Put the power of Corporate O2 to work for you.

About Corporate O2

User Guides

• Corporate O2 Digital Banking Guide
  
• Corporate O2 Log In Guide
• Corporate O2 Mobile Setup Instructions
  
• ACH Guide
  
• Internal Transfer Guide
  
• Positive Pay Guide
  
• Wire Transfer Guide
  
• Remote Deposit Guide
• Corporate Fraud Prevention Guide

Corporate O2 Tutorial Videos

FX Wires

Intuit^® Information

• Mint® Conversion Information
• Quickbooks® Desktop Conversion Instructions
• Quickbooks® Online Conversion Instructions
• Quicken® Conversion Instructions

Nacha Information

EFFECTIVE JUNE 19, 2026

NACHA Rules currently require Originators to establish and implement risk-based processes and procedures to reasonably identify ACH entries initiated due to fraud. Including, but not limited to, a fraudulent transaction detection system intended to screen when initiating ACH debits or when using Micro-Entries.

The new rule requires all non-consumer ACH Originators to establish and implement risk-based processes and procedures reasonably intended to identify ACH entries initiated due to fraud. The core focus of this rule is to mitigate fraud in ACH transactions, specifically targeting Unauthorized Entries: Transactions initiated without the account holder’s permission and Entries Authorized under False Pretenses: Payments resulting from deception, such as Business Email Compromise (BEC) vendor impersonation or payroll impersonation. 

We urge all Old Second National Bank business ACH Originators to begin assessing their current fraud controls immediately. You must work with your compliance, legal, and technology teams to ensure you are fully prepared before the mandatory deadline.

Failure to adhere to NACHA guidelines puts your ability to originate at risk. Your responsibility as an Originator means that you need to make sure your processes consider these important factors:  

• Establish and Implement Risk-Based Procedures: You must define and apply processes and procedures, relevant to your role as an Originator, that are reasonably intended to identify outgoing ACH Entries that may be unauthorized or initiated under false pretenses.

• Annual Review: These processes and procedures must be reviewed and, if necessary, updated at least annually to address evolving fraud risks.

• Risk Based Approach: At minimum, you must conduct a risk assessment to identify high risk vs low risk transactions and apply appropriate monitoring measures. Note that a risk-based approach cannot be used to conclude that no monitoring is necessary at all.

• Manual, documented internal controls
• Utilization of new features in your accounting or payroll software
• Adoption of a third-party fraud monitoring solution

• Business Email Compromise (BEC): A fraudster impersonates an executive or vendor via email to instruct an ACH payment be sent to a fraudulent account
• Impersonation: A fraudster calls or emails to trick an employee into changing payment information for a legitimate vendor or employee
• Account Takeover:  A fraudster gains access to the credentials necessary to initiate a transaction and initiates a credit entry from the accessed account. The accountholder did not authorize the credit entry.

• Unauthorized Withdrawals: How can you prevent external parties from pulling money without permission?
• Internal Misconduct: How can you prevent misuse of payment authority by employees?
• Compromised Credentials: How can you protect your internal systems used for managing payment information and activity?
• Change Request Fraud: How can you verify the authenticity of payment instruction changes?

• Dual Authorization/Segregation of Duties: Requiring at least two separate individuals to authorize high-dollar payments or ACH files. No single person should be able to create, approve, and release a payment
• Out-of-Band Verification: When receiving an email request for a bank account change (vendor or employee), verifying the change via a trusted secondary channel (e.g., a phone call to a known number on file, not the number listed in the suspicious email)
• System Controls and Anomaly Detection: Utilizing your internal accounting or payment systems to automatically flag or alert you to unusual activity, such as:
  • Payments to a new vendor that exceed a set dollar threshold
  • Sudden increases in transaction volume or amount outside of normal business patterns
  • Unusual payment destinations (e.g., high-risk geographical locations)
• Pre-Payment Account Validation: Utilizing ACH prenotes (zero-dollar verification) or third-party validation services to confirm the existence and ownership of a new vendor’s or employee’s bank account before the first live payment is initiated
• Strong Access Controls (MFA): Limiting the number of employees who have access to your ACH origination system and enforcing Multi-Factor Authentication (MFA) for all users to protect against compromised login credentials
• Review User Rights: Corporate O2 Administrators should review user rights regularly and promptly remove access for terminated or transferred employees who no longer require access
• Dedicated Payment Workstations: Restricting the computers used to initiate or approve ACH payments from being used for high-risk activities like opening external email attachments or general web browsing
• Formal Fraud Incident Response Plan: Maintaining a clear, documented plan that specifies the immediate steps to take if fraud is detected, including who at Old Second National Bank to call and internal protocols for isolating the risk
• Mandatory, Continuous Employee Training: Implementing regular (e.g., quarterly) training for all staff involved in payments to recognize, question, and independently authenticate suspicious requests (a key defense against social engineering)
• Secure Systems and Applications – Ensure maintenance of firewalls and make sure antivirus software is up to date.  Ensure all system components and software have the latest vendor-supplied security patches installed

• If requested by the Bank, you must provide a copy of the authorization within 10 business days. The Bank may request to see your authorizations from time to time as part of an annual audit.
• Send entries on the proper date.
• Give appropriate notice to debtor if changing amount or date.
• Cease subsequent entries when notified.
• Make necessary changes to payee account information within three (3) banking days upon receipt of a Notice of Correction or before another entry is sent.
• Protect the banking information received to originate transactions.
• Ensure your computer and you are protected as outlined in the Bank Treasury Management Agreement.
• Ensure the Originator is clearly identified as the source of the ACH transaction. Specifically, populate the Company Name Field of the NACHA formatted file with a name known to and readily recognized by the Receiver of the entry.

EFFECTIVE MARCH 20, 2026

Nacha is requiring the standardized use of specific transaction descriptions effective March 20, 2026. ACH originators are required to comply with Nacha operating rules.

• ACH credits related to wages must use the description "Payroll"
• ACH debits related to consumer e-commerce purchases must use the description "Purchase"

This rule applies to all ACH originators initiating these types of transactions and is mandatory by March 20, 2026. We recommend beginning to review and update your templates as soon as possible to ensure a smooth transition. Abbreviations to these descriptions are not allowed.

What you need to do:

• When creating new ACH files, populate the Entry Description as outline
  
  
• For Existing ACH templates, update your payroll files to include "Payroll" in the Entry Description field and "Purchase" for all relevant consumer e-commerce debits
  
  
• If you use a third-party payroll or accounting software, reach out to them to understand how to implement this change

Visit Nacha for additional information regarding this rule change.