Overdraft protection program vendors supply the decision rules, and core processors the posting engine, that decide when an overdraft or NSF fee is charged; many banks and credit unions run their program on settings those vendors shipped. Regulators are clear that the institution, not the vendor, answers for the result: the FDIC expects "careful oversight" of vendors, the OCC lists service providers that provide "systems that determine when overdraft or NSF fees are assessed" among the relationships a bank must manage, and in January 2025 the CFPB reported that core processors had kept charging APSN and re-presentment fees by default until each client institution acted to stop them. Botminds' Overdraft Compliance does not replace any of those systems. It reads the core's fee settings and postings every night, tests every fee against the bank's own promises, names the setting behind each finding and replays a proposed change, while a person makes every change. This page covers what vendors do, how they are paid, who owns the settings, what to ask, and where agents fit.
Where an overdraft program lives: three layers, and who owns each
What customers are told
The institution writes it
- Fee schedule and account agreement
- Regulation E opt-in notice
- Statements with Total Overdraft Fees
- ATM receipts and app balances
The settings that decide each fee
The institution owns them; the vendor ships the defaults
- Fee basis for card and ATM items
- Fee on re-presented items
- Daily fee limit and de minimis threshold
- Posting order
- Balance shown at the ATM
- Opt-in required flag
The platforms that run the program
Vendors build and host them
- Core banking system
- Card processor
- ACH processing and check imaging
- Overdraft program vendor’s decision rules
Agents read every layer every night · people approve every change to the middle one
What do overdraft protection program vendors do?
They supply the automation. The FDIC distinguishes automated overdraft programs, which "rely on computerized decision-making and use pre-established criteria to pay or return specific items", from ad hoc decisions a banker makes for a known customer (FDIC Consumer Compliance Examination Manual V-14). Vendors build and sell the first kind: the limits each account qualifies for, the rules for paying or returning an item, the fee logic, the customer communications and often the reporting. The core processor's platform then posts the items and applies the fees, and the card processor holds the authorizations.
The CFPB described the weight of that layer bluntly: "the system functionality that these entities develop drives many fee practices, including overdraft and NSF fee practices" (Supervisory Highlights 37). The OCC's bulletin puts the same relationships in scope for risk management, naming service providers "that often play a significant role in processing and reprocessing transactions, processing of payments, and providing systems that determine when overdraft or NSF fees are assessed" (OCC Bulletin 2023-12).
How do overdraft program vendors get paid, and why examiners ask
Some have been paid on the fees. The FDIC's examination manual notes that some programs "rely on third-party vendors to develop systems to maximize the amount of fee income generated", and tells examiners to look at the contract when vendor compensation is tied to fee income. Its example is specific: a vendor that takes a reduced percentage if the bank posts items largest to smallest. That arrangement "may rise to the level of a UDAP violation" if the bank, at the vendor's encouragement, manipulates posting order solely to generate fees.
Some vendors have tended to promote programs that encourage generation of fee income by linking the amount or volume of overdraft fees charged to the percentage of incentive compensation paid to the vendor. This practice is generally inconsistent with promoting the responsible use of these programs.
FDIC Consumer Compliance Examination Manual, V-14 Overdraft Payment Programs
Examiners therefore ask for the contracts. The FDIC's document list for an overdraft review includes "Third-party contracts for overdraft payment programs" and "Any agreements with third-parties allocating compliance responsibilities". A bank that cannot say how its vendor is paid, or who in the contract is responsible for compliance, has a finding before any fee is tested.
Who is responsible for vendor overdraft settings?
The institution. The interagency third-party guidance of 2023 makes the bank as responsible for an outsourced activity as it would be had it done the work itself (as summarised by the Federal Reserve, Consumer Compliance Outlook; the guidance is explained in full in the interagency guidance on third-party relationships). The September 2026 proposal to replace that guidance, issued by the FDIC, OCC, Federal Reserve and NCUA, keeps the point in almost the same words: outsourcing leaves the bank answerable for managing the risk and complying with the law (FDIC FIL-58-2026).
For overdraft programs the agencies have said it specifically. The FDIC's APSN guidance says "Institutions should ensure overdraft programs provided by third parties are compliant with all applicable laws and regulations" and encourages them "to review and understand the risks presented from third-party system settings for overdraft-related fees" (FDIC FIL-19-2023). The FDIC's 2010 guidance, amended in February 2026, says institutions using a vendor "must exercise careful oversight" (FDIC FIL-81-2010).
Does a vendor default setting create risk?
