WHO OWNS YOUR ACH COMPLIANCE?

I recently had the opportunity to attend the All Things Nacha educational session during NAPEO’s Operations Workshop. The presentation provided an excellent overview of the 2026 Nacha operating rule changes and the evolving responsibilities of ACH participants across the payroll industry.

What surprised me wasn’t the presentation itself; it was the conversations during and afterward.

Throughout the conference, I spoke with payroll professionals, operations leaders and executives from PEOs of all sizes. While many had heard about the new Nacha rules, a surprising number were not entirely sure how the changes applied to their organizations or who was ultimately responsible for compliance.

That lack of clarity is understandable. PEOs continue to navigate changing tax regulations, cybersecurity threats, labor law updates and increasing client expectations. Yet these Nacha rule amendments deserve particular attention because they reinforce something much larger than regulatory compliance: the need for stronger fraud prevention, documented operational controls and clearly defined accountability.

WHO OWNS COMPLIANCE?

One of the most common assumptions I heard during the workshop was that ACH compliance automatically becomes the bank’s responsibility simply because the bank transmits the ACH file.

In many situations, that isn’t the case.

Depending on how a PEO structures its ACH processing relationship, significant responsibilities including fraud monitoring, annual ACH Rules reviews, documented policies, risk assessments, and maintaining supporting evidence may remain with the PEO.

Banks play a critical role in the ACH Network, but they may not assume responsibility for your organization’s internal fraud-monitoring program or operational compliance.

That distinction matters.

The question every PEO executive should be asking is: If our bank, an auditor or one of our largest clients asked us tomorrow to demonstrate compliance with the 2026 Nacha Operating Rules, could we confidently produce the documentation?

If the answer isn’t an immediate “yes,” now is the time to better understand where those responsibilities reside.

FRAUD HAS CHANGED

The 2026 Nacha rules reflect an important reality: fraud has evolved. Today’s payment fraud rarely begins with sophisticated malware or someone breaking through a firewall. Instead, it often starts with a convincing email.

A payroll administrator receives what appears to be an urgent request from a client to change payroll funding instructions. An HR professional receives an employee request to update direct deposit information hours before payroll is finalized. A controller receives instructions that appear to come from a company executive requesting a last-minute vendor payment change.

Each request appears legitimate. Each transaction may be authorized by a trusted employee.

Yet each could result in significant financial loss.

This is why Nacha expanded its focus on fraud committed under false pretenses or payments initiated by authorized individuals who have unknowingly been deceived.

Organizations can no longer rely solely on traditional approval processes. Risk-based fraud monitoring has become an essential component of modern payroll operations.

OPERATIONAL RISK IS BUSINESS RISK

For PEOs, payroll is built on trust. Clients trust you to pay employees accurately and on time. Employees trust that their wages will arrive exactly where and when expected. When that trust is interrupted, the consequences extend well beyond a single payroll cycle.

Fraudulent transactions or inadequate controls can lead to delayed payrolls, increased client inquiries, overwhelmed support teams, additional administrative work and heightened scrutiny from banking partners or auditors.

The strongest organizations recognize that fraud prevention is no longer just an IT or compliance initiative. It is an operational discipline that requires coordination between payroll, finance, compliance, executive leadership and payment partners.

FIVE QUESTIONS EVERY PEO SHOULD ASK

As I reflected on the discussions at the NAPEO event, five questions stood out that every PEO leadership team should ask:

1. Who owns our ACH compliance responsibilities?
2. Are our fraud-monitoring processes documented, tested, and reviewed annually?
3. Can we identify unusual payroll or funding activity before transactions are released?
4. Have we reviewed our ACH procedures since the 2026 Nacha operating rule changes took effect?
5. Do our banking and payment partners clearly define which compliance responsibilities they support, and which remain ours?

The answers often reveal opportunities to strengthen governance before a problem occurs rather than after one has already impacted operations.

LOOKING AHEAD

One of my biggest takeaways from NAPEO’s Operations Workshop wasn’t simply that new Nacha rules exist. It was recognizing that many organizations are still determining how these requirements fit into their existing payroll operations.

The 2026 Nacha operating rules should be viewed as more than a regulatory obligation. They present an opportunity for PEOs to evaluate internal controls, improve fraud-monitoring practices, strengthen documentation and reinforce client confidence. Most importantly, they encourage every organization to answer one fundamental question: Who owns your ACH compliance?

Because understanding that answer today may prevent operational disruptions, compliance challenges, and difficult conversations tomorrow.