---
title: "Nacha: ACH Supplemental Security Requirements for Data at Rest"
description: Nacha now requires that account numbers must be “unreadable when stored electronically.” The implementation of this rule is broken into two phases.
image: https://blog.basistheory.com/hubfs/Imported_Blog_Media/61f01277c2e08ece4b2614f5_nacha-requires-bank-account-numbers-at%20rest-unreadable.jpg
---

[Skip to content](https://blog.basistheory.com/nacha-rules-bank-account-numbers#main-content)

![Basis Theory logo](https://blog.basistheory.com/hs-fs/hubfs/BTLogo%20(1).png?width=365&height=122&name=BTLogo%20(1).png)

- [Use Cases](https://basistheory.com/)
  
  Show submenu for Use Cases 
  
    - [Creator Economy](https://basistheory.com/use-cases/creator-economy)
    - [Digital Health](https://basistheory.com/use-cases/health)
    - [E-Commerce](https://basistheory.com/use-cases/ecommerce)
    - [Fintech](https://basistheory.com/use-cases/fintech)
    - [Gaming](https://basistheory.com/use-cases/gaming)
    - [Subscription Merchants](https://basistheory.com/use-cases/subscriptions)
    - [Travel](https://basistheory.com/use-cases/travel)
    - [VSaaS](https://basistheory.com/use-cases/vsaas)
- Solutions
  
  Show submenu for Solutions 
  
    - [Agentic Commerce](https://basistheory.com/solution/agentic-commerce)
    - [Data Consolidation](https://basistheory.com/solution/data-consolidation)
    - [Monetize Payments](https://basistheory.com/solution/monetize-payments)
    - [Multi PSP](https://basistheory.com/solution/multi-psp)
    - [Payment Method Discovery](https://basistheory.com/solution/payment-method-discovery)
    - [Payment Vault](https://basistheory.com/solution/payment-vault)
- [Platform](https://basistheory.com/platform)
  
  Show submenu for Platform 
  
    - [Enrichments & Add-Ons](https://basistheory.com/add-ons)
    - [Partners](https://basistheory.com/partnerships)
    - [Why Basis Theory](https://basistheory.com/why-basis-theory)
- [Pricing](https://basistheory.com/pricing)
- Resources
  
  Show submenu for Resources 
  
    - [Blog](https://blog.basistheory.com)
    - [Case Studies](https://blog.basistheory.com/case-studies)
- [Docs](https://developers.basistheory.com/)

Open main navigation

Close main navigation

- [Use Cases](https://basistheory.com/)
  
  Show submenu for Use Cases 
  
    - [Creator Economy](https://basistheory.com/use-cases/creator-economy)
    - [Digital Health](https://basistheory.com/use-cases/health)
    - [E-Commerce](https://basistheory.com/use-cases/ecommerce)
    - [Fintech](https://basistheory.com/use-cases/fintech)
    - [Gaming](https://basistheory.com/use-cases/gaming)
    - [Subscription Merchants](https://basistheory.com/use-cases/subscriptions)
    - [Travel](https://basistheory.com/use-cases/travel)
    - [VSaaS](https://basistheory.com/use-cases/vsaas)
- Solutions
  
  Show submenu for Solutions 
  
    - [Agentic Commerce](https://basistheory.com/solution/agentic-commerce)
    - [Data Consolidation](https://basistheory.com/solution/data-consolidation)
    - [Monetize Payments](https://basistheory.com/solution/monetize-payments)
    - [Multi PSP](https://basistheory.com/solution/multi-psp)
    - [Payment Method Discovery](https://basistheory.com/solution/payment-method-discovery)
    - [Payment Vault](https://basistheory.com/solution/payment-vault)
- [Platform](https://basistheory.com/platform)
  
  Show submenu for Platform 
  
    - [Enrichments & Add-Ons](https://basistheory.com/add-ons)
    - [Partners](https://basistheory.com/partnerships)
    - [Why Basis Theory](https://basistheory.com/why-basis-theory)
- [Pricing](https://basistheory.com/pricing)
- Resources
  
  Show submenu for Resources 
  
    - [Blog](https://blog.basistheory.com)
    - [Case Studies](https://blog.basistheory.com/case-studies)
- [Docs](https://developers.basistheory.com/)
- [Get a demo](https://basistheory.com/contact)

