Rules and risks

How the rules work

What's written and what's enforced differ, and I think that gap is where most roadmap risk sits. The rules that bite every day mostly arrive by contract, through your sponsor bank, your acquirer and your customers' auditors.

• Nacha rules are enforced by contract every day. They bite through your sponsor bank, along with its own anti-money-laundering and KYB demands. Since June 22, 2026, every non-consumer originator, third-party sender and receiving bank must monitor for unauthorized and "false pretenses" payments (BEC, vendor impersonation). A platform originating ACH debits for sellers is in scope.
• Card rules are enforced through acquirers, so surcharge mistakes become fines. Visa's monitoring counts cases ("excessive" means 150 basis points and 1,500 fraud and dispute cases a month, from April 2026), so B2B sellers rarely trip it, though each loss is large.
• Customers and auditors enforce through procurement and sign-off. Procurement asks for SOC 1 Type 2, SOC 2 Type 2 and a PCI attestation. Auditors sign off the CECL allowance; ASU 2025-05 simplifies the forecast but leaves the duty to reserve in place.
• Lightly written for credit. Reg B covers trade credit, but a denial to a business with over $1M in revenue needs only notice "within a reasonable time". The FDCPA stops at consumer debt, though state licensing can reach B2B collectors (Washington's has no commercial carve-out).
• Newly enforced in Canada. RPAA supervision since September 8, 2025; published notices of violation since June 12, 2026.
• Written but moving. The US surcharge map (a 2026 New York case questions state bans), the card settlement, and the Fed's check services (in December 2025 it asked about options up to winding them down; no decision yet).
• Deadlines slip. Canada's Real-Time Rail is planned for Q4 2026 and Interac e-Transfer migration for the first half of 2027; I'd plan as if both will land late.

What mistakes cost

• Cash. Three in four US organizations faced attempted or actual payments fraud in 2025 (AFP), and the FBI logged about $3B in reported BEC losses. The loss usually falls on the payer, but reaches the seller as an invoice the customer thinks it paid.
• Credit. An unsecured trade creditor ranks last when a customer fails, and recent payments can be clawed back. Guarantees, insurance and security interests only help if they're in place first.
• Days. Every unmatched payment, rejected invoice and order on hold adds to DSO.
• Relationships. Dunning a customer who already paid, or holding a good customer's order on a stale limit, burns goodwill.
• Access. Breach Nacha's return thresholds and your bank faces an inquiry. Run out your sponsor bank's patience and you can't originate at all, a platform-wide outage no code fix will undo.
• Margin. A card payment that downgrades to the non-qualified rate costs over $100 more on a $10,000 ticket.