Are third party payment processors high risk? Not by label: the FDIC’s stated policy is that banks which manage these relationships properly are neither prohibited nor discouraged from serving them. But processors carry a specific risk that the bank answers for, because the bank warrants every entry and owes due diligence on merchants it never meets, and processors generally sit outside the Bank Secrecy Act’s program requirements. The enforcement record shows what that costs when the bank’s view stops at the processor: $15 million and a lost charter at First Bank of Delaware, a $1.2 million resolution at Four Oaks Bank after $2.4 billion of consumer debits, $4.9 million at CommerceWest Bank after half its processor’s debits came back. Botminds’ Third-Party Sender Due Diligence exists for the layer those cases turned on: every originator behind a sender screened, evidenced and measured from the bank’s own files, and every decision signed by a named person.
What three banks paid over processors they did not watch closely enough
$15M
First Bank of Delaware, FinCEN and FDIC penalties, 2012; its charter was then terminated
$4.9M
CommerceWest Bank, civil and criminal resolution with the Justice Department, 2015
$1.2M
Four Oaks Bank, penalty and forfeiture in a 2014 consent order
$2.4B
of debits against consumers’ accounts Four Oaks let one processor originate
The sample case later on this page is fictional: Tessaly Community Bank and its sender Larkfield Payroll Services, as they run through the solution. The cases are real and quoted from the agencies’ own releases and orders.
Are third party payment processors high risk? Not by label, by what they carry
The regulators’ answer is that processors carry elevated risk which a bank can manage, not a status that rules them out. In 2014 the FDIC removed lists of example merchant categories from its guidance because they were being read as prohibitions, and restated its position: “it is FDIC’s policy that insured institutions that properly manage customer relationships are neither prohibited nor discouraged from providing services to any customer operating in compliance with applicable law” (FDIC FIL-41-2014).
The same agencies are specific about where the risk sits. The FFIEC’s examination manual tells banks that serve processors to “be aware of the heightened risk of returns and use of services by higher-risk merchants,” adding that some higher-risk merchants use processors precisely “because they do not have a direct bank relationship” (FFIEC BSA/AML Manual). Processors also tend to be nested and layered: the FDIC calls nested processor and aggregator relationships the case in which risk to the institution is significantly elevated. So the honest answer is that a processor is as risky as the merchants behind it and as opaque as the bank lets it be.
Third party payment processors AML risk: outside the BSA, inside the bank
The money laundering risk lands on the bank because the processor usually has no program of its own to carry it. Processors are generally not subject to the Bank Secrecy Act’s program requirements, which leaves the bank’s own AML program as the only control between the merchants and the payment system. The FFIEC manual describes the consequence: when the bank cannot identify the nature and source of what moves through a processor’s account, “the risks to the bank and the likelihood of suspicious activity can increase.”
FinCEN’s 2012 advisory lists how criminals have used processors: to mask illegal transactions, to place illicit funds through ACH credits from foreign sources, and to run fraud through consumers’ accounts while maintaining relationships at several banks in case one ends. Each of those is visible, if at all, at the level of the processor’s merchants. The three regulators’ texts are set side by side in third party payment processors under FFIEC, FDIC and FinCEN guidance.
Three enforcement outcomes over payment processors, by amount
What happened to First Bank of Delaware?
It paid $15 million, and then it stopped being a bank. In November 2012 the FDIC and FinCEN assessed concurrent penalties of $15 million for Bank Secrecy Act violations; “Specifically, the bank failed to adequately oversee third-party payment processor relationships and related products and services in a manner commensurate with associated risks” (FinCEN and FDIC release). The same release records what followed: another bank bought certain assets and assumed its deposits on November 16, 2012, and “The Delaware Office of State Bank Commissioner terminated First Bank of Delaware’s charter and the FDIC terminated its deposit insurance.”
FinCEN’s assessment shows how far the merchant layer had drifted from the bank’s view. Merchants using its remotely created check service “were responsible for total return rates of over 60%, which vastly exceeded any reasonably expected rate for such activity.” On the ACH side, “In 2010, the Bank processed over $1.4 billion in ACH transactions, primarily through a single customer,” and the bank had not collected enough information on that customer or its major merchants (FinCEN, Assessment of Civil Money Penalty). One of those merchants was a foreign money services business whose file lacked address verification, site visits and background checks. How the same assessment’s return figures translate into originator-level monitoring is worked through in third party sender ACH risk one layer down.
