NAPEO
Depending on how a PEO structures its ACH processing relationship, significant responsibilities including fraud monitoring, annual ACH Rules reviews, documented policies, risk assessments, and maintaining supporting evidence may remain with the PEO.
The hodgepodge of local labor and employment policies that vary from jurisdiction to jurisdiction will continue to pose compliance challenges for PEOs that operate across state lines.
If your PEO operates in any states affected by retirement plan mandate, businesses need your help.
given EBSA’s view of PEOs as having a dual role as both plan sponsors and commercial service providers, PEOs should not expect a moratorium on agency action.
OSHA may no longer view heat hazards in isolation, but as part of a more integrated approach to worker health and safety.
The Labor Department’s recent proposed joint employer rule is welcome news for the PEO industry. That being said, you’ve received similar welcome news every other time the DOL went through this same exercise in the past, only to see the helpful guidance unwound by a new administration. Watching the joint employer rule evolve is like watching a very slow and long tennis match with a volley returned every four years. But while we have the benefit of a helpful rule, PEOs should incorporate the guidance into their risk management strategy. Here’s a recap and a review of the four things all PEOs should know.
The DOL’s Wage and Hour Division released a proposal last month outlining a four-factor test to determine when two businesses are liable as joint employers under the FLSA, FMLA, and MSPA. With no single factor being dispositive, the test considers whether a business hires or fires the employee; supervises and controls their work schedule or conditions of employment to a substantial degree; determines their rate and method of payment; and maintains their employment records.
The proposal largely mirrors a 2020 Trump administration rule that was subsequently blocked by a court and later rescinded under Biden, though this version places greater emphasis on actual control over merely reserved control which is helpful for the PEO industry.
Here’s a review of the top four things PEO leaders need to know about this proposal.
The four-factor test plays well when it comes to how PEOs operate. Three of the four factors in the new test favor PEOs, as long as your service agreements, policies, and practices are managed in a way that aligns with the factors. For example, while PEOs need the right to hire and terminate from the standpoint of onboarding and offboarding worksite employees, they generally do not make the decision for the customer. Similarly, PEOs don’t supervise or control worksite employees to a substantial degree, or set their rate of pay, and it is important the PEO avoid the appearance of doing so.
The PEO’s role in these things, or lack thereof, must be made very clear in the service agreement. Your other written materials also must align with the contract on these items.
Marketing related documents can be particularly thorny when it comes to keeping these things in synch because, compared to a contract, they are so informal.
When trying to give a potential customer a brief list of helpful services provided by your PEO, it is very easy to accidentally give the impression the PEO is responsible for things it merely supports by offering tools or guidance to the customer. For example, your service agreement probably says that only the customer is responsible for deciding who is exempt from overtime, even though the PEO may provide guidance or tools for that subject. That is a very important provision. If the sales department’s marketing-oriented list of services includes a vague reference to “exempt / non-exempt status” that can work against what the service agreement is trying to do.
Make sure your legal team reviews any marketing materials to make sure they don’t inadvertently create exposure.
The “reserved control” wrinkle shouldn’t be overblown. The proposed rule departs from the 2020 Trump administration standard in one notable way: it treats the mere right to control (even if never exercised) as relevant to the joint employer analysis. This is the provision that drew the most attention when the rule dropped, and it’s worth understanding why it’s there.
The new approach in the rule is likely there to enhance the ability of the rule to survive a challenge in court and not to actually expand joint employer liability. The 2020 rule’s strict “actual control” standard was struck down in court, with the judge finding it conflicted with the FLSA. The new language hopefully fixes that problem, while practically speaking not significantly increasing the risk of joint liability. The proposed rule itself supports this directly, stating that actual control is “much more relevant” to the analysis than a mere reserved right.
Common PEO services are expressly insulated from the analysis. One of the most significant wins buried in the proposed rule is what it excludes. The DOL explicitly states that certain business practices, standing alone, do not make joint employer status more or less likely. That list reads like a PEO service menu:
The third bullet point is the most useful for PEOs since you often provide all of those services and adversaries often point to them as evidence of joint employer status. The two mentioning “sample” documents are not as helpful because PEOs may do more than just provide samples when they assist customers with things like employee handbooks. But the factors will be helpful in that they acknowledge the difference between providing resources and controlling policy. The association health plan factor is inapplicable.
