New NACHA Rules for ACH Validation: Strengthening Supplier Payment Controls

ACH payments offer significant advantages over paper checks, but they also make the accuracy and security of supplier banking information increasingly important.

For accounts payable teams, one of the highest-risk moments isn't necessarily when the payment is released.

It's when a supplier is created or changes its banking information.

Fraudsters increasingly target supplier onboarding and bank-change processes because redirecting a legitimate payment can be easier than attacking the payment system itself.

Changes to the NACHA operating rules are putting additional emphasis on risk-based fraud monitoring for ACH transactions. For AP organizations, that's another reason to examine how supplier banking information is collected, verified, approved, changed, and documented.

A supplier portal can play an important role by replacing email-based processes with structured workflows and stronger controls.

Why Supplier Banking Information Deserves More Attention

Many AP organizations have historically treated supplier bank setup as an administrative task.

A supplier sends banking information. AP enters it into the ERP. Someone approves the supplier or payment, and the process moves forward.

The problem is that supplier banking information has become a major target for fraud.

A fraudulent bank-change request may look legitimate:

• The email appears to come from a known supplier

• The request includes realistic supplier information

• The new bank account is valid

• The fraudster creates a sense of urgency

• The communication may appear to come from an existing email thread

If AP simply accepts the new information and updates the supplier master, a legitimate payment can be redirected to an account controlled by a fraudster.

That's why supplier banking changes should be treated as a control event, not simply a data-maintenance task.

Account Validation vs. Account Ownership Verification

One important distinction is the difference between validating a bank account and verifying who owns it.

Account Validation

Account validation is designed to help determine whether banking information appears valid and whether an account can receive ACH transactions.

Depending on the process and service being used, validation methods can include:

• Routing-number validation

• Account validation services

• Prenotification

• Micro-deposits

• Other bank-validation methods

These controls can help identify invalid or unusable banking information.

But there's an important limitation:

A valid bank account isn't necessarily the supplier's bank account.

A fraudster can provide legitimate banking information for an account they control.

Account Ownership Verification

Ownership verification goes further by helping determine whether the account belongs to the intended supplier.

This adds another layer of protection against bank-account substitution and fraudulent change requests.

Organizations can combine technology-based verification with other controls, including independent callbacks and multi-level approvals.

The objective is layered protection rather than relying on any single verification method.

Three High-Risk Events for AP

Supplier banking controls deserve particular attention in three situations.

1. New Supplier Onboarding

Banking information entered during supplier setup can eventually become the destination for payments.

Organizations should therefore apply appropriate verification and approval controls before new banking information becomes active.

2. Supplier Bank Account Changes

Changes to existing supplier banking information are particularly sensitive.

A supplier relationship may have existed for years, but a fraudulent request to change the payment destination can redirect future payments.

Bank-change requests should trigger a defined verification and approval workflow.

3. First Payment to New Banking Information

Even after new banking information has been approved, organizations may choose to apply additional controls before the first payment is released.

The appropriate controls should reflect the organization's risk profile, payment amounts, policies, and banking practices.

Why Email-Based Bank Changes Create Risk

Email remains one of the most common ways suppliers and AP departments communicate.

But it is a poor control environment for sensitive banking changes.

Consider a typical process:

Supplier emails new banking information → AP receives it → AP verifies it by email or phone → AP updates the ERP → Payment proceeds

Several things can go wrong.

Business Email Compromise

An attacker may compromise or imitate a supplier's email account and submit fraudulent banking information.

If AP verifies the request by replying to the same compromised email conversation, the fraudster may remain in control of the process.

Manual Data Entry

Bank information received through email or PDF often needs to be manually entered into another system.

That introduces opportunities for typing and transposition errors.

Inconsistent Verification

One AP employee may call the supplier. Another may reply by email. Another may accept documentation without independent verification.

Without a defined workflow, controls can vary by employee or transaction.

Fragmented Audit Trails

Evidence may be scattered across inboxes, attachments, notes, phone records, and ERP history.

That makes it harder to demonstrate exactly:

• Who requested the change

• Who reviewed it

• How it was verified

• Who approved it

• When it became effective

A structured process makes those questions much easier to answer.

Building Stronger Bank-Change Controls

No single control eliminates payment fraud.

A stronger approach combines several controls.

Supplier Self-Service

Allow suppliers to submit and maintain information through a controlled portal rather than sending sensitive banking information through email.

This reduces manual re-entry and creates a structured point of entry for supplier data.

Multi-Level Approval

Banking changes can be routed through defined approval workflows.

Depending on organizational policy, higher-risk changes can require additional approval before becoming effective.

Separation of Duties

The individual initiating or reviewing a banking change shouldn't necessarily be the only person authorizing it.

Separating responsibilities can reduce the risk of unauthorized changes.

Independent Verification

For sensitive changes, AP can use an independent verification method rather than relying solely on the contact information contained in the change request.

For example, an organization may contact the supplier using a trusted phone number already maintained in its records.

Cooling-Off Periods

Organizations may choose to delay payment to newly changed banking information for a defined period.

This creates additional time to identify a questionable change before funds are released.

