Request for Information: Should Secure Electronic Channels be Required for Exception Processing? 

September 28, 2026 / Source: Nacha

Should the Nacha Rules require use of secure electronic channels for exception processing? That’s the question Nacha would like to hear your thoughts on in a new Request for Information (RFI).  

Exception cases related to ACH Entries typically include sensitive data elements such as names and account numbers. And the Nacha Rules already require ACH Network participants to protect the security and integrity of certain ACH data throughout its life cycle. Additionally, information transmitted electronically is required to be secured using commercially reasonable methods. 

Exception cases necessarily exist in support of the life cycle of an ACH Entry. When the data elements of an Entry are communicated outside the ACH Network in an exception case, the data elements deserve protection similar to the protection they receive when they flow through the ACH Network. 

This issue isn’t new. In August 2025, Nacha issued ACH Operations Bulletin #2-2025: Encouraging the Use of Secure Electronic Channels for Resolving ACH Exceptions. In it, Nacha recommended “all Non-Consumer Originators, Participating DFIs, Third-Party Service Providers, and Third-Party Senders abandon the use of unencrypted electronic mail and faxes and use only a secure electronic channel when exchanging information and documents to resolve ACH Exceptions.” 

Using a secure communication channel for certain exception processing functions may provide tremendous value to financial institutions. There is, of course, the additional security for ACH information. But there’s also certainty on how to make a request and consistent processes for receiving and responding to a request. 

One potential solution is to use Nacha’s Risk Management Portal for secure communications. The Portal provides a single resource for financial institutions, ACH Operators, Payment Associations, and—in the near future—certain agencies under the U.S. Treasury to access Nacha risk management services and databases. 

More information about the RFI is available here. RFI responses are due by Friday, Nov. 20.