State law remains the wildcard. The proposed rule would establish a uniform federal standard for DOL enforcement under the FLSA, FMLA, and MSPA, which is a welcome upgrade from the current patchwork of circuit-by-circuit tests. But it doesn’t preempt state law. California, New York, and several other states apply broader joint employer standards, and PEOs with worksite employees in those jurisdictions will need to continue navigating state-specific analysis.
This article is designed to give general and timely information about the subjects covered. It is not intended as legal advice or assistance with individual problems. Readers should consult competent counsel of their own choosing about how the matters relate to their own affairs.
If employer contributions or pre-tax salary deferrals to Trump Accounts becomes a common benefit offering, PEOs are well-positioned to offer it to small businesses who otherwise do not have the bandwidth to administer it.
When your clients decide to expand into new markets, the excitement of growth often collides with a harsh reality: every jurisdiction brings its own maze of employment laws, tax codes, and regulatory requirements.
The United States still lacks a comprehensive AI statute and a national privacy law that would address AI privacy concerns. Instead, agencies and organizations must rely on and adapt existing frameworks to AI use cases.
Across the United States, state privacy laws are rapidly expanding, while federal regulators are increasing enforcement around data handling, discrimination and employee rights.
The practical consequences for employers are significant: inflated settlement demands, warped litigation budgets, and cases that simply don’t resolve the way they used to.
With respect to telework accommodations, PEOs should review existing remote work arrangements that they granted as disability accommodations and assess whether those arrangements remain necessary and appropriate.
Loper Bright cannot be understood in a vacuum. The Supreme Court’s prohibition on lower court national injunctions in the Casa case reduces litigation stakes for agencies and potential rewards for private litigants which could embolden an agency to regulate aggressively.
There’s quite a bit that PEOs need to know and understand about Nacha’s new fraud monitoring requirements including operational impacts and how to prepare before the March 20, 2026, effective date.
The ACH network is the financial backbone of payroll, taxes, benefits, and countless employer-related transactions processed by PEOs every day. As fraud grows more sophisticated, Nacha is implementing a broad set of risk management rule amendments that take effect March 20, 2026. These changes aim to strengthen fraud detection, improve visibility into ACH activity, and enhance the industry’s ability to recover funds when fraud occurs.
For PEOs, who sit at the center of employer payroll operations, these rules represent more than a compliance update. They introduce new expectations around monitoring, data visibility, and internal controls that require preparation well before the effective dates.
This article outlines what’s changing, why it matters, and what PEOs can do now to be ready.
The ACH Network has experienced exponential growth in volume and speed, including same-day and near real-time payments. With that growth has come a parallel rise in:
Historically, many instances of frauds weren’t detected until after funds had settled, making recovery extremely difficult. Nacha’s new rules focus on earlier detection, stronger monitoring obligations, and improved tools for identifying suspicious transactions before they’re processed.
1. Expanded Fraud Monitoring Requirements
Under the new rules, several ACH participants must implement risk-based fraud monitoring across all ACH entries—not only WEB debits or micro-entries.
Requirements impact:
This marks a major shift: monitoring must now occur for all transactions regardless of SEC code or transaction type.
Annual reviews now become mandatory. All entities covered by the rule must review their monitoring processes at least annually, documenting updates and validating effectiveness. Annual fraud review requirements mean PEOs must treat ACH monitoring the same way they treat payroll accuracy: consistently, proactively, and with documentation.
PEO Impact: PEOs that originate payroll files or partner with third-party providers must ensure these monitoring capabilities exist—either internally or through their financial partners.
2. Updated Definition Of “False Pretenses”
Nacha expanded the definition of unauthorized transactions to include payments induced by: misrepresentation of identity, authority, and account ownership. This updated terminology more accurately covers modern fraud methods, including payroll redirection, vendor impersonation, BEC schemes, and account takeovers.
PEO Impact: Payroll departments are prime targets for impersonation-based fraud, especially those processing high volumes on behalf of multiple employers.
