NACHA / ACH Interface Reference
Complete development reference for JIL's NACHA/ACH interface layer - compliance requirements, message formats, 2026 fraud monitoring mandates, and integration architecture for US domestic payment processing.
Table of Contents
2. NACHA Participant Classification
3. Core Standing Obligations
4. 2026 Rule Changes
5. ACH Message Format Reference
6. Standard Entry Class (SEC) Codes
7. Return Reason Codes
8. Fraud Monitoring Requirements
9. Integration Architecture
10. SLA Commitments
11. Testing & Certification
12. Implementation Roadmap
JIL's Role in the ACH Flow
The ACH (Automated Clearing House) network, governed by NACHA, processes US domestic payments - payroll, direct deposit, bill pay, and e-commerce. It processes trillions of dollars annually across all US financial institutions. JIL operates at the interface layer between Originators/ODFIs and the ACH Operator.
What JIL Adds at the Interface Layer
Beneficiary Binding
Cryptographic lock on intended recipient before ACH entry is submitted.
Pre-Settlement Compliance
KYC/AML/sanctions check before the file is sent to ACH operator.
False Pretense Detection
Satisfies NACHA 2026 fraud monitoring mandate at protocol layer.
Finality Receipts
Deterministic finality receipt mapped to ACH trace number for audit trails.
Description Enforcement
Automatic PAYROLL / PURCHASE entry description tagging per 2026 rules.
NACHA Participant Classification
JIL operates under one or both classifications depending on implementation structure.
Third-Party Service Provider (TPSP)
- Provides ACH processing on behalf of ODFIs or Originators
- Directly subject to NACHA Operating Rules
- Must be registered with NACHA
- Subject to audit rights from ODFIs
Third-Party Sender (TPS)
- Transmits ACH entries on behalf of Originators to ODFIs
- Contractual chain: TPS to ODFI to ACH Operator
- Requires written agreement with each ODFI partner
- ODFI remains liable for TPS compliance
Core Standing Obligations
Always-on requirements regardless of volume or phase.
Account Validation
WEB debits must validate first-use consumer account numbers. Validation methods: prenote, micro-deposit, account verification service (AVS). JIL BID system satisfies this via the identity verification pipeline.
Sanctions Screening
Screen all originators and receivers against OFAC SDN List, OFAC Consolidated Sanctions, EU Consolidated Sanctions, and UN Sanctions List. Must screen before ACH entry is originated.
Data Security
ACH data encrypted in transit (TLS 1.2+, TLS 1.3 preferred) and at rest (AES-256 minimum). Role-based access controls with principle of least privilege. Log all access to ACH files and records.
Record Retention
ACH transaction records: 7 years minimum. Authorization records: 2 years after revocation. Audit logs: 7 years. ODFI agreements: duration plus 7 years.
Annual Audit
Annual self-audit of all ACH processes and procedures. Must document findings and remediation. ODFI partners may request audit results.
Error & Return Processing
Process return entries within required windows. Handle NOC (Notification of Change) entries. Keep unauthorized debit return rate below 0.5%; admin/general returns below 3%.
2026 Rule Changes - Active Now
Phase 1 is effective March 20, 2026. These are not future requirements.
Phase 1 - Effective March 20, 2026
Applies to ODFIs, non-consumer originators, TPSPs, and TPSs with 2023 ACH origination volume of 6 million entries or more.
Fraud Monitoring (Outbound)
- Replaces "commercially reasonable" with "processes and procedures reasonably intended to identify" fraudulent entries
- Risk-based approach required - cannot justify eliminating monitoring
- Must differentiate higher-risk from lower-risk transactions
- Annual review of processes and procedures mandatory
- Focus areas: BEC, vendor impersonation, payroll impersonation
Standardized Entry Descriptions (New - All Originators)
| Description | Use Case | SEC Code |
|---|---|---|
PAYROLL | All PPD credits for wages, salaries, compensation | PPD |
PURCHASE | All e-commerce consumer debit purchases | WEB |
False Pretense Definition (New)
"The inducement of a payment by a person misrepresenting (a) their identity, (b) their association with or authority to act on behalf of another person, or (c) the ownership of an account to be credited."