[Login](https://portal.basistheory.com/)

[Get a demo](https://basistheory.com/contact)

 January 25, 2022

![Picture of Basis Theory](https://blog.basistheory.com/hs-fs/hubfs/bt-favicon-new.png?width=50&name=bt-favicon-new.png) [Basis Theory](https://blog.basistheory.com/author/basis-theory-team) ·

[Banking](https://blog.basistheory.com/tag/banking)

# Nacha’s ACH Supplemental Security Requirements for Data at Rest

![Nacha's security requirements for data at rest](https://blog.basistheory.com/hubfs/Imported_Blog_Media/61f01277c2e08ece4b2614f5_nacha-requires-bank-account-numbers-at%20rest-unreadable.jpg)

Nacha now requires that account numbers must be “unreadable when stored electronically.” The implementation of this rule is broken into two phases.

## What is ACH?

The Automated Clearing House (ACH) connects nearly all banks and credit unions in the United States. The bank transfer network offers businesses and consumers a dynamic and inexpensive way to move money from one financial institution to another. According to Nacha, the governing and enforcement body of ACH, the network processed nearly 27 billion bank transfers totaling just under $62 trillion in total value in 2020.

## What is deposit account information, and why does it matter?

Better known to most as a bank account number, deposit account information refers to the unique ID associated with an account at a given bank or credit union.

![](https://blog.basistheory.com/hubfs/Imported_Blog_Media/61f0145e3b2f461664bb36a9_tokenized-ach-bank-account-number.jpg)

Each ACH transaction includes the sender and receiver’s *account numbers*, their respective financial institutions’ *routing numbers*, an *amount* to be deposited and credited, and other pieces of information. A financial institution lumps all its originators' transactions into an ACH file and sends it to an *ACH Operator*.

The ACH Operator uses the routing and account numbersto instruct the corresponding financial institutions which account to credit or debit*.* This system works well when you provide and authorize employers, billers, and companies to use it. Unfortunately, it doesn't work well when bad guys capture account numbers. 

While many controls and protections make it difficult to abuse these numbers, ACH fraud is notoriously more difficult to deal with than credit or debit card fraud. For example, a stolen card can be reprovisioned digitally in seconds. Some businesses, like Netflix, even automatically update your existing subscription with the new card number. 

Still, business is booming. ACH has grown [year-over-year by 8% since 2011](https://www.nacha.org/content/ach-network-volume-and-value-statistics). In addition, new fintechs, like [Stripe](https://stripe.com) and [Dwolla](https://dwolla.com), have made integrating ACH into consumer apps, like [YNAB](https://www.ynab.com/) and [Coinbase](https://coinbase.com), super easy. Nacha also began rolling out [Same Day ACH](https://www.nacha.org/resource-landing/same-day-ach-resource-center) in 2016, providing an affordable way to bypass the wait times of two to three business days of traditional ACH, as well as the more costly push-to-debit option.

With volume and fraud on the rise, Nacha modernized its security compliance requirements for account numbers at rest in 2020.

## What are Nacha’s security compliance rules for data at rest?

Nacha now requires that account numbers must be “unreadable when stored electronically.” The implementation of this rule is broken into two phases:

- [Phase 1](https://www.nacha.org/rules/supplementing-data-security-requirements-phase-1): ACH Originators and Third-Parties with more than 6 million ACH payments annually. This rule came into effect on June 30, 2021.
- [Phase 2](https://www.nacha.org/rules/supplementing-data-security-requirements-phase-2): ACH Originators and Third-Parties with more than 2 million ACH payments annually. This rule will come into effect on June 30, 2022.

## How do I know if I must follow Nacha’s rule for data at rest?

Understanding a given role in ACH can be notoriously tricky. So instead of defining the terms used in Article One, Section 1.6, we thought of two simple questions to ask your organization:

- First, “Are we storing bank or credit union account numbers?"
- Second, “Do we use those bank or credit union account numbers to initiate around 2 million\* ACH transactions per year?”

If you answered “Yes,” to both of those questions, then it’s likely the rule applies to your organization.

\*Nacha will look at the total of all debit and credit ACH transactions originated by an entity across all its financial partners.

## Which “deposit account information” must be unreadable?

To this point, we've used the term bank account numbers instead of the formal term, deposit account information. They are the same. It's these 5-to-17 digits that appear on a paper check that Nacha requires to be unreadable. It's important to note that the rule extends to images (e.g., authorization forms or scans of checks) too.

