June 22: The Nacha Deadline Most Finance Teams Are Missing

On June 22, every business that sends or receives ACH gets pulled into Nacha's new fraud-monitoring rules. No volume threshold. No exceptions.

Phase 1 went live March 20 and only covered the largest originators. Phase 2 closes the gap. The official effective date is June 19, but because that is a federal holiday, the operative day is Monday, June 22. By then, every non-consumer originator, third-party sender, and receiving depository institution must have a documented, risk-based fraud monitoring program in place. (Phase 2).

The piece that actually matters: "False Pretenses"

Buried in the rule is a new defined term that changes how the ACH network treats authorized-but-deceived payments. False Pretenses covers any payment induced by someone misrepresenting their identity, their authority, or the ownership of an account.

In plain terms: BEC, vendor impersonation, capital-call fraud, and payroll redirection are now inside the scope of required monitoring, even when an employee technically authorized the wire.

The network used to treat "authorized" and "unauthorized" as a clean binary, and deceived-but-authorized payments lived in a gray zone where nobody had a duty to act. Not anymore.

Why this matters now

Fraud isn’t slowing down. The FBI’s 2025 Internet Crime Report shows $20.9 billion in losses last year, up 26%. BEC alone accounted for $3 billion across nearly 25,000 incidents, and most of that money moved through wire or ACH.

And the teams most exposed? Fund managers and AP.

They’re dealing with high-value transactions, tight timelines, and instructions coming in over email, often with lean teams making approval decisions quickly. That’s exactly where attackers focus.

What to have in place before June 22 

• Map where payment instructions enter your process (email, portals, internal requests, etc.)
• You likely already require verification for any bank or routing changes - have a technical control that supports and audits this activity
• Put dual approval and callback procedures in place
• Train AP, fund accounting, and IR teams on common red flags
• Document everything, including how you’ll review it annually

The rule doesn’t say you need to screen every transaction in real time. It does expect a program that exists beyond a policy doc and one you can actually show if asked. 

How Conduit helps‍

This usually isn’t a policy issue, but a workflow issue.

It’s the bank change that slips through without a callback. The new vendor set up in a rush. The email that looks just real enough to pass.
‍
That’s where things break down.

Conduit helps close those gaps inside the payment workflow itself:

• Flags suspicious patterns in real time, like unusual request behavior or signs of BEC
• Verifies vendors and payees through independent, out-of-band checks, especially for new payees or account changes
• Enforces approval controls like dual approvals, thresholds, and callbacks directly in the process
• Automatically logs every step for audit-ready documentation
  

If you’re working through Phase 2 readiness, we can walk through your current workflow with you and show exactly where controls should sit, and where risk is still creeping in.

‍