Third-party sender due diligence that reaches the layer below the sender
Every originator behind the sender screened and measured, not just the sender.
See one case, screen by screen ↓It is the work an originating bank does to register a payment processor that sends ACH through it, to know the originators that processor sends for, and to keep each of them inside the Nacha return levels and the bank's own risk criteria. Third-Party Sender Due Diligence does that work one layer deeper than a yearly spreadsheet: every originator on the roster is screened, evidenced and measured from the bank's own ACH files, and every finding carries a reason code and a named approver.
AI use cases in banking: a buyer's guide to agentic AI for bank and credit union operations →
Updated
Third-party sender due diligence starts with a simple fact: a third-party sender is a payment processor that originates ACH through the bank for its own clients. The bank registers it, signs an origination agreement, sets a settlement exposure limit — and then answers to Nacha and to its examiners for companies it has never met. Those companies are the ones that debit consumers, and their return rates, their business and their due diligence are the bank's problem long before they are anyone else's.
Once a year the processor emails a roster, in whatever shape it keeps it. A sample is screened by hand, because nobody can screen 1,240 rows. Return rates come out of the payments platform at sender level, because that is the report it prints — and a sender whose own unauthorized rate is 0.18 % can be carrying three originators over the 0.5 % level without a number on any screen moving. Between reviews nothing watches, so a new originator, a new entry type, or a sender hiding behind the sender surfaces a year later, or in an examiner's sample.
Estimated split for one annual review of a sender with about 1,200 originators, by hand and with the solution.
Seven agents read the registration, the roster, the files and the returns; the analyst prepares, the BSA Officer confirms screening and the committee decides.
Larkfield Payroll Services has originated ACH through Tessaly Community Bank since 2019. Its annual review is due on October 31; it sends for 1,240 companies, 412,000 entries a month, $186.4 million. Here is what happens, screen by screen, in the working solution.
Delia runs 34 third-party senders with 18,600 originators behind them and 3.2 million entries a month. She opens Larkfield: 1,240 originators as a tree, grouped by industry and entry type — staffing and payroll, medical and dental practices, property management, fitness and membership, online subscriptions, billing and receivables. Most branches are calm. Five carry a small chip.
Its own unauthorized return rate is 0.18 % against a 0.5 % level — comfortably inside, which is the whole problem.
The registration agent reads the registration record and the origination agreement, and lists the Company Identifications actually sending. The roster agent reads all 1,240 rows — not a sample — screens each name and checks the due diligence evidence on file. The returns agent measures every originator from the bank's own ACH files, and the nesting agent compares what is in the files with what is on the roster. The audit evidence agent reads the audit and the risk assessment, and the review writer turns it all into findings with their reason codes.
“1,240 rows, 6 industry groups, 4 entry types — every row, not a sample.”
Harbor Lane Dental Partners has no beneficial ownership certification on file. Hallowell Property Group, Fernhill Fitness Collective and Fennimore Media Group are over the unauthorized return level. QuickRun Billing is not an originator at all. A sixth finding is about Larkfield itself.
Status is a word, not a color: returns over level, no due diligence on file, nested sender.
Over a rolling 60 days: Fennimore Media Group 1.12 % unauthorized on 2,144 WEB and TEL debits, and 4.29 % administrative — over both levels. Fernhill Fitness Collective 0.73 % on 3,718 debits. Hallowell Property Group 0.61 % on 6,430. The codes behind each rate are kept, and the window can be 30, 60 or 90 days.
“All three of the sender's own rates are inside their levels. A sender-level report stops here.”
Fernhill Fitness Collective, Company Identification 9105113467, WEB membership dues, 1,859 entries a month, on Larkfield's roster since April 2023, with the descriptor its debits carry. Screening cleared on October 19 and confirmed by the BSA Officer; the business formation document and the beneficial ownership certification are on file; 27 unauthorized returns put it over the level.
The agents screen and evidence; they never clear a hit. A named person does.
Company Identification 9004218833 has sent WEB and TEL debits since March 4, 2026 — 230 days, 56,400 entries, $27.9 million — under the name QuickRun Billing, and there is no row for it in the 1,240 the sender supplied. Its addenda name 37 of its own clients. Its own business is processing payments for small service businesses. Section 7.3 of the origination agreement does not permit it.
Two clocks: 30 days after the first entry, missed in April — and 10 days from the day the bank knew, October 30.
