Are your clients ready for the NACHA June 22 ACH vendor verification changes?

Worth being precise about what the rule asks for, because it's easy to over-read. Phase 2 (in effect since June 22) requires every business that originates ACH payments to have risk-based processes reasonably intended to catch entries that are unauthorized or made under false pretenses (vendor impersonation, business email compromise, payroll diversion), and to review them at least once a year. It doesn't prescribe a specific verification method, or require re-verifying every existing vendor.

For most small clients the practical version is:

1. Treat any request to change a payee's bank details as unverified until it's confirmed by a call to a number already on file, not one from the request.
2. Have a second person approve the change before the first payment goes to the new details.
3. Log who verified, how and when. That's the kind of record banks are asking customers for.
4. Review the process once a year.

For the existing vendor list, a one-off pass ordered by payment size is more realistic than verifying everyone at once.

On spotting the fake requests themselves: most come from a lookalike of the vendor's domain that was registered days before the email, or have a Reply-To that points somewhere else. Checking how old the sender's domain is (any WHOIS lookup shows the registration date) takes a minute, but it doesn't replace the call-back.