Other financial information, like account name, amount, and routing numbers, can be stored in plain text at this time.

Naturally, situations exist where using bank account numbers is part of daily operations. Nacha refers to this temporary usage as “active” and does not apply the rule. For example, the fraud department can view an account number as part of an investigation. 

“Active” doesn’t mean safe, so Nacha still requires this information to be behind a set of controls (like passwords, logging, etc.). Basis Theory provides many of these controls, like aliasing or masking, as part of its services.

## Our learnings

A few months ago, Nacha announced Basis Theory as a preferred partner for data tokenization and encryption. Since then, we have worked with several companies to help them follow these rules. After several conversations, a few themes have surfaced:

### **You are not alone**

Most companies are currently working on assuring compliance to the Nacha rule. However, don’t feel like you are the only company working on this. Asking peers in the industry may be a good idea to fast-track the initiative.

### **It doesn’t have to be a roadmap-destroying exercise**

Some companies want to use the ruling as an opportunity to rethink their entire payments stack. Most, however, are looking to follow the rule without disrupting operations. Don't buy into the marketing and over-invest if you don't need to.  

### **Businesses *are* going above and beyond to secure the data**

Many firms we speak to believe these measures will extend further in the near future. They're taking a proactive approach and extending Nacha’s scope to other details in the financial transaction, like name, amount, or entire addendums.

### **You still have time**

Solutions like Basis Theory offer low-code solutions and easy interoperability with a company’s existing tech stack. As a result, many can get a working proof-of-concept completed in less than one sprint. Skip the long sales cycles and development timeframes. Using Basis Theory, development teams can get your bank data into compliance in a matter of days, not weeks.

In the next part of the series we'll discuss your options for securing ACH bank account numbers at rest, including tokenization. However, if you'd like to get a jump start, [contact us](https://basistheory.com/contact) or pass our [secure bank accounts guide](https://developers.basistheory.com/docs/guides/collect) onto your developers.

[![View an Interactive Demo   See how the Basis Theory platform secures payment data and significantly reduces PCI compliance burden from day 1.  ](https://no-cache.hubspot.com/cta/default/22332934/interactive-171495116167.png)](https://blog.basistheory.com/hs/cta/wi/redirect?encryptedPayload=AVxigLJeU247vdwcbt4tgfAAVQkaMcOQqoSKMqB35AeT5OWB57uKg6kT5%2BOd5txnCTDcxXhjcy99DeifqyKoauuvU56UXYkAISCkJ7f8112uRrTf6lf1cWhoi9cCkLJQA9XLlm4OReD6Ra%2FoPGG%2B9a8kk0PqBwpFwUn%2FZTbe9pAvZTzpT3aOTPY2ZuX8ODMFM30dLYPNi9xIRCmTSz6tecSkG5jjj3M%3D&webInteractiveContentId=171495116167&portalId=22332934)

## Related posts

[![Nacha's 2022 data protection requirements](https://blog.basistheory.com/hubfs/Imported_Blog_Media/62d03f5e1da9597a6d48854c_Getting%20to%20compliance_%20Breaking%20down%20the%202022%20Nacha%20Data%20Protection%20Requirements.jpeg)](https://blog.basistheory.com/nacha-data-protection-requirements)

[Compliance](https://blog.basistheory.com/tag/compliance)

### [Breaking down the 2022 Nacha Data Protection Requirements](https://blog.basistheory.com/nacha-data-protection-requirements)

![Picture of Basis Theory](https://blog.basistheory.com/hs-fs/hubfs/bt-favicon-new.png?width=50&name=bt-favicon-new.png) [Basis Theory](https://blog.basistheory.com/author/basis-theory-team) 

 November 16, 2022

[Read more](https://blog.basistheory.com/nacha-data-protection-requirements)

[![Top Payments trends in 2023](https://blog.basistheory.com/hubfs/payment-statistics-trends-2023.jpg)](https://blog.basistheory.com/payment-statistics)

[Payments](https://blog.basistheory.com/tag/payments)

### [Top Payment Statistics and Trends in 2023](https://blog.basistheory.com/payment-statistics)

![Picture of Basis Theory](https://blog.basistheory.com/hs-fs/hubfs/bt-favicon-new.png?width=50&name=bt-favicon-new.png) [Basis Theory](https://blog.basistheory.com/author/basis-theory-team) 

