Reference guide

Nacha rules, in plain tables.

What the Nacha Operating Rules require, from SEC codes to the 2026 rule dates.

Updated September 13, 2026 · 23 primary sources

The short answer

The Nacha Operating Rules govern the ACH Network; agreements bind originators to them.
SEC codes set the rules per payment: CCD for businesses, PPD for consumers.
2026 brought fraud monitoring for non-consumer originators and PAYROLL and PURCHASE descriptions.

The basics

What the Nacha Operating Rules govern

The ACH Network: The Rules govern the network and how funds settle between financial institutions.
Two ACH Operators: The Federal Reserve Banks and The Clearing House's Electronic Payments Network.
Bound by agreement: An agreement binds each Originator and its ODFI to the Rules.
Business receivers: Trading partners need an agreement; both parties must be bound to the Rules.
Third parties: TPSPs create or send files for others; ODFIs register their Third-Party Senders.
The rulebook: The full Rules and Guidelines is an annual publication, sold by subscription.

ACH SEC codes

SEC codes and when each applies

The SEC code marks consumer or corporate, single or recurring, and the record format.

Code	Name	Used for	Authorization
CCD	Corporate Credit or Debit	Business payments, cash concentration	Agreement between the companies
CTX	Corporate Trade Exchange	Business payments with up to 9,999 addenda	Agreement between the companies
PPD	Prearranged Payment and Deposit	Consumer credits and debits, such as payroll	In writing, for consumer debits
WEB	Internet-Initiated/Mobile Entries	Consumer debits authorized online or by mobile	Similarly authenticated
TEL	Telephone-Initiated Entries	Consumer debits authorized orally by phone	Recording or written notice
IAT	International ACH Transaction	Payments involving an office outside the U.S.	Depends on consumer or corporate type
ARC	Accounts Receivable Entries	Mailed or lockbox checks converted to ACH	Notice before accepting the check
BOC	Back Office Conversion	In-person checks converted later	Notice before accepting the check
POP	Point of Purchase	Checks converted at the point of purchase	Notice and written authorization
RCK	Re-presented Check Entries	Returned checks presented again as ACH	Notice before accepting the check
CIE	Customer Initiated Entries	Consumer bill-pay credits to companies	Presumed agreement
POS	Point of Sale	Debits at an electronic terminal with a card	Written

CCD vs PPD

CCD vs PPD, side by side

The Originator carries the burden of knowing whether an account is consumer or business.

Point	CCD	PPD
Receiver's account	Business (non-consumer)	Consumer
Debit authorization	Agreement; both parties bound to the Rules	Signed or similarly authenticated writing
Addenda records	One	One
Unauthorized debit return	R29, 2 banking days	R10 or R11, 60 days
Change-of-date notice	7 calendar days	7 calendar days
Change-of-amount notice	Consumer rule; not CCD	10 calendar days
Sent to the wrong account type	R05 return, 60 days	Not applicable

Authorizations

What an authorization must do

Consumer debits: Need a writing signed or similarly authenticated, in clear and readily understandable terms.
Recurring debits: Must tell the consumer how to revoke authorization for future debits.
Phone authorizations: A single TEL debit needs an audio recording or written notice before settlement.
Keep the evidence: Two years from authorization; for recurring, two years after termination or revocation.
Proof on request: The ODFI has 10 banking days to provide proof or accept a return.
Notice of changes: Seven calendar days for a new date; ten for a new consumer amount.
WEB debits: Validate the account on first use and whenever the account number changes.

Numbers to know

Limits, deadlines and thresholds

Rule	Number	Applies to
Same Day ACH limit	$1 million per payment	Every Same Day entry; IAT excluded
Unauthorized return rate	0.5%	R05, R07, R10, R11, R29, R51 debit returns
Administrative return rate	3.0%	R02, R03, R04 debit returns
Overall return rate	15.0%	All debit returns
Reversal window	5 banking days after settlement	Duplicates and other named errors
Notification of change	6 banking days, or before the next entry	Most change requests, whichever is later
Micro-entry credits	Under $1.00, described ACCTVERIFY	Account validation by micro-entries
Stored account numbers	Unreadable when stored electronically	Non-FI originators and third parties above 2 million entries
Prenotification	At least three business days ahead, recommended	Before the first live entry

Nacha rules 2026

Rule dates for 2026 and after

Dates as Nacha lists them on its New Rules page, checked September 13, 2026.

Effective	Rule	Who it affects
March 20, 2026	Fraud monitoring, phase 1	ODFIs; others with 6 million+ entries in 2023
March 20, 2026	PAYROLL and PURCHASE entry descriptions	Payroll PPD credits; consumer online purchases of goods
June 22, 2026 (listed June 19)	Fraud monitoring, phase 2	All other non-consumer originators, TPSPs, TPSs and RDFIs
July 24, 2026	U.S. Treasury joins the ACH Contact Registry	Financial institutions and Treasury's Fiscal Service
September 18, 2026	Non-Same Day credits available by 9:00 a.m.	RDFIs, in their local time
September 18, 2026	Definition of IAT entries	IAT entries
January 1, 2027	Accepted characters; IAT contacts in the registry	Files; DFIs handling IAT
March 19, 2027	IAT amendments: date of birth, non-bank agencies	IAT entries
September 17, 2027	Same Day ACH limit rises to $10 million	Same Day entries; IAT still excluded
March 17, 2028	R90 return code for sanctions compliance	RDFIs

Enforcement

Audits, fines and inquiries

Annual audit: Participating DFIs and third-party service providers and senders audit Rules compliance yearly.
Fines can pass down: Nacha fines financial institutions, which may pass fines to originators by contract.
Egregious violations: Involve at least 500 entries, or entries totaling at least $500,000.
Class 3 sanctions: Up to $500,000 per occurrence, and a directive to suspend the originator.
Return-rate levels: Exceeding 3% or 15% starts a Nacha inquiry, not an automatic violation.
Exposure limits: Financial institutions must set exposure limits for originators; prefunding is not one.
Individual accreditation: Nacha's Accredited ACH Professional credential is earned by individuals, by exam.

Questions

What people ask about the Nacha Rules.

What are the Nacha rules?: The Nacha Operating Rules govern the ACH Network, its participants and settlement.
What is the difference between CCD and PPD?: CCD goes to business accounts. PPD goes to consumer accounts, with consumer return rights.
What are ACH SEC codes?: Three-letter codes, like CCD, PPD, WEB and TEL, that classify each ACH entry.
What are the new Nacha rules for 2026?: Two fraud-monitoring phases, PAYROLL and PURCHASE descriptions, and earlier credit availability.
Who has to follow Nacha rules?: Banks in the network, plus originators and third parties bound by agreement.
What is the Same Day ACH limit?: $1 million per payment today. Nacha raises it on September 17, 2027.

Sources

Where every fact comes from.

Primary sources only. Rules change, so check the date above.

After the cart

Need this built or fixed?

Thirty minutes with the people who build it.

Book a 30-minute call Every guide