Delia clicks the roster finding and reads the search itself: the roster was searched for Company Identification 9004218833 and for the name QuickRun, and no row matches. The agreement clause, the audit page, the screening run, the return report and the customer due diligence index all open the same way.
“Read by the agents · not changed.”
The registration record says nested senders: no — contradicted by the files. The agreement forbids them. And last year's annual rules compliance audit, completed November 22, covered PPD and CCD entries only: WEB and TEL were not in scope — 341 originators across four industry groups send them, including all three over a return level. The request to the sender is drafted from the gaps.
The audit evidence agent never signs off a scope gap.
The chain is on the screen: prepared by Delia at 09:38, screening confirmed by Royce Tanaka the evening before with all 1,240 cleared, and the decision waiting for the committee on October 23. Harriet suspends QuickRun Billing's entries pending registration with reason code TPS-04, in her own words, and signs. Switched to internal audit, every one of those actions is unavailable and the evidence pack still downloads.
Report-filing matters are not part of this review; they stay with the BSA Officer in the financial-crime case file.
Suspend the entries, register QuickRun as a nested sender by October 30, amend the origination agreement, get its own risk assessment and audit, run due diligence on its 37 companies, a 60-day rate plan for the three originators, the missing certification, and an audit scope extended to WEB and TEL. Each item names the record that closes it, and the person who raised it cannot close it alone.
The same review, seen by the four people who carry it — what their year looked like, and what it looks like now.
Seven agents read the registration, the roster, the files and the returns; the analyst prepares, the BSA Officer confirms screening and the committee decides.
Reads the registration record and the origination agreement, lists the Company Identifications actually sending, and reports whether the registration is current and whether nested senders are permitted — quoting the clause.
Reads the originator roster in whatever shape it arrives, matches every name and Company Identification to the entries seen, screens each one against the sanctions and prohibited-business lists, and checks the due diligence evidence on file.
Measures each originator's unauthorized, administrative and overall return rates from the bank's own ACH files over the configured window, against the Nacha levels, and keeps the return codes behind every rate.
Looks for a sender behind the sender: Company Identifications and names that send but are not on the roster, batch descriptors and addenda that name a third party, and originators whose own business is payment processing.
Reads the annual rules compliance audit and the risk assessment, checks the date, the period, the entry types and originators in scope and the findings, and drafts the request for what is missing.
Drafts the review: every finding cited to the record it came from, a recommendation and a reason code for each, the committee packet and the examiner evidence pack.
Between reviews, compares each morning's files and rosters with the last review and opens an alert — a new originator, a new entry type, a volume outside the band, a rate over a level, a new unmatched Company Identification — with its evidence and its clock.
Approves, conditions or suspends. The agents propose; a named person decides.
Plain questions, answered from the records on the screen — and the answer can act: filter the tree, open a finding, draft the request.
Why is QuickRun Billing a finding?
It is a third-party sender hiding behind a third-party sender. Company Identification 9004218833 has sent WEB and TEL debits through Larkfield since March 4, 2026 — 230 days, 56,400 entries, $27.9 million — and it is not on the roster supplied on October 6. Its own business is payment processing, and section 7.3 of the origination agreement does not permit nesting. The rule gives the bank 10 days from today to register it.
Which originators are over a Nacha level?
Three, all on WEB or TEL debits, over the 0.5 % unauthorized level in the 60-day window: Fennimore Media Group at 1.12 % — and 4.29 % administrative, over both — Fernhill Fitness Collective at 0.73 % and Hallowell Property Group at 0.61 %. Larkfield's own rate is 0.18 %, comfortably inside, which is why a sender-level report shows nothing.
Did the sender's audit cover WEB entries?
No. The rules compliance audit of November 22, 2025 covered PPD and CCD entries only; WEB and TEL were not in scope. That leaves 341 originators across four industry groups sending entry types the audit never looked at — and all three originators over a return level are among them. The February 2026 risk assessment also does not address nested senders.
Hold the three high-return originators to a monthly rate report
Added as a condition. Fennimore Media Group, Fernhill Fitness Collective and Hallowell Property Group now carry a monthly unauthorized, administrative and overall rate report to the bank for 60 days, reason code TPS-02, due December 19, owner Niles Okonjo. It is on the remediation plan and goes to the committee with the review — the assistant cannot approve it; the committee chair does.
13 screens from the working solution, on its sample data. Pick one to see it large.
