Originator vs third party sender: the customer that is really a TPS

Originator vs third party sender turns on whose payment the entry is. An originator is the business that owes or is owed the money by the receiver, such as an employer paying wages or a gym collecting dues, and it authorizes the entries for itself. A third-party sender transmits entries for other businesses’ obligations, and holds the ACH origination agreement with the bank in their place. The hard case is a customer the bank onboarded as an originator that quietly starts sending for clients of its own: it has become a sender, the bank owes Nacha its registration within ten days of working that out, and every client behind it is now a company the bank must know. Botminds’ Third-Party Sender Due Diligence watches for that change in the bank’s own ACH files, where it shows first, and puts each sign in front of an analyst with its evidence.

The sample case on this page is fictional: Tessaly Community Bank and its sender Larkfield Payroll Services, as they run through the solution. The tests come from Nacha’s public pages and its 2014 operations bulletin, linked where they are used.

Third party sender vs originator: whose obligation is the entry paying?

The originator is the party with the underlying obligation; the sender is an intermediary that holds the bank agreement for it. Nacha’s Third-Party Sender Identification Tool opens with exactly that question for the bank: “Does my ACH customer have the underlying obligation (e.g., agreement, contract) to pay or be paid by the Receiver?” (Nacha, Third-Party Sender Identification Tool). If the answer is no, the tool’s conclusion is that the customer is a sender, because it “is originating entries on behalf of and for the ultimate benefit of its downstream customer (e.g., the Originator) that has the underlying payment obligation with the Receiver.”

The test ignores several things banks tend to look at. It does not matter that the customer creates the file, that funds settle into its account first, or that its name is on the bank’s side of the agreement. The tool even has an outcome for that case: a sender that says funds settle into its own account is still a sender, because those funds “are for the benefit of my client.” What matters is who the receiver owes, or who owes the receiver.

What is an originator in ACH? The party with the obligation, not the party with the file

An originator is the person or business that initiates an entry to satisfy its own obligation, with the receiver’s authorization where one is needed. It may hire a service provider to do every mechanical step, and it remains the originator. Nacha’s tool says so for the common case: an originator “may outsource any or all of its Originator obligations (such as file creation and transmission to the ODFI) to a Third-Party Service Provider,” and because it holds the agreement directly, the provider “is solely that of a service provider and not a Third-Party Sender.”

In a sender relationship the originator still exists; it is simply not the bank’s customer. In the sample, Fernhill Fitness Collective is an originator: its members owe it their dues, its debits carry its own descriptor, and it reaches the bank through Larkfield Payroll Services. The bank has never signed anything with Fernhill, but Fernhill is the originator of every one of those debits, and the bank must still know it. The difference between the sender and the third party service provider that merely builds files is the same contract question from the other side.

An originator behind a sender: its own obligation, its own descriptor

Nacha’s property manager test: same business, two different answers

Nacha’s bulletin uses two property-management scenarios to show that the business label decides nothing. In the first, a property manager collects homeowners’ association dues: the homeowners owe the association, the manager obtains their authorizations on the association’s behalf, and so the association is the originator and the manager is a sender. In the second, a manager rents out a vacation property and collects the rent: “The Property Manager is the Originator of the ACH debit because Renter has not incurred a direct obligation to the Owner, and the Renter and Owner have no agreement with each other” (ACH Operations Bulletin #2-2014).

A bank whose property-management customers do both, as many do, has a customer that is an originator for one book and a sender for another. That is not a contradiction; it is the normal state of an intermediary, and it is why the classification belongs to entries and books, not to the customer’s industry code.

Can a company be an originator and a third party sender at once?

Yes, and many intermediaries are. The bulletin says the 2014 definition allows one participant to hold both roles, “including when multiple Entries are used in different stages of an overall transfer.” A payroll processor originates its own funding debit to the employer and sends the wage credits for the employer. A billing company may originate its own fee debits and send its clients’ customer debits.

The practical consequence is about what the bank registers and measures. Registration follows the sender role: the registration FAQ tells banks to register a business “based on its own customer relationship,” and if the business is a sender with another bank, “the other ODFI should register it” (Nacha, Third-Party Sender Registration). Return monitoring follows the originators: the sender’s own fee debits are one originator among many, and each of its clients is another.

How to tell if a customer is a third party sender: start with the files

Ask the customer, but check the files first, because the files change before the paperwork does. A business that signs a new client today will put that client’s debits into tomorrow’s file; nobody updates the onboarding form. The six signs in the figure above all come from what the bank already holds: the company name and Company Identification in each batch header, the addenda, the receivers, the entry types and volumes, and the settlement flows.

