A sample third party sender risk assessment has two parts, because two parties owe one. The sender owes Nacha its own ACH risk assessment, covering operational, return, credit, fraud, compliance and reputational risk in whatever format suits its business, and a risk management program built on it. The bank owes its supervisors an assessment of the risk the sender poses to the bank, which reaches the originators behind the sender. Templates for both are easy to find; what is hard to know is whether the review built on them would catch a real problem. The test on this page answers that: take one sender’s roster, files, agreement and audit, plant six known problems, and count what each method of review finds. A sample screened by hand finds what it happens to sample. Botminds’ Third-Party Sender Due Diligence is designed to find all six, and a bank evaluating it, or any other tool, should run exactly this test on its own data before believing it.
The planted problems mirror the fictional sample review in the solution: Tessaly Community Bank, its sender Larkfield Payroll Services and 1,240 originators. The rules are quoted from Nacha’s public pages; the sampling odds are our arithmetic.
Six planted problems: how many each review method can expect to find
What should a third party sender risk assessment include?
It should cover the risks of the ACH activity the sender actually performs, and Nacha names the broad categories. Its 2022 reminder to senders says the assessment “should be risk based and cover the ACH activities that the Third-Party Sender is involved in,” and should broadly include operational, return, credit, fraud, compliance and reputational risk (Nacha, November 2022). It then points senders to the obligations a bank carries, as a guide to what a sender carries in its place.
What a third-party sender’s own risk assessment should address
- Customer due diligence on its originators
Who they are, what they sell, how they obtain authorizations, and how the sender verifies it.
- Exposure limits for its originators, set and enforced
The sender must do for its originators what the bank does for the sender.
- Auditing and testing of originators’ authorization processes and quality
Especially for web and telephone debits, where authorization is hardest to evidence.
- Monitoring of forward and return volumes, dollars and rates
Per originator, against Nacha’s threshold and levels and the sender’s own limits.
- Data security: access controls, authentication, authorization, encryption
Senders above 2 million ACH transactions a year must also render stored account data unreadable.
- Entry-type requirements and warranties
The specific rules for each SEC code the sender transmits, including any it has added since the last assessment.
- Nested senders, if any
Whether it allows them, the agreements it holds with them, and how it knows their originators.
- The risk management program it implemented as a result
An assessment with no program behind it does not meet the rule.
Nacha’s risk advisory group describes the purpose in one line: the assessment “requires a TPS to think through an organization’s activities, identify the risks posed to the organization, and implement a risk management program that reduces ACH risks to a level accepted by the organization and its partners” (Nacha RMAG, November 2021). The last three words matter to the bank. The bank is one of the partners, and its acceptance is the committee’s decision.
Does Nacha prescribe a risk assessment format? No, deliberately
No. “Like the ACH Rules Compliance Audit, a specific format for the risk assessment is not prescribed,” Nacha tells senders (Nacha), and the rule page explains why: “Risk assessments for TPS should not be one-size-fits-all” (Nacha, Third-Party Sender Roles and Responsibilities). A prescribed list, it says, would over-prescribe controls for some senders and miss the risks of others.
For a bank reading one, the absence of a format moves the test from completeness to fit. A payroll processor sending PPD credits and a subscription biller sending web debits should produce different documents. A risk assessment that reads the same for both, or that has not changed since the sender added a new entry type, has not been done for the business in front of you. In the sample, the sender’s February 2026 risk assessment did not address nested senders, while a nested sender had been sending through it since March 4.
Can a third party sender rely on another sender’s risk assessment?
No. The 2022 rule is explicit: “The obligation to perform a Risk Assessment, as well as the required Rules Compliance audit, cannot be passed onto another party; i.e., each participant will conduct or have conducted its own” (Nacha). That applies down a nested chain: a sender behind a sender needs its own assessment, not its host’s. It may hire help; Nacha notes that payments associations offer audit and risk assessment services, but the document must be about the sender that owns it.
The bank is not obliged by the Nacha rules to review its senders’ assessments, though it may set a policy that it will, as the list of third party sender requirements sets out. In practice the sender’s assessment is one input to the bank’s own, which is a separate document with a separate purpose.
The bank’s risk assessment of a sender is a different document
Nacha’s risk advisory group draws the line: “The risk assessment required by the Nacha Rules is different than the risk assessment required by the regulator(s) of each ODFI to assess the risk posed to the ODFI by their TPS customers” (Nacha RMAG). The bank’s version decides the sender’s risk tier, its review cycle, its exposure limit and the conditions on approval. The OCC’s principle for originators, that the first review goes as deep as the originator’s risk requires (quoted in the ACH originator risk assessment template), applies to senders and the merchants behind them (OCC Bulletin 2006-39).
