Short answer
On October 8, 2026, Nacha proposed a rule that would let your bank review a claim that an ACH debit was unauthorized before it refunds you, up to the point where Regulation E requires provisional credit. Nothing changes yet: comments are due December 11, 2026, and the proposed effective date is June 18, 2027.
On this page
Today, Nacha’s rules tell a bank to “promptly” recredit a consumer who signs a Written Statement of Unauthorized Debit, without saying what promptly means. Nacha says some banks read it as the same day, with no time to look at the claim. The proposal would tie that word to the federal deadline instead.
What changed
- StatusProposed rule and request for comment, not yet adopted
- TodayNacha’s rule says “promptly”; some banks recredit on the day you sign the statement
- ProposedNo recredit required before the bank owes you provisional credit under Regulation E
- Comments dueDecember 11, 2026
- Proposed effective dateJune 18, 2027
- WhoConsumers who report an ACH debit as unauthorized, and their banks
Source: Nacha: Request for Information/Request for Comment, First-Party Fraud Topics · Checked on October 15, 2026
What the proposal says
The proposed text adds one sentence to Section 3.11 of the Nacha Operating Rules: the duty to promptly recredit “does not require the RDFI to recredit a Consumer Account of a Receiver prior to the time it incurs an obligation to provisionally recredit the Receiver’s Consumer Account under Regulation E”. The RDFI is your bank, the one the debit was taken from. For business accounts, the bank would get “a comparable period reasonably necessary to investigate”.
Nacha says the change does not alter when a bank must send the debit back to the company that took it, and does not remove the rule that the bank recredits you before it returns the entry. Banks would not have to change anything on the effective date; a bank that wants to use the extra time can do so on its own timeline.
Sources: Nacha: Proposed Modifications to the Rules, Nacha: First-Party Fraud Topics presentation · Both dated October 8, 2026
What Regulation E already requires
Regulation E, the federal rule for electronic transfers, has its own timetable for a reported error such as an unauthorized debit. Nacha’s general counsel summarized it in May 2026: the bank must investigate and decide within 10 business days, then correct an error within one business day. If it needs longer, it must give you provisional credit and finish within 45 days, with more time in some cases, such as new accounts.
Timeline
- Day 0you tell your bank an ACH debit was not authorized and sign the written statement
- Within 10 business daysthe bank decides, or gives you provisional credit and keeps investigating
- Up to 45 daysthe investigation ends and the credit becomes final, or is reversed if the bank finds the debit was authorized
Sources: Nacha: What Does ‘Prompt’ Recredit Actually Require? (May 26, 2026), CFPB: Regulation E, section 1005.11 · Checked on October 15, 2026
Why Nacha wants it
The proposal is part of a wider request for information on first-party fraud: a person telling their bank that a debit they authorized was unauthorized, so the bank returns it (usually with return code R10). Nacha asks banks how often “unauthorized” returns were in fact authorized and what that costs. If banks have time to review a claim, Nacha says, some of these returns could be stopped.
Source: Nacha: First-Party Fraud: Nacha Wants Your Input (October 8, 2026)
What it means for you
If the rule is adopted, a genuine claim should still end with your money back, but the refund could come later than the same day at banks that now recredit at once. Your rights under Regulation E do not change.
Warning
Report a debit you did not authorize as soon as you see it on your statement. Regulation E’s error rules apply to a notice that reaches your bank within 60 days of the statement that first showed the problem.
How ACH disputes, stop payments and reversals work today is in can an ach transfer be reversed. The difference between a payment you push and one a company pulls is in ach credit vs ach debit.