It did, in the cases the CFPB examined. Its examiners found core processors had built the capability to stop APSN and re-presentment fees, then left the fees switched on by default, so that each client institution had to act to stop them (NSF representment fees quotes the finding), and concluded the processors themselves had engaged in an unfair practice (Supervisory Highlights 37). The FDIC had warned of the same pattern in 2023: some third parties offer fixes "as optional or require client financial institutions to take action in order to implement them".
The processors examined have since changed their defaults. That does not close the question for any one bank, because a default applies when a setting is created, and a bank that converted, upgraded or customised its fee tables carries whatever value was set then. In the fictional sample credit union the solution runs on, the courtesy pay fee basis for card and ATM items had been SETTLEMENT, the vendor default, since a 2024 conversion; that one value was behind 4,920 authorized positive, settle negative fees in a year.
Eight fee settings that decide overdraft compliance, as read at a sample credit union
| Setting | Value read | Why it matters | Status |
|---|---|---|---|
| Courtesy pay fee basis, card and ATM | SETTLEMENT, vendor default since the 2024 conversion | Decides whether APSN fees are charged | Change proposed to AUTHORIZATION |
| Returned-item fee on re-presented items | DO_NOT_CHARGE; was CHARGE, vendor default, until October 19 | Repeat NSF fees on the same item | Changed |
| Re-presentment match keys | Originator + amount + RETRY PYMT | Whether a retry is recognised at all | Matches |
| Maximum courtesy pay and NSF fees a day | 4; was 5 until October 16 | Must equal the limit the fee schedule and opt-in notice state | Changed |
| Balance printed on ATM receipts | Available balance plus the courtesy pay limit, on 3 ATM models | Part 707.11(c) and Regulation DD forbid it without a second, labelled balance | Change booked |
| Opt-in required for card and ATM courtesy pay | YES | The flag is set; the consent behind it is tested separately | Matches |
| Small-overdraft threshold, no fee | $5.00 | Matches the fee schedule’s promise | Matches |
| Posting order | Chronological | FDIC expects a neutral order, not one built to maximise fees | Matches |
How do you oversee a third-party overdraft program?
By testing what the vendor's system does, not only what the contract says. The Federal Reserve's examiners found that institutions relying on a third party for their systems "monitored the third party's system settings for compliance with applicable laws and regulations, including the prohibition on UDAPs", and found it helpful when institutions told their Federal Reserve contact "if a third party was unable to comply with their directions relating to representments" (Consumer Compliance Outlook, 2023). The 2005 Joint Guidance set the starting point: institutions contracting with overdraft vendors "must conduct thorough due diligence reviews prior to signing a contract" (70 FR 9127).
The FDIC's 2010 guidance adds one test that only data can answer: review "check-clearing procedures of the institution and any third-party vendor to ensure they operate in a manner that avoids maximizing customer overdrafts and related fees through the clearing order" (FIL-81-2010 attachment). The OCC's version is broader: banks should test their core settings and parameters from time to time against what they disclosed, and boards should ensure "the bank has an effective change management process".
What questions should you ask an overdraft program vendor?
The ones whose answers you can check against your own data. A vendor's assurance that its platform is compliant is worth little without the settings, the change history and a way to test what the settings produced.
Ten questions for an overdraft program vendor or core processor
- How are you paid, and does any part depend on fee volume?
The FDIC manual tells examiners to evaluate compensation tied to fees generated.
- Which fee settings ship as defaults, and what is each default today?
Fee basis for card items, re-presentment fees, daily limits, de minimis, posting order, balance display.
- Can you export every setting, with its value on any past date?
Without a dated history, a lookback cannot say when a practice started.
- Do you decide card and ATM fees at authorization or at settlement, and can we choose?
The APSN question, and whether the fix is an option you must turn on.
- How do you identify a re-presented ACH debit or check?
Which keys, and what happens to a retry the merchant miscodes as new.
- Does a release or conversion ever reset a setting we changed?
Ask for release notes that list fee-setting changes.
- Can we receive the authorization file and full posting history every night?
APSN cannot be tested without the balance at authorization.
- Which compliance responsibilities does the contract allocate to you?
Examiners ask for agreements allocating compliance responsibilities.
- Will you let an unaffiliated testing tool read the core?
The agencies now weigh limits on integration when they supervise core providers.
- What happens on exit?
Deconversion fees and data return decide whether the settings history leaves with you.
The last two questions became easier to ask in September 2026. The FDIC, OCC and Federal Reserve's joint statement on community banks' engagement with core providers calls core providers "CBOs' most material, complex, and highest-risk third-party relationships", notes that a few large providers dominate the market, "which limits CBOs' negotiating power", and says the agencies will weigh, in allocating supervisory attention to a core provider, contract terms and practices including "excessive limitations on the ability of unaffiliated service providers to integrate with the core platform" and undefined deconversion fees (Joint Statement, September 11, 2026).
