Nacha Operating Rules testing requirements
The Nacha Operating Rules govern US ACH payments and apply to financial institutions, ACH Operators, and the businesses and third parties that send ACH entries through a financial institution. Nacha testing verifies file format, return handling, WEB debit account validation, Same Day ACH limits, and fraud monitoring controls. FintechAssuranceLabs produces the test evidence an originating bank or ACH auditor reviews.
- Jurisdiction
- US (ACH Network)
- Primary source
- nacha.org
Engineering interpretation of testing requirements, not compliance advice.
What the Nacha Operating Rules require
Nacha develops and administers the private sector Nacha Operating Rules for ACH payments (Nacha, About Us). The full rulebook is sold by Nacha, so this page cites only Nacha's public rule summaries (checked on 2026-09-16) and the Nacha ACH Guide for Developers, with rule numbers only where a summary names them. The bank that originates an entry is the ODFI; the bank that receives it is the RDFI.
File format
An ACH file is fixed-width ASCII with 94-character records in a set order: file header (1), batch header (5), entry detail (6), addenda (7), batch control (8), and file control (9). Lines of 9s pad the file to a multiple of 10 lines. The batch control Entry Hash is the sum of the Receiving DFI Identification fields in the batch. Each entry detail record carries the receiver's account number, so every generated file holds account data. Appendix Three of the Rules holds the full layouts.
Risk management rules effective in 2026
- Fraud monitoring. ODFIs, non-consumer Originators, Third-Party Senders, and Third-Party Service Providers must establish and implement risk-based processes and procedures reasonably intended to identify entries suspected of being unauthorised or authorised under False Pretenses, and review them at least annually. RDFIs must do the same for received credit entries. Phase 1 started on 20 March 2026 for all ODFIs and for the largest originating and receiving parties by 2023 volume. Phase 2 removed the volume thresholds on 19 June 2026, with 22 June 2026 as the practical date because of a federal holiday. Nacha's FAQ states that the Rules require neither entry-by-entry screening nor monitoring before processing.
- Company Entry Descriptions. Since 20 March 2026, Originators must use "PAYROLL" for PPD (Pre-arranged Payment or Deposit) wage credits to consumer accounts and "PURCHASE" for consumer online purchases of goods sent as WEB (internet-initiated) debits. The field sits in positions 54 to 63 of the batch header.
Account validation and Micro-Entries
- WEB debit account validation. Article Two, Subsection 2.5.17.4 (effective 19 March 2021) requires the fraud detection system for WEB debits to validate an account number for its first use and for any later change to it. Nacha accepts an account number with a history of successful payments as validated.
- Micro-Entries. A credit Micro-Entry is under $1.00, offsetting debits must not exceed the credits, and the Company Entry Description is "ACCTVERIFY" (effective 16 September 2022). Since 17 March 2023, Originators must monitor Micro-Entry forward and return volumes as part of commercially reasonable fraud detection.
Returns, reinitiation, and timing
- Return rates. Article Two, Subsection 2.17.2 sets a 0.5% unauthorised return rate threshold, counted on return codes R05, R07, R10, R11, R29, and R51. Exceeding that threshold requires additional ODFI action and reporting. Administrative returns (R02, R03, R04) above 3.0% or all returns above 15.0% start a Nacha inquiry, which is not an automatic violation. Nacha's calculation sheets use the preceding 60 days or two calendar months.
- Reinitiation. Subsection 2.12.4 requires a reinitiated entry to keep the original Company Name, Company ID, and Amount and to carry "RETRY PYMT". An entry returned as unauthorised cannot be reinitiated.
- Same Day ACH. A Same Day entry must be $1,000,000 or less and cannot be an IAT (international) entry. The limit rises to $10 million per entry on 17 September 2027. Nacha's schedule chart lists ODFI deadlines of 10:30 a.m., 2:45 p.m., and 4:45 p.m. ET.
- Funds availability. From 18 September 2026, Subsection 3.3.1.1 requires RDFIs to make credits that are not Same Day entries available by 9:00 a.m. RDFI local time on the Settlement Date.
Data security, third parties, and Regulation E
Article One, Section 1.6 requires Originators that are not financial institutions, Third-Party Senders, and Third-Party Service Providers above 2 million entries a year to render account numbers unreadable when stored electronically. Since 30 September 2022, each Third-Party Sender must conduct its own risk assessment and Rules Compliance Audit. For consumer accounts, 12 CFR 1005.10(b) allows preauthorised debits only on a writing signed or similarly authenticated by the consumer.