Regulators have pointed at the same signs for years. FinCEN’s 2012 advisory on processors warns that “Payment Processors engaged in suspicious activity often maintain accounts at more than one financial institution” (FinCEN FIN-2012-A010). The OCC tells banks to be alert to senders using more than one bank, because “some third-party senders may use multiple banks to process their transactions because they had their contract with another bank terminated” (OCC Bulletin 2006-39). Nacha’s Terminated Originator Database exists for that check, though it is a prompt for judgement, not a bar: inclusion “does not mean an Originator or Third-Party Sender is prohibited from working with another ODFI” (Nacha Risk Management Portal).

In the sample, the signal that settled it was a Company Identification, the ten-character identifier the originating bank assigns to name the originator in each batch (what an ACH company ID means). QuickRun Billing sent web and telephone debits under its own identifier, 9004218833, in every batch, its addenda named 37 businesses, and its own description of itself was recurring billing for small service businesses. It looked, on a quick read, like one more originator in the files. It was a sender sending through another sender.

What if an originator is processing payments for others?

Then it is acting as a third-party sender for those entries, and the bank has to treat it as one: registration, a sender agreement, the sender’s own risk assessment and audit, and due diligence on its clients. Leaving it on an originator agreement does not change its role; it only means the bank lacks the clauses a sender agreement would carry, such as the disclosure of nested senders, the bank’s access to originators’ files and the list of approved and disallowed originators.

The sequence that tends to work starts with a hold rather than a termination, because most such customers are legitimate businesses that grew into a new role. Ask the customer to confirm the arrangement and supply its client list. Register it within the clock. Re-paper it on a sender agreement with an exposure limit set on its creditworthiness against its clients’ volume. Screen and evidence the clients, and measure each one’s returns separately. Where the clients are the problem, the bank can require the sender to stop processing for one of them; the FDIC lists exactly that option for processors. Where the customer refuses to disclose, the question is no longer classification.

How long to register a third party sender once found? Ten days

Ten days from the day the bank determines it, or 30 days from the first entry when the bank knew from the start. The registration FAQ is direct: “If an ODFI determines that an unregistered customer is actually a Third-Party Sender, the ODFI has 10 days to register the Third-Party Sender” (Nacha). When the newly discovered sender sits behind another sender, the 2022 roles rule sets the later of the two dates for flagging it, as worked through in nested third party sender examples.

Missing the clock is a matter for Nacha’s enforcement process, not an automatic penalty. The 2017 rule added a bank’s failure to register its senders to the list of Class 2 rules violations, and the FAQ explains how it proceeds: investigation begins with the bank, which can respond and show it has fixed the problem, and “There are no automatic fines. Fines, if at all, occur at the end of the enforcement process.” The larger cost is elsewhere: every day an undeclared sender sends, the bank warrants entries for clients nobody has screened.

What Third-Party Sender Due Diligence does when a customer changes role

The solution watches for the change rather than waiting for the customer to report it. Between reviews, its change watcher compares each morning’s files and rosters with the last review and opens an alert for a new originator, a new entry type, a volume outside the band, a rate over a level or a new unmatched Company Identification, each with its evidence and its clock. In the sample bank’s queue, that looks like Ardenwood Payment Technologies sending telephone debits first seen on October 17, Bellcourt Subscription Billing’s volume up 214% in a month, and Westvale Debt Recovery with 18 originators added since its last review.

Change alerts across 34 senders, each with an owner and a clock

What the solution does not do is reclassify the customer. It raises the question with the files, the roster search and the customer’s own description of its business; the analyst decides whether the customer is a sender, the BSA officer confirms any screening, and the committee decides what happens to the entries. Below the confidence floor in the bank’s settings, a suspicion stays a question. To see a review from the roster to the signed decision, start from Third-Party Sender Due Diligence.

Questions people ask

What is an example of a third-party sender?

A payroll processor that holds the ACH agreement with the bank and sends wage credits for employers is the standard example; the employers are the originators. A property manager collecting homeowners’ dues for an association, a tuition processor collecting for a university and a billing company collecting for gyms are the same shape.

Is a merchant processor an originator or a third-party sender?

For ACH debits it initiates on behalf of merchants whose customers owe them, it is a sender if it holds the origination agreement with the bank. For its own fee debits, it is an originator. The obligation behind each set of entries decides.

Does a third-party sender need a different agreement from an originator?

Yes. A sender’s origination agreement covers obligations an originator’s does not, including the sender’s warranties, its duty to disclose other senders, whether nested senders are allowed and the bank’s access to its originators’ files. Leaving a sender on an originator agreement leaves those terms out.

What happens if a bank fails to register a third-party sender?

Nacha treats it as a Class 2 rules violation, handled through its enforcement process: the bank is contacted first and can respond, and there are no automatic fines. The supervisory risk is separate, because an unregistered sender is usually also an undiligenced one.

Can the bank rely on the customer to say it has become a sender?

The rules oblige a sender to give the bank registration information and to disclose other senders it transmits for, but the change of role itself tends to show in the bank’s ACH files first. A daily comparison of what is sent with what is declared finds it whether or not the customer speaks up.