no longer just about responding when something goes wrong. It's about demonstrating that you have processes to detect suspicious activity before money leaves the account.

The interesting part is that Nacha deliberately requires organisations to build controls appropriate to their own level of risk. That means understanding:

• Where payment instructions originate
• How payment changes are verified
• Who can approve payments
• What unusual behaviour should trigger additional review
• How fraud incidents are investigated and improved upon

The biggest takeaway

To me, that's the biggest takeaway. Compliance is becoming less about ticking boxes and more about demonstrating that fraud risk is actively managed.

If you're working through how to document and operationalise risk-based controls on your payment flows, we're happy to walk through it.

Originally shared on LinkedIn.