A third-party payment processor (TPPP) is a business customer of a bank that provides payment processing to its own clients, typically merchants, using the accounts it holds at that bank. The processor sends debits and credits through the bank into the payment system, collects the resulting funds and passes them on to its clients after deducting fees. The clients are customers of the processor, not of the bank, and the bank usually has no direct relationship with them.
The term is used mainly by United States bank regulators and in anti-money laundering guidance. It describes a risk category more than a business model. Many legitimate payroll companies, billers and software platforms fit the description, but because the arrangement lets merchants reach the banking system without being vetted by a bank, it has repeatedly been used by fraudulent merchants. Banks are therefore expected to apply extra care to this type of customer.
How the arrangement works
A processor opens one or more deposit accounts at a bank and signs an agreement to originate payments. For bank-account payments it submits ACH debit and credit files, with the bank acting as originating depository financial institution. In the vocabulary of the ACH network, such a processor is a third-party sender. Processors may also deposit remotely created checks, which are drafts drawn on a consumer's account without a signature, or handle card transactions under a separate acquiring arrangement.
Money collected from consumers lands in the processor's account, often a pooled account holding the funds of many merchants, and is then paid out to each merchant.
Why regulators treat it as higher risk
The central problem is that the bank sees the processor and its aggregate activity, while the parties whose payments are being processed stay in the background. A merchant that could not open an account or obtain processing directly, because of its business line or history, may obtain access through a processor with weaker standards. Guidance from the federal banking agencies and the examination manual used for Bank Secrecy Act reviews describe the risks as money laundering, consumer fraud and facilitation of illegal activity.
Past cases have involved telemarketing fraud, deceptive online offers, unlicensed lending and illegal gambling, where consumers' accounts were debited without valid authorization. Banks that kept processing in the face of obvious warning signs have faced enforcement, including civil penalties and orders to compensate consumers, on the reasoning that they knew or should have known what their customer was enabling.
Red flags
- High return rates. A large share of debits coming back as unauthorized, or for closed accounts and insufficient funds, suggests that consumers did not agree to the charges. Elevated ACH return levels are the single most watched indicator.
- Consumer complaints. Complaints to the bank, to other banks or to regulators about a processor's merchants.
- Risky merchant types. A client base concentrated in categories usually classed as high-risk merchant activity.
- Multiple banks. A processor that moves between banks or spreads volume across several, which can be a way to stay under each bank's thresholds.
- Nested processors. A processor whose clients are themselves processors, adding a further layer between the bank and the real merchant, similar to a nested account.
- Weak controls. No evidence of merchant underwriting, monitoring or complaint handling by the processor.
What banks are expected to do
A bank that serves processors is expected to understand each one in depth before opening the relationship. Its customer due diligence should cover the processor's ownership and background, its financial condition, the types of merchants it serves and the methods it uses to approve and monitor them. Many banks require a list of the processor's merchants, and the right to review and reject them.
After onboarding, the bank monitors return rates and chargebacks for each merchant where possible, reviews complaints, sets exposure limits and holds reserves against returns. It should be ready to file suspicious activity reports and to end the relationship where problems persist.
Regulatory status of the processor
A processor does not hold a banking license and is not, in general, itself required to have an anti-money laundering program under federal law. Federal rules exclude certain payment processors from the definition of money transmitter where they act for a merchant under a formal agreement to facilitate payment for goods or services through a clearance and settlement system. The exemption has conditions, and state licensing laws do not always follow it, so each business model has to be analyzed separately. Processors remain subject to consumer protection law, including the prohibition on unfair and deceptive practices, and to network rules.
The concept overlaps with other intermediary models. A payment facilitator in the card system also processes for sub-merchants under its own account, but does so under detailed card network rules on registration and underwriting.
The heightened scrutiny has had side effects. A Department of Justice initiative that began in 2013, known as Operation Choke Point, investigated banks and processors serving merchants linked to consumer fraud. Critics argued that it pressured banks to drop lawful but disfavored industries, an example of de-risking, and the program was later ended. The episode remains a reference point in debates about how far banks should be responsible for their customers' customers.