Question: Do you have a fraud policy template?
Answer: Yes. Pages 5–8 of the ACH Guide include a template to help you develop fraud mitigation policies and procedures tailored to your organization.
Question: How detailed do our procedures need to be?
Answer: The level of detail should reflect your organization’s ACH activity and risk profile. As a general guideline, tailor your procedures to what your business actually does—there is no need to over-engineer them.
For example:
• A business debiting customers for gym memberships will require a different approach than one issuing high-dollar vendor payments.
• A payroll-only originator should focus on processes for handling employee payment changes and direct deposit updates.
Focus on identifying your actual risks and aligning procedures accordingly. There is no expectation to create extensive policies covering irrelevant payment types.
That said, all organizations should:
• Be aware of business email compromise risks
• Follow strong email security practices
• Implement controls around outgoing payments
• Maintain effective dual control procedures
Nacha also requires policies and procedures to be reviewed at least annually, or more frequently when changes occur (e.g., new payment types or staff turnover). Any new activity—such as transitioning vendor payments from checks to ACH—could introduce new risk and should trigger an update to your policies as well as corresponding procedural updates.
Question: Will anyone review my policy or procedures?
Answer: The Nacha rule requires that you provide your policies and procedures upon request. These requests would come through Kennebec Savings Bank (KSB), not directly from Nacha.
Possible scenarios for a request include:
• Fraud investigations involving your organization
• Situations where suspicious activity prompts further review
• Cases where your organization was impacted by a fraud scheme
While widespread requests are not expected, this requirement underscores the importance of having meaningful, functional procedures—not just documentation for compliance. Your policies should serve as a practical tool to help protect your business.
Question: What is dual control?
Answer: Dual control is a security measure requiring two individuals to complete a payment transaction:
1. One person initiates the payment
2. A second person reviews and approves it
KSB requires dual control for all ACH originators. However, its effectiveness depends on proper execution. Approvers must actively review and validate transactions—simply approving without verification undermines the control.
Question: What if we use Paychex or another payroll provider?
Answer: If your payroll provider originates ACH transactions on your behalf, they are responsible for maintaining compliant fraud policies and procedures.
However, your organization should still maintain internal processes for:
• Verifying employee payment changes
• Managing direct deposit updates
Because you typically know and interact with your employees directly, your fraud risk in this scenario is lower. The Nacha rule primarily applies to ACH transactions you originate directly through KSB’s online banking platform.
Question: How can we get more information?
Answer: Our team is here to help. You can reach us through any of the following channels:
• Email: JNorton@KennebecSavings.bank
• General inquiries: info@KennebecSavings.bank
• Business support: BusinessSupport@KennebecSavings.bank
• Phone: Ask for Jessica Norton, Amanda Stratton, or Business Support
• Online banking: Secure Message Center
Question: Do cardholders need to have a login to the system?
Answer: “It depends”. An administrator is needed for the business to manage all cards. Individual card holders don’t need access unless the company is also using the expense management tool.
Closing Guidance
Fraud prevention policies should not be viewed as a burdensome requirement, but as a necessary safeguard. Financial fraud risks continue to increase in sophistication and frequency, and even a single error can result in significant losses.
While these requirements are specific to ACH origination, the principles apply to all payment types—including wires and checks. Establishing clear policies, training staff, and implementing strong controls are essential steps in protecting your organization’s assets.