This definition maps directly to JIL's Beneficiary Binding pillar - cryptographic hash lock on intended beneficiary before value moves.
Phase 2 - Effective June 19/22, 2026
Extends to all remaining non-consumer originators, TPSPs, TPSs below the 6M threshold, and all RDFIs. RDFIs must now monitor incoming ACH credit entries for fraud using risk-based factors: account age, balance history, transaction velocity, behavioral anomalies.
ACH Message Format Reference
NACHA ACH files use a fixed-width flat file format. All fields are positionally defined at 94 characters per record.
File Header Record (Type 1) - 94 Characters
| Field | Position | Length | Value |
|---|---|---|---|
| Record Type Code | 1 | 1 | 1 |
| Priority Code | 2-3 | 2 | 01 |
| Immediate Destination | 4-13 | 10 | FRB routing, leading space |
| Immediate Origin | 14-23 | 10 | Company EIN or routing |
| File Creation Date | 24-29 | 6 | YYMMDD |
| File Creation Time | 30-33 | 4 | HHMM |
| File ID Modifier | 34 | 1 | A-Z, 0-9 |
| Record Size | 35-37 | 3 | 094 |
| Blocking Factor | 38-39 | 2 | 10 |
| Format Code | 40 | 1 | 1 |
| Dest. Name | 41-63 | 23 | FRB or bank name |
| Origin Name | 64-86 | 23 | Company name |
| Reference Code | 87-94 | 8 | Optional internal ref |
Batch Header Record (Type 5) - 94 Characters
| Field | Position | Length | Notes |
|---|---|---|---|
| Record Type Code | 1 | 1 | 5 |
| Service Class Code | 2-4 | 3 | 200=mixed, 220=credits, 225=debits |
| Company Name | 5-20 | 16 | Originating company |
| Company ID | 37-46 | 10 | IRS EIN with leading 1 |
| SEC Code | 47-49 | 3 | PPD, CCD, WEB, etc. |
| Company Entry Description | 50-59 | 10 | PAYROLL or PURCHASE where required |
| Effective Entry Date | 66-71 | 6 | YYMMDD - settlement date |
| ODFI Routing Number | 76-83 | 8 | First 8 digits of routing |
| Batch Number | 84-94 | 7 | Sequential, zero-padded |
Entry Detail Record (Type 6) - 94 Characters
| Field | Position | Length | Notes |
|---|---|---|---|
| Record Type Code | 1 | 1 | 6 |
| Transaction Code | 2-3 | 2 | See transaction codes |
| Receiving DFI Routing | 4-11 | 8 | First 8 digits |
| Check Digit | 12 | 1 | 9th digit of routing |
| DFI Account Number | 13-29 | 17 | Receiver account, left-justified |
| Amount | 30-39 | 10 | Dollars + cents, no decimal, zero-padded |
| Individual Name | 55-76 | 22 | Receiver name |
| Addenda Indicator | 79 | 1 | 0=none, 1=addenda follows |
| Trace Number | 80-94 | 15 | ODFI routing (8) + sequence (7) |
Transaction Codes
| Code | Type | Direction |
|---|---|---|
22 | Checking credit | Deposit to checking |
23 | Checking credit prenote | Verify checking account |
27 | Checking debit | Debit from checking |
28 | Checking debit prenote | Verify checking account |
32 | Savings credit | Deposit to savings |
33 | Savings credit prenote | Verify savings account |
37 | Savings debit | Debit from savings |
38 | Savings debit prenote | Verify savings account |
Standard Entry Class (SEC) Codes
| SEC Code | Full Name | Use Case | Type |
|---|---|---|---|