What did Four Oaks Bank pay, and what had it earned?
Four Oaks paid $1.2 million to resolve a civil complaint, against about $850,000 in fees. According to the complaint, the bank let a Texas-based processor “originate more than 9.8 million debit transactions, for a total of more than $2.4 billion, against consumers’ bank accounts,” for merchants that included internet payday lenders defrauding borrowers (U.S. Attorney, E.D.N.C.). The consent order required a $1 million penalty, a $200,000 forfeiture and a permanent bar on serving processors for high-risk merchants without strict prior and ongoing investigation and monitoring.
The Justice Department’s testimony to Congress later that year set out the warning signs the bank allegedly had: hundreds of notices from consumers’ banks, submitted under penalty of perjury, that debits were unauthorized; evidence “that more than a dozen merchants served by the payment processor had a ‘return rate’ over 30 percent,” one over 70 percent; and efforts by merchants to conceal who they were. The bank, the testimony said, “received more than $850,000 in fees” (Statement of Stuart F. Delery, July 17, 2014). The penalty was the smaller part of the cost; the permanent restriction on a business line was the larger.
CommerceWest: blocking the banks that complained
CommerceWest’s case is the clearest record of a bank that saw the problem and managed the complaints instead of the processor. From December 2011 to July 2013 it served V Internet, a processor whose merchants debited consumers without authorization. “Approximately 50 percent of the transactions were returned by consumers and their banks,” many with sworn affidavits (Justice Department, March 10, 2015). When other banks complained, “CommerceWest and V Internet developed a practice of blocking transactions against accounts at those banks that complained, but allowing the transactions to continue against accounts at all other banks.”
CommerceWest and V Internet: from the warning to the stop
- Returns near half; complaints from other banks
- 35 d
- 30 d
The bank also never filed a suspicious activity report, and that is what the criminal charge was for: willfully failing to file. The resolution totalled more than $4.9 million, with a deferred prosecution agreement and a permanent injunction requiring “a strict regime of underwriting and monitoring designed to prevent future consumer fraud by third-party payment processors.” In each of the three cases, the information that should have triggered action existed at the merchant level, and the bank either did not collect it or did not act on it.
What each bank missed, and the control that would have caught it
| Bank | What the record says it missed | The control that reaches it |
|---|---|---|
| First Bank of Delaware | Merchants with total returns over 60%; $1.4 billion of ACH through one customer whose merchants it had not assessed | Due diligence on the processor’s merchants, and returns measured per merchant |
| Four Oaks Bank | More than a dozen merchants with return rates over 30%; hundreds of sworn notices of unauthorized debits; merchants concealing their identities | Return rates per originator against a threshold, with a decision when one is crossed |
| CommerceWest Bank | About half of all debits returned; complaints from other banks; an official’s finding that all transactions appeared fraudulent | A named decision-maker with a clock, and the suspicious activity report the BSA officer owns |
What was Operation Choke Point, and what changed after it?
It was the name given to a Justice Department effort against banks and processors that facilitated consumer fraud, and the reaction to it reshaped the guidance banks read today. The department told Congress in July 2014 that its attorneys proposed, in November 2012, “a concentrated effort to pursue the fraud committed by the banks and payment processors,” issuing civil subpoenas between February and August 2013; “This effort is sometimes referenced as Operation Chokepoint” (Delery testimony). Four Oaks was the first resolution it described.
The same testimony responded to criticism that the effort targeted lawful businesses, saying “an entity’s simply doing business with a merchant considered ‘high risk’ is not fraud.” Eleven days later, on July 28, 2014, the FDIC removed its lists of example high-risk merchant categories. More recently the OCC struck references to reputation risk from its processor and ACH bulletins as of March 20, 2025, and the FDIC did the same to its processor guidance on February 3, 2026 (OCC Bulletin 2008-12; FDIC FIL-3-2012). What did not change is the expectation that a bank knows the processor’s merchants and acts on what their returns and complaints show.
Can a bank be fined for a payment processor’s merchants?
Yes, through several routes, and the three cases used most of them. First Bank of Delaware was penalised under the Bank Secrecy Act for an inadequate program and unreported activity. Four Oaks and CommerceWest faced the Justice Department under fraud statutes, and CommerceWest also under FIRREA and the Bank Secrecy Act’s reporting requirement. The FDIC adds the consumer-protection route: banks that fail to manage processor relationships “may be viewed as facilitating a payment processor’s or merchant client’s fraudulent or unlawful activity and, thus, may be liable for such acts or practices” under the unfair or deceptive practices provisions of the Federal Trade Commission Act (FDIC FIL-3-2012).