Can overdraft settings be changed in the core?
Yes, and the change is where most programs lose their evidence. A setting is usually a value in the core's fee tables that deposit operations or the processor can change in minutes; what is usually missing is the reason, the expected effect, a second approver and proof afterwards that the change held. At the fictional sample bank that is exactly what happened: the core setting had changed with no record of why. The flow below is the change process the solution runs instead.
One setting change in Overdraft Compliance, from finding to nightly proof
Agent
Configuration agentNames the setting behind an approved finding and replays the last 12 months under the proposed value
Never: Read only on the core
A person decides
Compliance OfficerProposes the practice change with the replay attached: fewer fees, less fee income, from a stated date
A person decides
Deposit Operations ManagerApproves as checker with a reason code, then makes the change in the core
Agent
Replay agentRuns the same tests on each night’s fees and reports only failures, so a reset by a release shows up the next morning
Never: Never fills a gap in source data
The settings behind the fees, and a change waiting for its checker
Should a bank use an overdraft program vendor?
Most already rely on one through their core: the agencies' own statement says most community banks rely on core providers, whether or not they bought a separate overdraft product. The practical question is how to oversee it. A separate program vendor can bring decision rules and reporting a small institution could not build; the supervisory findings say what to watch: compensation tied to fees, posting order, defaults that charge until switched off, and settings nobody at the bank can export. The FDIC's 2010 guidance and the OCC's 2023 bulletin both describe the same alternatives a program should offer heavy users, a linked savings account or a lower-cost line of credit, and a vendor's program should support them rather than steer around them.
What the vendor does, and what stays with the bank
Vendor or core processor: The decision rules, posting engine, fee logic and default settings
The bank or credit union: Nothing: it chooses and configures
Vendor or core processor: Each item, by the rules as configured
The bank or credit union: Which rules, which settings, which fees, and when to change them
Vendor or core processor: Its own practices, where it is examined as a service provider
The bank or credit union: Every fee charged to its customers, whoever’s system charged it
Vendor or core processor: Assurances, release notes and audit reports
The bank or credit union: Testing the fees the settings produced against what it disclosed
Where agents sit beside the core: read, test, never change
Botminds' Overdraft Compliance is built to integrate, not replace. It works with the systems the fees already run through: the core banking system for posting history, fee settings and account status, read every night; the card processor for authorizations, settlements and ATM receipt settings; ACH processing and document imaging for returns, retries and re-deposited checks; the agreement library for the fee schedule, agreement and opt-in notices; contact centre recordings for phone opt-ins; and the general ledger and remediation program for refunds. The configuration agent is read only on the core: a person makes every change. Nothing in the vendor's program changes, and every setting change gains a reason, a replay and two signatures. The same integrate-not-replace argument for account opening systems is made in digital account opening software: integrate it, don't replace the core.
The test of a setting is what it does to fees against what the bank promised, and that is where the solution spends most of its night: each promise in the fee schedule, the agreement and the Truth in Savings disclosures becomes a test on the year's postings. For what the full-year test finds and how it compares with a sample, see overdraft protection compliance, tested on last year's postings.
Overdraft Compliance tests each promise against what the core does
Questions people ask
Is an overdraft program vendor examined by the regulators?
Some are. The FDIC, OCC and Federal Reserve examine certain technology service providers, including core providers, and the CFPB examined core processors as service providers to large institutions, finding their default fee settings unfair. The bank remains responsible for its own fees either way.
What is the difference between an automated and an ad hoc overdraft program?
An automated program pays or returns items by pre-set criteria with little or no case-by-case review; an ad hoc decision is a banker's judgment for a known customer. The FDIC's 2010 expectations on heavy users apply to automated programs, which is most vendor programs.
Do vendor contracts need to allocate compliance responsibility?
FDIC examiners ask for "Any agreements with third-parties allocating compliance responsibilities" in an overdraft review. A contract cannot move the bank's legal responsibility to the vendor, but it can require the settings exports, change notices and data feeds the bank needs to meet it.
Can a core processor change our overdraft settings in a release?
Ask yours in writing, and test for it. A nightly test of the fees the settings produce is the fastest way to see a change you did not make; in the sample, the watch after a change reports any failing fee the next morning.
Does the 2026 core provider statement change what a bank must do?
No. It tells community banks how the FDIC, OCC and Federal Reserve will weigh core providers' practices, such as limits on integrating other tools and opaque deconversion fees, when they decide how closely to supervise those providers. The bank's own third-party risk management duties are unchanged.