What testing verifies in the Nacha Operating Rules
| Requirement | What we test | Evidence produced |
|---|---|---|
| ACH file format (Appendix Three layouts) | Every generated ACH file has 94-character records in the order 1, 5, 6, 7, 8, 9 and a line count that is a multiple of 10. | File format validation report per generated ACH file |
| Batch control and file control totals | Entry counts, debit and credit totals, and the Entry Hash match the entry detail records after a payment is cancelled. | Control total test cases with expected and actual values |
| Company Entry Descriptions (20 March 2026) | Wage credits to consumer accounts carry "PAYROLL", and consumer online purchase WEB debits carry "PURCHASE". | Batch header field assertions per payment type |
| WEB debit account validation (Subsection 2.5.17.4) | A WEB debit to a new or changed account number is held until account validation passes. | Validation gate test log per onboarding path and account change path |
| Micro-Entries | Credit Micro-Entries are under $1.00, offsetting debits do not exceed the credits, and the batch uses "ACCTVERIFY". | Micro-Entry file assertions with the generated batch headers |
| Return reason codes | Each return code in the test set, such as R01, R03, and R11, moves the payment and the ledger to the state the product defines for that code. | Return code matrix with the posted ledger state per code |
| Reinitiation (Subsection 2.12.4) | A retried debit keeps Company Name, Company ID, and Amount, carries "RETRY PYMT", and is never sent after an unauthorised return. | Reinitiation test cases with the generated retry entries |
| Unauthorised return rate (Subsection 2.17.2) | The return rate report counts R05, R07, R10, R11, R29, and R51 and flags an Originator above 0.5%. | Return rate calculation checks against a synthetic return dataset |
| Same Day ACH eligibility | An entry above $1,000,000 or an IAT entry is never submitted in a Same Day ACH window. | Same Day ACH eligibility and cut-off scenarios per settlement window |
| Fraud monitoring (Risk Management Topics, 2026) | The client's documented fraud monitoring rules raise an alert for synthetic ACH entries after a payee account change or a volume spike. | Alert trace per synthetic fraud scenario |
Artifacts an ODFI or ACH auditor requests
- The Rules Compliance Audit report and ACH risk assessment; a Third-Party Sender presents its own.
- Written fraud monitoring procedures and the record of the latest annual review.
- The account validation method for WEB debits, with test results for new accounts and account changes.
- Return rate reports per Originator, with unauthorised, administrative, and overall rates and the period used.
- Sample ACH files with validation results for format, control totals, and required Company Entry Descriptions.
- Consumer debit authorisations for PPD and WEB entries under 12 CFR 1005.10(b).
- Evidence that stored account numbers are unreadable, for parties above the Section 1.6 volume threshold.
Common Nacha findings
- Account change without validation. A customer edits bank details, and the next WEB debit goes to the new account number with no validation. This breaks Subsection 2.5.17.4.
- Retry job ignores the return type. The retry scheduler resubmits every returned debit, including R10 returns. An entry returned as unauthorised cannot be reinitiated under Subsection 2.12.4.
- Retry with a fee added. A retried debit adds a returned-payment fee to the original amount, or omits "RETRY PYMT". Both break the reinitiated entry requirements in Subsection 2.12.4.
- Old payroll descriptor. A payroll batch still sends "SALARY" in the Company Entry Description after 20 March 2026. This breaks the "PAYROLL" Company Entry Description rule.
- Control totals out of step. A cancelled payment leaves the entry detail records, but the batch control record keeps the old entry count, amount total, and Entry Hash. This breaks the batch control record definition in the Nacha file format.
- Return rate report misses R11. The report counts R10 but not R11, so the unauthorised return rate shows below the 0.5% threshold in Subsection 2.17.2 when it is above.
How we cover Nacha testing
Bank transfers and payment rails testing covers the file format, control total, return, and Same Day rows. That service delivers the "Payment file format validation suite (NACHA, ISO 20022 pain and camt, SWIFT MT and MX)" and "Return, reject, and recall test cases". The NACHA return code testing guide shows the return matrix we run.
BaaS and partner bank integration testing covers the account validation, fraud monitoring, and retry rows, and delivers the "Partner bank due diligence test evidence pack". The sponsor bank compliance audit scenario describes the sequence when an ODFI review is due.
We test ACH flows for payroll platforms, business banking products, AP/AR platforms, BaaS programmes, neobanks, lenders, earned wage access products, and collections software. For these products, an improperly reinitiated debit can come back as an R11 return, which counts toward the 0.5% unauthorised return rate. Consumer debits also fall under Regulation E testing requirements.
We do not perform the Rules Compliance Audit. Your auditor or ODFI decides whether to rely on the test evidence.
Related
Segments
- Business banking
- Payroll and global hiring
- AP/AR automation and treasury
- Banking-as-a-Service and card issuing
- Neobanks and digital banking
- Consumer lending and credit marketplaces
- Earned wage access
- Debt collection and loan management software
- Payment acquiring
- Subscription billing and revenue management
- Buy now pay later
- Expense reporting
- Insurtech
- Family and youth banking
- Open banking and data aggregation
- Revenue-based financing and factoring
- Spend management and corporate cards
- Investing and trading apps
- Robo-advisors and wealthtech
Adjacent standards
Questions
What is a NACHA file?
How does a NACHA file work?
Who do Nacha rules apply to?
Is Nacha a government agency?
Scope your testing
Send FintechAssuranceLabs your product, segment, money flows, and the standards that need evidence, and get a proposed test scope with its deliverables.
Scope your testing