PPD | Prearranged Payment and Deposit | Payroll, recurring consumer payments | Consumer |
CCD | Corporate Credit or Debit | B2B payments, corporate disbursements | Corporate |
CTX | Corporate Trade Exchange | B2B with EDI addenda data | Corporate |
WEB | Internet-Initiated Entry | E-commerce, online-authorized debits | Consumer |
TEL | Telephone-Initiated Entry | Phone-authorized debits | Consumer |
IAT | International ACH Transaction | Cross-border ACH | Both |
CIE | Customer-Initiated Entry | Consumer-initiated online credits | Consumer |
POP | Point of Purchase | Check conversion at POS | Consumer |
RCK | Re-presented Check Entry | Returned check re-presentment | Consumer |
PPD (payroll/consumer), CCD (institutional B2B), WEB (e-commerce), IAT (cross-border)
Return Reason Codes
Administrative Returns
| Code | Description | Return Window |
|---|---|---|
R01 | Insufficient Funds | 2 banking days |
R02 | Account Closed | 2 banking days |
R03 | No Account / Unable to Locate | 2 banking days |
R04 | Invalid Account Number | 2 banking days |
R05 | Unauthorized Debit to Consumer | 60 calendar days |
R07 | Authorization Revoked | 60 calendar days |
R08 | Payment Stopped | 2 banking days |
R10 | Originator Not Known | 60 calendar days |
R16 | Account Frozen | 2 banking days |
R29 | Corporate Not Authorized | 2 banking days |
Fraud-Related Returns (2026 Priority)
| Code | Description | Notes |
|---|---|---|
R05 | Unauthorized consumer debit | Monitor rate - must stay below 0.5% |
R10 | Not authorized / originator unknown | False pretense indicator |
R11 | Entry not per authorization terms | False pretense indicator |
R29 | Corporate not authorized | |
R90 | Sanctions compliance return | Effective 2028 - build handler now |
NOC (Notification of Change) Codes
| Code | Description | Required Action |
|---|---|---|
C01 | Incorrect DFI account number | Update within 6 banking days |
C02 | Incorrect routing number | Update routing number |
C03 | Incorrect routing and account | Update both |
C05 | Incorrect transaction code | Update transaction code |
C06 | Incorrect account and transaction code | Update both |
C07 | Incorrect routing, account, and transaction | Update all three |
Fraud Monitoring Architecture
Per NACHA 2026 rules, the interface must implement this 5-stage monitoring pipeline.
Entity Validation
OFAC/Sanctions screening (originator + receiver), business identity verification (KYB), individual identity verification (KYC)
Account Validation
Account ownership verification (WEB debits: mandatory), prenote or micro-deposit verification, account status check
Transaction Risk Scoring
Amount vs. history, velocity check, geographic anomaly, entry description consistency, BEC pattern detection
False Pretense Detection (NEW 2026)
Beneficiary identity match (JIL BID binding), originator-to-beneficiary association validation, account ownership confirmation. Mismatch triggers hold/reject.
Decision
APPROVE: Submit to ACH operator. HOLD: Queue for manual review (with timeout). REJECT: Return with reason code + audit log entry.
