High-Risk ACH Processing

The merchant is usually the Originator of entries. The ODFI transmits entries into the ACH Network and is responsible for its origination program. A payment processor or Third-Party Sender may provide authorization capture, file creation, risk controls, reporting, and settlement services between the merchant and ODFI.

Ask which bank is the ODFI, whether the provider acts as a Third-Party Sender, which legal entity contracts with the merchant, and who can suspend origination or hold settlement. A software connection alone does not establish ACH origination approval.

Phase 1 took effect on March 20, 2026. It applied to every ODFI and to non-Consumer Originators, Third-Party Service Providers, and Third-Party Senders with at least 6 million ACH entries originated or transmitted in 2023. On the receiving side, it applied to RDFIs with at least 10 million ACH entries received in 2023.

Phase 2 has an effective date of June 19, 2026. Nacha notes that June 19 is a federal holiday, so the practical compliance date was Monday, June 22. Phase 2 removed the volume threshold for the remaining non-Consumer Originators, Third-Party Service Providers, Third-Party Senders, and RDFIs.

An ODFI, non-Consumer Originator, Third-Party Sender, or Third-Party Service Provider that performs ACH processing functions must use risk-based processes relevant to its role to identify entries suspected of being unauthorized or authorized under False Pretenses. Those processes must be reviewed at least annually. The rules do not require every entry to be screened individually or require all monitoring to occur before processing.

Consumer and business entries can require different authorization language, notices, records, and Standard Entry Class (SEC) codes. Web-initiated consumer debits, telephone-initiated entries, recurring entries, and corporate entries are not interchangeable labels. The provider should support the authorization method and records required for the merchant’s actual sales channel.

Keep authorization records retrievable for the period required by the applicable rules and contract. The checkout or sales process should make the amount, timing, frequency, cancellation method, and merchant identity clear before the account is debited.

ACH returns are not one metric. Unauthorized returns, administrative returns, and overall returns use different reason codes and risk levels. Nacha’s unauthorized debit return-rate threshold is 0.5%; additional administrative and overall return-rate levels can trigger inquiry. The ODFI or provider may set stricter contractual limits.

A return program should show the original entry, return code, customer authorization, account-validation result, settlement impact, and corrective action. High return rates can lead to delayed funding, reserves, lower volume limits, suspension, or termination under the provider’s agreement.

ACH settlement does not make a debit irrevocable. Entries can be returned after the merchant has received provisional funds, and some consumer claims follow timelines different from standard administrative returns. The merchant needs enough liquidity and reporting to reconcile returns, reversals, refunds, and negative balances.

Compare funding delay, reserve, per-entry and return fees, same-day options, cutoffs, limits, bank holidays, prefunding, and the provider’s right to debit the settlement account. Ask how the service handles rejected files and duplicate entries.

Approval should match the merchant’s product, authorization channel, customer type, projected debit volume, average and maximum amount, recurring model, and expected return profile. A generic claim of “eCheck support” does not answer those questions.