The Nacha rules add a network route. A bank whose originator or sender breaches the unauthorized threshold, or that fails to register a sender, faces Nacha’s enforcement process, which can end in sanctions or fines against the bank (Nacha, Third-Party Sender Registration FAQ). None of these routes cares that the merchant was the processor’s customer rather than the bank’s.
What does a missed nested sender cost before any penalty?
It costs a backlog of entries the bank warranted for parties it never assessed, and a remediation list with dates. In the sample, QuickRun Billing sent 56,400 web and telephone debits worth $27.9 million through Larkfield Payroll Services over 230 days, under a registration that said the sender had no nested senders and an agreement that required the bank’s written consent first. Its addenda named 37 companies. Nacha’s 2022 rule keeps the bank responsible for giving receiving banks the information they are owed, proof of authorization included, however many senders sit in between (Nacha), so every one of those debits is one the bank may have to stand behind with paperwork it has never seen.
The decision becomes eight items, each with the evidence that closes it
That list is the cost of the error when it is caught by the bank. The cost when it is caught by an examiner, or by a receiving bank’s complaint, is the cases above. Where the nested sender came from, and why the roster could not show it, is in nested third party sender examples.
How to decide whether to bank a payment processor
The decision is the bank’s, made by its board-approved policy and a committee, and the record suggests six questions that separate a processor the bank can manage from one it cannot. None of them is about the processor’s industry label; all of them are about whether the bank can see and act on the layer below.
Six questions before approving, or renewing, a payment processor
- Can we see every merchant, with its identity, business, location and sales method?
The FDIC and FFIEC both require this information and verification of each merchant’s legitimacy; a processor that will not supply it fails here.
- Can we measure each merchant’s returns from our own files?
All three cases turned on merchant-level returns the bank either did not measure or did not act on.
- Does the agreement give us access, a nesting rule and termination rights?
Access to originators’ files, prior consent for nested senders, the right to stop a merchant and immediate termination.
- Is the processor’s creditworthiness enough to back its warranties?
The FFIEC asks banks to substantiate it against the volume and exposure of the merchants beneath.
- Who decides when a line is crossed, and how fast?
CommerceWest took over a month from its own finding of fraud to a decision, and planned 30 more days.
- Is the suspicious activity decision separate and owned?
Each bank’s penalty grew from reports not filed; that decision belongs to the BSA officer, outside the commercial review.
Where Botminds’ solution helps is the second, third and fifth questions: it reads every merchant behind a sender from the bank’s own files, quotes the agreement’s clauses back, and puts each finding in front of a named decision-maker with a reason code and a clock. It does not decide whether to bank a processor, and it keeps report-filing matters with the BSA officer. To see a full review on a sample sender, start from Third-Party Sender Due Diligence.
Questions people ask
Is a third-party payment processor a money services business?
Not necessarily. The FFIEC manual notes that processors are generally not subject to the Bank Secrecy Act’s program requirements, while FinCEN tells banks to check that a processor holds any state licences and registrations it needs. Whether a given processor is a money transmitter depends on its activities and the applicable rules.
Why did First Bank of Delaware lose its charter?
After the $15 million penalties in November 2012, another bank bought certain assets and assumed its deposits, and the Delaware Office of State Bank Commissioner terminated its charter while the FDIC terminated its deposit insurance. The penalties related to its oversight of payment processors and other high-risk lines.
Did the FDIC end its payment processor guidance?
No. FIL-3-2012 is still current; it was revised on February 3, 2026 to remove references to reputation risk. Its expectations on due diligence, monitoring and not relying solely on the processor remain.
Are nested payment processors riskier than direct ones?
The FDIC says so: a processor that serves other processors or aggregators is far harder for the bank to watch, and the bank’s risk rises sharply with it. Nacha adds that risk may increase with each level of removal from the originator. Worked cases are in nested third party sender examples.
What return rate signals a problem processor?
Nacha’s unauthorized threshold is 0.5% per originator or sender. The cases on this page involved merchants at 30% to 70% and processors with about half their debits returned, far beyond any threshold, which is why a bank measuring each merchant would have seen them early.