The appropriate duration should be established by the organization according to its own risk and payment policies.

Complete Audit Trail

Every step in the change process should be documented.

That can include:

• Supplier submission

• Banking-information change

• Verification activity

• Approvals

• Dates and timestamps

• Communications

• Final activation

This creates a much clearer record for internal controls, audit, and investigation.

How the AP Express Supplier Portal Helps

The AP Express Supplier Portal provides a controlled environment for managing supplier information and supplier interactions.

Instead of relying on unstructured email exchanges, suppliers can interact with AP through a secure self-service experience.

For supplier banking changes, organizations can establish workflows designed around their own control requirements.

Capabilities include:

• Supplier self-service information management

• Structured banking-information changes

• Configurable multi-level approvals

• Separation of responsibilities

• Customer-controlled cooling-off periods

• Audit history

• Alerts and workflow notifications

• Centralized supplier communications

• Integration with AP and ERP processes

This creates a controlled path between the supplier's request and the organization's approved supplier record.

A Better Bank-Change Workflow

A controlled supplier banking-change process might look like this:

1. Supplier initiates change

The supplier submits new banking information through the Supplier Portal rather than sending it by email.

2. Change is flagged for review

The banking change triggers the organization's configured workflow.

3. Verification is performed

The organization applies its required verification procedures based on its policies and the risk associated with the change.

4. Required approvals are completed

The change moves through the configured approval process.

5. Cooling-off period is applied if required

The organization can apply its chosen waiting period before payments are allowed to flow to the new account.

6. Approved information proceeds through the integration

Once the organization's requirements have been satisfied, the approved supplier information can move through the appropriate ERP integration process.

7. Activity remains documented

The organization maintains a history of the submission, review, approval, and related activity.

This replaces an informal bank-change process with a repeatable control framework.

Apply Controls Based on Risk

Not every supplier or transaction carries the same level of risk.

Organizations may want to apply different levels of review based on factors such as:

• New supplier

• New bank account

• Bank-account change

• First payment following a change

• Payment amount

• Unusual supplier activity

• Dormant supplier reactivation

• Changes to other sensitive supplier information

A risk-based approach allows organizations to apply stronger controls where the potential consequences are greatest.

The important point is that the process should be defined, consistent, and documented.

Supplier Management and Payment Security Are Connected

Supplier management is sometimes viewed as separate from payment security.

In reality, they're closely connected.

Payment security begins with the information used to create the payment.

If supplier banking information is inaccurate or fraudulently changed, even a perfectly executed payment process can send money to the wrong destination.

That's why supplier onboarding, supplier-master changes, payment controls, and AP automation should work together.

The supplier record isn't merely administrative data.

It's part of the payment-control environment.

Preparing for Evolving ACH Fraud Controls

NACHA's evolving fraud-monitoring requirements reinforce something AP teams should already be considering:

Fraud prevention needs to begin before the payment is released.

Organizations should review how they currently handle:

• Supplier onboarding

• Banking-information collection

• Bank-account changes

• Verification

• Approvals

• Separation of duties

• First payments to new accounts

• Audit documentation

• Supplier communications

If those activities depend heavily on email, spreadsheets, PDFs, and informal phone calls, there may be an opportunity to strengthen the process.

The objective isn't simply NACHA compliance.

It's creating a supplier-payment process that is more controlled, repeatable, auditable, and resistant to fraud.

Conclusion

ACH fraud controls shouldn't begin at the payment file.

They should begin when supplier banking information enters or changes within the organization.

A controlled supplier portal can help AP teams move sensitive supplier changes out of email and into structured workflows with defined approvals, verification procedures, audit trails, and customer-controlled safeguards.

The AP Express Supplier Portal brings those capabilities together with supplier onboarding, AP automation, and ERP integration.

As payment fraud becomes more sophisticated and ACH fraud-monitoring expectations evolve, that connected approach becomes increasingly important.

Protecting the payment starts with protecting the supplier data behind it.

FAQs

Do the 2026 NACHA rules require bank validation for every ACH payment?

The updated NACHA rules emphasize risk-based fraud monitoring rather than prescribing one identical validation procedure for every ACH transaction.

Organizations should work with their financial institution, payment providers, and compliance advisors to determine how the rules apply to their specific role and ACH activity.

What's the difference between account validation and ownership verification?

Account validation helps determine whether banking information is valid and whether an account can receive transactions.

Ownership verification adds another layer by helping establish whether the bank account belongs to the intended supplier.

The distinction matters because a fraudulent account can still be a perfectly valid bank account.

What controls should we use for supplier bank changes?

Organizations should establish controls appropriate to their risk environment.

Common approaches include structured supplier submission, independent verification, multi-level approval, separation of duties, trusted callbacks, cooling-off periods, audit trails, and additional review before the first payment to changed banking information.

No single control should be considered sufficient on its own.

Can a supplier portal eliminate ACH fraud?

No.

No technology or process can eliminate payment fraud entirely.

A supplier portal can help reduce risk by moving sensitive supplier information into a more controlled environment and supporting consistent verification, approval, documentation, and change-management processes.