Most FIs have focused on general education and customer communications in 2026 — mailers, emails, web pages, sharing the Nacha Rulebook, alerts in online banking. Far fewer can show what their Originators did with that information.

The changes in effect from June 22, 2026 

Phase 2 of the Nacha Fraud Monitoring Rules is in effect, so all non-consumer Originators are now required to act. Auditors and examiners may request records from ODFIs demonstrating their Originators’ compliance dating back to this date, even if your audit or exam comes later.

 

What we’re already hearing from banks and credit unions 

An auditor recently asked a regional bank to present its ACH Originator oversight plan given the new Nacha Rules’ requirement that Originators participate in the fraud monitoring. The bank described its Originator education it did and its pre-June 22 questionnaire.

The auditor wanted to see what more the bank was doing to ensure compliance with the new Nacha Rules. Fortunately, the bank was able to present its plan to use Lexalign for Originator oversight.

 

Are you accruing a compliance deficit you don’t mean to?

Are you waiting to build records of compliance oversight and simply relying on education? This can result in a lack of oversight evidence that compounds monthly from the effective date.

The question behind the deficit 

Originator education is important. But what else is necessary?

“Verified by appropriate oversight” is the standard Nacha has articulated — and what auditors will have in mind as they audit ODFI compliance with Nacha Rules 2.2.3 and 2.2.4. How does general education stand up?

 

First, what does “verified by appropriate oversight” look like? 

  • Informs Originators about the new Nacha Rules and important deadlines – this is what general education and Lexalign both cover well 
  • Assesses each Originator’s individual operational risk, based on the specific Rules that apply to them – Lexalign facilitates a guided diagnostic interview with each Originator which determines the relevant Rules triggered by their ACH activity and operational environment – with compliance gaps and remediation steps explained in plain-language.
  • Produces documented, audit-ready records on demand for each Originator – this is not covered by General Education. However, Lexalign generates records that are dated, source-cited, and traceable to the specific Rule behind each obligation, so you can produce evidentiary-grade documentation for any Originator, for any year, the moment an auditor or examiner asks.
  • Scales across your full Originator portfolio, so your team isn’t tracking it manually – this is also not covered by General Education, but Lexalign facilitates a Rule-based diagnostic for every Originator and compiles all data and results into a dashboard, that gives you real-time compliance oversight of your Originators across your entire portfolio without adding headcount or chasing paper.
  • Scores and filters by compliance risk or compliance factors to facilitate low-cost, high-impact “risk-based” oversight – while scoring is not covered by General Education, Lexalign quantifies each Originator’s risk into a LexaRating (1–5) and identifies specific risk-factor exposure across your portfolio, so you can filter, triage, and focus your effort where it matters most.

General education isn’t sufficient by itself. Don’t create a ”compliance deficit.”

Question: Can I send out education to all my Originators?

Answer: An email you sent to all of your Originators isn’t evidence that an individual Originator understood the Nacha Rules that applied to them specifically — and then took action.

Question: Will my Origination Agreement work?

Answer: An Origination Agreement reads the requirements under Nacha Rule 2.2.2, but doesn’t satisfy the ODFI responsibility under Nacha Rule 2.2.3.

Question: Can I send out a questionnaire?

Answer: If you do, ask yourself: does the questionnaire alert each Originator to the specific gaps in their compliance with the applicable Rules and empower their remediation with clear guidance and tracking? And could you promptly demonstrate this across your portfolio?

When waiting until 2027 to comply means compounding risk.

Waiting doesn’t just push the work to next year — it could cost you more time and money in 2027. Auditors and examiners may request compliance records dating back to June 22, 2026, and each day you wait is a deficit you can’t backfill.

 

If you start in 2026…

  • The deficit stops growing the day you begin
  • Oversight you can demonstrate, right away
  • A smaller, calmer lift this year
  • Ready when the audit or exam come
  • Educate and empower your Originators simultaneously

 

If you wait until 2027…

  • More time and money to catch up
  • Months of records you can’t reconstruct
  • A bigger lift in a busier year
  • The potential for fines and higher oversight expectations, with aggressive, disruptive timeframes for remediation
  • Still exposed if the audit or exam comes before Lexalign onboarding

A few questions worth asking yourself

  1. If an auditor or examiner asked tomorrow how you assess your Originators — your process, your sample population, the evidence you’d provide — could you answer?
  2. If an auditor or examiner asked you to identify your low vs. high-risk Originators based on operational compliance and security gaps, could you do that?
  3. If an auditor or examiner asked how you’re ensuring each Originator can comply with the Nacha Rules that actually apply to them individually, do you have an answer?
  4. If an auditor or examiner asked you to identify instances where you empowered and tracked Originator compliance remediation – including with the Fraud Monitoring Rules – would you be able to do so?

Educating your Originators was the right first move.

Don’t let a compliance deficit become the next problem you have to deal with — or make the new Rules even harder to solve for. After identifying the gap, having a plan is the next step. We’re here to help. Lexalign provides an automated solution developed by attorneys that enables you to demonstrate Originator compliance enablement and oversight across your portfolio.

Schedule a demo with our team to learn more about how Lexalign can help.

Privacy Preference Center