Risk Score Thresholds
Integration Architecture
Core Services to Build
| Service | Function | Priority |
|---|---|---|
nacha-file-parser | Parse inbound NACHA flat files into structured objects | P0 |
nacha-file-generator | Generate valid NACHA flat files from JIL transaction objects | P0 |
nacha-validator | Validate file structure, checksums, field formats | P0 |
entry-description-enforcer | Auto-tag PAYROLL/PURCHASE per 2026 rules | P0 |
fraud-monitor | Risk scoring pipeline | P0 |
return-handler | Process return entries, NOC entries | P0 |
sanctions-screener | OFAC/EU/UN screening before origination | P0 |
account-validator | WEB debit account validation | P1 |
return-rate-monitor | Track unauthorized return rates, threshold alerts | P1 |
audit-logger | Immutable audit log with policy version hash | P1 |
nacha-iso20022-bridge | Translate between NACHA and ISO 20022 pacs.008 | P2 |
File Processing Timing
| File Type | Submission Cutoff | Settlement |
|---|---|---|
| Standard ACH (credits) | 2:45 PM ET | Next banking day |
| Standard ACH (debits) | 2:45 PM ET | Next banking day |
| Same-Day ACH (Window 1) | 10:30 AM ET | Same day 1:00 PM ET |
| Same-Day ACH (Window 2) | 2:45 PM ET | Same day 5:00 PM ET |
| Same-Day ACH (Window 3) | 4:45 PM ET | Same day 6:00 PM ET |
SLA Commitments
Latency Targets
| Operation | Target |
|---|---|
| ACH file validation (per file) | < 500ms |
| Fraud risk score computation | < 1 second |
| BID beneficiary verification | < 3 seconds |
| Sanctions screening | < 2 seconds |
| Finality receipt generation | < 5 seconds after consensus |
| Return/NOC processing | < 30 minutes after receipt |
Incident Response
| Severity | Definition | Response | Resolution |
|---|---|---|---|
| P1 - Critical | ACH processing down / settlement blocked | 15 minutes | 2 hours |
| P2 - High | Degraded performance > 20% | 30 minutes | 4 hours |
| P3 - Medium | Non-critical service degraded | 2 hours | 24 hours |
| P4 - Low | Cosmetic / documentation | 8 hours | 5 business days |
Testing & Certification
NACHA File Testing Checklist
- File Header (Type 1) parses and generates correctly
- Batch Header (Type 5) with all SEC codes
- Entry Detail (Type 6) for all transaction codes
- Addenda records (Type 7) for PPD, CCD, CTX, WEB, IAT
- Batch Control (Type 8) hash and amount totals
- File Control (Type 9) hash and amount totals
- Blocking factor padding (multiples of 10 records)
- PAYROLL description enforced on qualifying PPD credits
- PURCHASE description enforced on qualifying WEB debits
- Return and NOC entry processing
- Prenote handling
- Same-Day ACH effective date handling
Compliance Testing Checklist
- Sanctions screening fires on OFAC-listed entity
- WEB debit rejected on unvalidated account
- PAYROLL description enforced
- PURCHASE description enforced
- Beneficiary hash mismatch triggers hold/reject
- Risk score thresholds trigger correct disposition
- Velocity limits enforced
- Return rate monitoring alerts fire at threshold
- Audit log captures all decisions with policy hash
- R90 handler exists (even if not live until 2028)
ODFI Certification Requirements
- NACHA Third-Party Sender registration
- Written TPS agreement (signed)
- Fraud monitoring framework documentation
- Annual audit commitment
- Data security controls evidence
Implementation Roadmap
Core Parser / Generator
Build nacha-file-parser, nacha-file-generator, nacha-validator. Unit tests for all SEC codes and transaction codes. File padding and blocking factor logic.
Compliance Layer
Integrate sanctions screening, build entry-description-enforcer, fraud-monitor risk scoring, JIL BID integration, return-handler, return-rate-monitor.
Settlement Integration
Map NACHA trace numbers to JIL finality receipts, build audit log with policy version hash, account-validator, file scheduling engine.
ISO 20022 Bridge
Map NACHA Entry Detail to ISO 20022 pacs.008, NACHA Return to pacs.004, NACHA NOC to camt.027. Validate against existing JIL ISO 20022 gateway.
Certification & Go-Live
NACHA TPSP registration, ODFI partner agreement execution, fraud monitoring documentation package, parallel run with test files, production cutover.
Explore All JIL Payment Interfaces
NACHA is one part of JIL's global payment connectivity stack covering 15+ jurisdictions and 25+ payment rails.