 June 26, 2023

[Read more](https://blog.basistheory.com/payment-statistics)

[![Connected payments help improve margins and reduce risk for merchants. Read the blog for more!](https://blog.basistheory.com/hubfs/second-payment-processor.png)](https://blog.basistheory.com/how-connected-payments-reduce-merchant-risk)

[Payments](https://blog.basistheory.com/tag/payments)

### [How Connected Payments Reduce Merchant Risk](https://blog.basistheory.com/how-connected-payments-reduce-merchant-risk)

![Picture of Basis Theory](https://blog.basistheory.com/hs-fs/hubfs/bt-favicon-new.png?width=50&name=bt-favicon-new.png) [Basis Theory](https://blog.basistheory.com/author/basis-theory-team) 

 June 25, 2024

[Read more](https://blog.basistheory.com/how-connected-payments-reduce-merchant-risk)

## Stay Connected

### Receive the latest updates straight to your inbox

### Follow on Social

<https://www.linkedin.com/comm/mynetwork/discovery-see-all?usecase=PEOPLE_FOLLOWS&followMember=colinthomasluce>

[![BTLogo (1)](https://blog.basistheory.com/hs-fs/hubfs/BTLogo%20(1).png?width=138&height=46&name=BTLogo%20(1).png "BTLogo (1)")](https://basistheory.com)

- Use Cases 
    - [Creator Economy](https://basistheory.com/use-cases/creator-economy)
    - [Digital Health](https://basistheory.com/use-cases/health)
    - [E-Commerce](https://basistheory.com/use-cases/ecommerce)
    - [Fintech](https://basistheory.com/use-cases/fintech)
    - [Gaming](https://basistheory.com/use-cases/gaming)
    - [Remittance](https://basistheory.com/use-cases/remittance)
    - [Subscription Platforms](https://basistheory.com/use-cases/subscriptions)
    - [Online Travel Agencies](https://basistheory.com/use-cases/travel)
    - [Vertical SaaS](https://basistheory.com/use-cases/vsaas)
- Developers 
    - [Quickstart](https://developers.basistheory.com/getting-started)
    - [Elements](https://developers.basistheory.com/docs/sdks/web/javascript)
    - [Documentation](https://developers.basistheory.com/)
- Basis Theory 
    - [Pricing](https://basistheory.com/pricing)
    - [Add-Ons](https://basistheory.com/add-ons)
    - [ROI Calculator](https://go.basistheory.com/roi)
    - [Case Studies](https://blog.basistheory.com/case-studies)
    - [Blog](https://blog.basistheory.com)
    - [Contact](https://basistheory.com/contact)
- Other 
    - [Terms and Conditions](https://basistheory.com/resources/terms-of-service)
    - [Privacy Policy](https://basistheory.com/resources/privacy-policy)
    - [Cookie Policy](https://basistheory.com/resources/cookie-policy)
    - [Security](https://basistheory.com/security)
    - [System Status](https://status.basistheory.com/)
- Compare 
    - [Basis Theory Vs. Evervault](https://go.basistheory.com/evervault-alternative)
    - [Basis Theory Vs. IXOPAY](https://go.basistheory.com/alternative-to-ixopay)
    - [Basis Theory Vs. VGS](https://go.basistheory.com/compare/very-good-security)

---

```json
{
  "@context" : "https://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Basis Theory",
    "url" : "https://blog.basistheory.com/author/basis-theory-team"
  },
  "dateModified" : "2025-12-30T21:47:07.724Z",
  "datePublished" : "2022-01-25T05:00:00.000Z",
  "headline" : "Nacha: ACH Supplemental Security Requirements for Data at Rest",
  "image" : [ "https://blog.basistheory.com/hubfs/Imported_Blog_Media/61f01277c2e08ece4b2614f5_nacha-requires-bank-account-numbers-at%20rest-unreadable.jpg" ],
  "mainEntityOfPage" : {
    "@id" : "https://blog.basistheory.com/nacha-rules-bank-account-numbers",
    "@type" : "WebPage"
  },
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "url" : "https://blog.basistheory.com/hubfs/BTLogo%20(1).png"
    },
    "name" : "Basis Theory"
  }
}
```