A third-party service provider (TPSP) is an outside organisation that carries out part of a payment or financial service on behalf of a bank, merchant, payment company or other regulated firm. Examples include processors, gateways, hosting companies, core banking vendors, payroll firms and fraud-screening services. The firm that hires the provider keeps responsibility for the outsourced activity, so it must choose, contract with and oversee the provider carefully.
The phrase has specific meanings in several rulebooks. The Nacha Operating Rules use it for organisations that handle ACH entries for originators or banks. The PCI DSS uses it for any business that stores, processes or transmits card data for another entity, or that could affect the security of that data. Bank supervisors and EU law use related terms such as third-party relationship and ICT third-party service provider. The common thread is that a regulated firm relies on someone else to do work that affects its customers, data or money.
TPSPs in the ACH Network
Under the Nacha rules, a third-party service provider is any entity other than an originator, ODFI or RDFI that performs functions relating to ACH processing on their behalf. These functions include creating files, transmitting them, acting as a sending or receiving point and settling entries. A third-party sender is a special subtype that holds the origination agreement with the bank itself; other TPSPs act only as agents of a party that already has a direct agreement.
All TPSPs must follow the Nacha rules for the work they do, including data security and audit requirements, and the ODFI or RDFI that relies on them remains responsible to the network.
TPSPs under PCI DSS
In card payments, PCI DSS uses the term for any provider that handles payment card data for a merchant or another service provider, or that manages systems inside or connected to the cardholder data environment. A hosted payment page provider, a payment gateway, a tokenisation service and a managed security provider can all be TPSPs.
Requirement 12.8 of PCI DSS asks the merchant or entity to keep a list of its TPSPs, have written agreements in which providers acknowledge their responsibility for the security of the data they handle, check their compliance status and know which requirements each provider covers. Requirement 12.9 places the matching duty on the provider to acknowledge that responsibility and supply information to its customers. Large providers usually prove compliance with a Report on Compliance and an Attestation of Compliance for service providers, and the card schemes list registered providers.
Third-party risk in banking regulation
Bank regulators treat dependence on outside providers as a source of operational, compliance and reputational risk. In the United States, the federal banking agencies issued joint interagency guidance on third-party relationships in 2023, covering the full life cycle from planning and due diligence through contracts, ongoing monitoring and termination. In the European Union, the Digital Operational Resilience Act (DORA), applicable since January 2025, sets rules for how financial firms manage ICT third-party risk and creates an oversight regime for critical ICT providers. EU banking guidelines on outsourcing also require firms to keep a register of outsourcing arrangements and to retain the ability to exit.
Typical controls include risk-based due diligence before signing, contractual rights to audit and to receive incident reports, service-level monitoring, business continuity and exit plans, and periodic reassessment, with the depth of each step matched to how important the service is and how much sensitive data or money the provider handles. Providers whose failure would disrupt a key service are often classed as a critical service provider and receive the closest scrutiny. These practices form the core of vendor risk management and wider third-party risk programmes.
TPSPs in embedded finance
The growth of banking-as-a-service has made TPSP oversight a central concern. A sponsor bank may rely on a fintech programme manager, a middleware platform and several processors to deliver accounts and payments to end users, so a failure at any layer can leave customers unable to reach their money or leave ledgers that do not reconcile. Supervisors have taken enforcement action against banks whose oversight of such partners was weak, and sponsor banks now commonly require detailed reporting, reconciliation evidence and compliance testing from every provider in the chain.