A third-party sender (TPS) is a business that stands between an originator and its bank in the US Automated Clearing House (ACH) Network. The TPS has the origination agreement with the originating depository financial institution (ODFI), and the originators, typically the payroll firm's or payment company's own clients, have an agreement only with the TPS. Payroll providers, bill payment companies, payment facilitators and many fintech platforms operate as third-party senders.
The term is defined in the Nacha Operating Rules, which govern the ACH Network. A TPS is one kind of third-party service provider (TPSP). What sets it apart from other providers is the contractual position: because the originator has no direct agreement with the ODFI, the TPS takes on many of the duties and warranties that would otherwise sit with the originator or the bank.
How the third-party sender model works
In a direct relationship, a company signs an origination agreement with its bank and sends ACH files itself. In the TPS model, the payroll company or platform collects payment instructions from many client businesses, builds ACH files and submits them to its ODFI under its own agreement. Debits pull funds from the accounts of employees, customers or payers at the receiving depository financial institution (RDFI), and credits push funds out, for example as wages.
The ODFI sees the TPS as its customer, not the underlying originators, even though the originators' names appear in the entries. Funds often pass through an account owned by the TPS, which creates both settlement risk and an opportunity for misuse if controls are weak. When the TPS itself has clients that are also third-party senders, the arrangement is called a nested third-party sender relationship, and each layer adds distance between the bank and the businesses actually initiating payments.
Obligations under the Nacha rules
Because the TPS sits in the originator's chain of responsibility, the Nacha rules place specific duties on it. In broad terms a TPS must:
- Have an origination agreement with each of its originators that binds them to the Nacha rules and allows the ODFI to end or suspend their activity.
- Make the ODFI's warranties about each entry it transmits, and be responsible for its originators' obligations, such as obtaining proper ACH authorizations from consumers.
- Carry out an annual rules compliance audit and conduct and update a risk assessment of its ACH activities.
- Follow data security requirements for the account and routing numbers it stores.
- Accept exposure for ACH returns of its originators' entries, which means managing return rates for unauthorised debits and administrative errors.
The ODFI remains fully responsible to the network for every entry it sends, whether it comes from a direct originator or a TPS. ODFIs must also register their third-party sender customers with Nacha.
Risks for banks
US bank supervisors have long regarded third-party senders as higher risk. The FFIEC examination manuals and federal agency guidance on payment processor relationships highlight several concerns. The bank may not know the originators whose debits it is sending, so fraudulent merchants, telemarketers or illegal online businesses can hide behind a TPS. High rates of unauthorised returns, especially return code R10 for consumer debits not authorised, are a common warning sign. The TPS may also fail financially while holding customer funds, leaving the bank exposed to credit losses on returned entries.
Banks respond with enhanced due diligence on the TPS, review of its client portfolio and underwriting standards, exposure limits, monitoring of return rates by originator and the right to audit. Some banks refuse nested relationships altogether. The work overlaps with wider third-party risk management and with know-your-customer obligations under anti-money laundering rules, since the bank is moving money for parties it does not onboard directly.
A TPS differs from a sending point or processor that only transmits files for an originator that already has a direct agreement with the ODFI; that provider is a TPSP but not a TPS. It also differs from a card payment facilitator, although the business model is similar: in both cases a master account holder sponsors many smaller businesses and takes responsibility for them. In the bank-fintech model, a platform that offers ACH payments through a sponsor bank is very often acting as a TPS, and the bank's oversight of that platform is a core part of its ACH risk programme, especially for faster products such as Same Day ACH, which leave less time to stop a bad file.