3. Standardized Company Entry Descriptions
Two new standardized entry descriptions will be required: payroll (for wage and compensation credits), and purchase (for e-commerce WEB debits).
These standardized labels increase transparency for receiving institutions, aiding fraud detection and funds-availability decisions.
PEO Impact: Standardized descriptors allow banks to better identify unusual payroll activity, such as unexpected frequency changes, which often signal payroll redirection attempts.
While these changes strengthen the ACH ecosystem, they introduce several operational challenges that PEOs must prepare to address.
Comprehensive Fraud & Transaction Monitoring. PEOs will need visibility into a broader range of ACH activity, covering velocity spikes, duplicate entries, irregular transaction patterns, SEC code inconsistencies, and out-of-band payment attempts. This level of monitoring may require new tools or enhancements to existing processes.
AML/KYC-Related Expectations. Though Nacha does not regulate AML laws, its expectations now mirror several AML/KYC principles: account behavior monitoring, risk-based profiling, and suspicious pattern identification. PEOs may need to work more closely with financial institutions to align monitoring practices.
Detecting Batch-Level Discrepancies. Many fraud schemes hide within batch structures. PEOs will need to identify: mismatched totals, duplicate batches, unusual batch volumes, and missing entries. These issues must be flagged before processing—not after settlement.
Payroll Frequency Anomalies. Payroll fraud often begins with subtle deviations in established patterns. Nacha’s rules emphasize monitoring for percentage-based change in payroll volume, transaction count variances, and unexpected off-cycle or one-off payrolls. This is particularly important for PEOs managing multiple employer groups with varied pay cycles.
Meeting Annual Compliance Review Requirements. The required annual reviews will demand documentation, testing, and validation. PEOs must account for this increased workload without slowing down payroll operations.
The most successful organizations will treat ACH risk management as a strategic priority rather than an isolated compliance task. Here are a few steps PEOs can take now.
1. Reviewing ACH workflows end-to-end. Mapping every touchpoint reveals gaps and vulnerabilities.
2. Strengthening internal fraud awareness. Most fraud begins with social engineering; better training reduces risk.
3. Confirming provider readiness. Ensure banks or ACH processors are preparing for new 2026 monitoring requirements.
4. Implementing payroll pattern monitoring. Systems should detect both percentage-based and transaction-based anomalies.
5. Updating client communication processes. Employer contacts must understand red flags and verification expectations.
6. Treat 2025 as a “test year.” Conduct mock audits and practice annual reviews before the deadline.
Nacha’s 2026 rule changes represent one of the most significant updates to ACH risk management in years. For PEOs that manage payroll and payments at scale, these new requirements call for enhanced monitoring, stronger internal controls, better data visibility, and closer collaboration with financial partners.
By preparing early and strengthening fraud detection workflows now, PEOs can protect employers, employees, and payroll operations while stepping confidently into 2026 and beyond.
In May 2025, the Trump DOL announced it would no longer enforce a strict Biden-era rule that deemphasized any “core” factors and adopted a broad, multi-factor economic realities test.
At the start of 2025, only a dozen states had formal pay transparency mandates. By year-end, that number has more than doubled.
What separates resilient companies from reactive ones isn’t the absence of issues; it’s a thoughtful, consistent, and purposeful response.
From a business development perspective, strategic handbook services offer multiple advantages.
With the new $100,000 fee, the economics change dramatically. For smaller employers — many of whom partner with PEOs for HR and compliance — the barrier may now feel insurmountable.
PEOs need to stay on top of these decisions, as they impact guidance that they provide to their clients.
One provision that might be of benefit to PEOs as a potential service to offer their clients is the newly created savings accounts provided in the OBBB.
While the bill simplifies taxes in some areas, it also introduces new compliance requirements tied to workforce investments and tax credit eligibility.
The PEP structure offers employers a high degree of fiduciary outsourcing, pricing scale achieved through asset aggregation, and administrative simplicity.
From hiring to performance management, from resume review to video interviews, AI is increasingly relied upon by employers to help with a wide spectrum of tasks – and lawmakers are taking notice.