The levels, cycles and clocks the agents apply are settings — versioned, and every change on the audit trail.
| Setting | Default | Choose from |
|---|---|---|
| Review cycle by risk tier | High 12 months · Medium 18 · Low 24 | High 6 or 12 · Medium 12 or 18 · Low 18, 24 or 36 months |
| Unauthorized return level | 0.5 % — the Nacha level | 0.5 % · 0.4 % · 0.3 % |
| Administrative return level | 3.0 % — the Nacha level | 3.0 % · 2.5 % · 2.0 % |
| Overall debit return level | 15.0 % — the Nacha level | 15.0 % · 10.0 % · 8.0 % |
| Return window | Rolling 60 days | Rolling 30 · 60 · 90 days |
| On a suspected nested sender | Hold for the committee · 2 business days | Hold for the committee · suspend entries on discovery |
| Change alert SLA | 5 business days | 3 · 5 · 10 business days |
| Second signature above | $5,000,000 of daily exposure | $2,500,000 · $5,000,000 · $10,000,000 |
Every figure is labelled: a target the solution is built to, an estimate, a typical published result, or a proven one.
“demo” = seen in the working solution on its sample data · “typical” = published figures (Nacha Operating Rules: the 0.5 % unauthorized, 3 % administrative and 15 % overall return rate levels; registration of a nested third-party sender within the later of 30 days after the first entry or 10 days after the bank becomes aware; the annual ACH rules compliance audit every third-party sender owes by December 31) · “estimated” = our estimate, with the inputs shown. The bank, the senders, the originators, the people and every identifier on this page are fictional — characters and sample data in the working solution.
It is the work an originating bank does to register a payment processor that sends ACH through it, to know the originators that processor sends for, and to keep each of them inside the Nacha return levels and the bank's own risk criteria. Third-Party Sender Due Diligence does that work one layer deeper than a yearly spreadsheet: every originator on the roster is screened, evidenced and measured from the bank's own ACH files, and every finding carries a reason code and a named approver.
A nested third-party sender is a processor that has an agreement with another third-party sender rather than with the bank, so the bank may never be told it exists. The nesting agent compares the Company Identifications, company names, batch descriptors and addenda in the bank's own files with the roster the sender supplied. Something that sends but is not on the roster — and whose own business is payment processing — is raised as a suspected nested sender with every piece of evidence and a confidence, for a person to decide.
From the bank's origination files and return reports, over a rolling window of 30, 60 or 90 days. The unauthorized rate comes from R05, R07, R10, R11, R29 and R51; the administrative rate from R02, R03 and R04; and the overall rate from every debit return. Each is compared with the level in settings — 0.5 %, 3 % and 15 % by default — and the codes behind every rate are kept and shown.
Yes, and its scope rather than just its date. The audit evidence agent records the period, the entry types and originators the audit covered and its findings, then compares that scope with what the sender actually originates. An audit that covered PPD and CCD entries while the sender also sends WEB and TEL is a finding, and the request for a scope extension is drafted from it.
Yes. The review cycle per risk tier, the three return levels, the return window, the nested-sender rule, the change-alert SLA, the approver for each decision, the second-signature threshold, the agent confidence floor, the reason-code list, retention and account-number masking are all settings. Each is versioned and every change is recorded against the administrator who made it.
Yes. The agents read, screen, measure, draft and propose; they never approve, suspend, release, register or clear a screening hit. The analyst prepares, the BSA Officer confirms the screening, and the committee decides with a reason code and a signature, with a second signature above the exposure threshold in settings.
One evidence pack: the review, every finding with the record it came from, every decision with its reason code and signature, every agent step, and every action a person took. Entries that belong to the financial-crime case file are excluded, and only the BSA Officer can add one — so nothing in a review, a committee packet or a request to the sender discloses a report-filing matter.
The Agentic Solution Engine builds and deploys it from your own material — your registration records, origination agreements, a sender's roster and a period of ACH files — and it goes live once every quality gate has passed. We will walk you through it on one of your own third-party senders first.
What the client agreed, what the log shows, and whether they match.
1-min demoTreasury Management OnboardingLive in days, not a month, with every setup signed and checked.
1-min demoPositive Pay ExceptionsEvery exception decided by a named person before the cutoff, not left to the default.
1-min demoWe'll run Third-Party Sender Due Diligence on one of your own third-party senders and its roster.