A sample bank-side risk assessment of one third-party sender
| Factor | What to establish | In the fictional sample review |
|---|---|---|
| Sender profile | Business, years originating, other banks, terminations | Payroll and billing processor; originating through the bank since 2019 |
| Originator mix | Industries and entry types, by count and volume | 1,240 originators in six groups; 341 send web or telephone debits |
| Returns | Unauthorized, administrative and overall, for the sender and each originator | Sender 0.18% unauthorized; three originators over 0.5% |
| Exposure and creditworthiness | Limit, peak use, and the sender’s capacity to back its warranties against its originators | Limit $9.5 million a day; peak $6.8 million; no breaches |
| Nesting | Whether the agreement allows it, and whether the files show it | Agreement requires the bank’s consent; one undeclared nested sender found |
| Due diligence evidence | Screening and documents for every originator, not a sample | 1,240 screened and cleared by the BSA officer; one ownership certification missing |
| The sender’s own audit and assessment | Date, period, entry types and originators in scope, findings | Audit of November 22, 2025 covered PPD and CCD only |
| Risk tier and cycle | The bank’s conclusion, with its reason | High tier, 12-month review cycle |
Nacha’s advisory group also expects the bank to decide, by policy, how far down the risk label reaches: “Based on the ODFI’s policy, the TPS or any or all of the Originators serviced by the TPS may be defined as high risk and may require extended due diligence procedures prior to onboarding” (Nacha RMAG, 2021). That is only workable if the bank can see each originator, which brings the question back to how the review is done.
How to test third party sender due diligence: plant six problems
Take a copy of one real sender’s roster, a period of its ACH files, its registration, its agreement and its last audit. Plant six problems whose answers you know, run the review the way it is actually run, and count. The six below are the kinds of finding that matter most in a sender review, and they are the six findings of the fictional sample review.
The six planted problems, and what finding each one takes
| Plant | How to plant it | What finding it takes |
|---|---|---|
| 1. A nested sender | Add a Company Identification that sends web and telephone debits, with addenda naming other businesses, and no roster row | Comparing every Company Identification in the files with the roster |
| 2. An originator at about 1.1% unauthorized | Add unauthorized returns to one web-debit originator, with an administrative rate over 3% | A rate per originator from the bank’s own files |
| 3. An originator at about 0.7% | Add returns to a second originator, mostly R10 and R07 | The same, against the threshold |
| 4. An originator at about 0.6% | Add returns to a third, including some R11 | The same; R11 counts as unauthorized |
| 5. A missing ownership certification | Remove one originator’s beneficial ownership certification from the evidence index | Checking the evidence for every row |
| 6. An audit scope gap | Leave the audit dated and complete, but covering only PPD and CCD | Reading scope against the entry types the sender actually sends |
Two design choices keep the test honest. The planted problems must be ones the review is supposed to catch under the bank’s own policy, so the result measures the process and not the planter’s imagination. And the people running the review must not know which rows were changed. The point is to measure what the review finds in the ordinary course, not what a forewarned reviewer can find.
What a sample screened by hand finds, in numbers
Very little, and the reason is structural rather than a matter of effort. A hand review that screens and evidences a sample of 60 rows out of 1,240 draws any given row with a probability of 4.8%. If it reads return rates from a sender-level report, it cannot see plants 2 to 4 at all, because the sender’s rate stays inside the threshold. If it checks the audit for a date, it passes plant 6. And it can never find plant 1, because a nested sender is not a row on the roster it is sampling. Its expected score is 0.05 of 6: one chance in twenty of finding the missing certification.
Improving the hand review helps, within limits. Pulling each sampled row’s own rates means plants 2 to 5 are each found if drawn, so the expected haul rises to about 0.19, and the chance that at least one of those four rows is drawn is 18%. Reading the audit’s scope finds plant 6 every time. That gets to about 1.2 of 6, still without the nested sender, the arrangement the FDIC says carries significantly elevated risk. Doubling the sample to 124 rows, a tenth of the roster, raises the chance of drawing at least one planted row to 34%.
What finding all six looks like: five originators and one sender-level gap
Method C, every row read, every originator’s rates computed from the bank’s files, the files compared with the roster and the audit’s scope read against the entry types actually sent, is designed to find all six. That is what the solution’s agents do in the sample review, which took 1 minute 48 seconds for 12 steps. It is a design target, and a buyer should treat it as one until the test has been run on the bank’s own data.
What a review costs in days, by hand and with agents
The test measures what a method finds; the calendar measures what it costs. Botminds estimates the working days of one annual review for a sender with about 1,200 originators as below. The figures are Botminds’ estimate, from the steps the review involves, not a measured result at any bank.
Where one annual sender review’s working days go, by hand and with agents
What software helps with third party sender risk assessment, and what to look for
Look for software that reads what a person would read, every time, and leaves the decisions alone. The buyer’s questions that follow are the ones the six-plant test answers directly.
Does it read the whole roster in the shape the sender sends it? A tool that needs the roster reformatted into its template will spend the first week of every review waiting for a spreadsheet. Does it measure every originator from your own files? Rates from the sender’s reports measure what the sender chooses to show. Does it compare the files with the roster? Without that comparison, plant 1 is invisible. Does it read an audit’s scope, not just its date? Does every finding open the record it came from? An examiner will ask. Who clears a screening hit, approves a sender or suspends entries? If the answer is the software, the bank has handed away a decision its supervisors expect a person to make. And can you set the levels, cycles and clocks yourself, with every change recorded?
The scope gap, read from the audit rather than assumed from its date
Where Third-Party Sender Due Diligence fits, and where it does not
The solution fits the bank’s side: it prepares the bank’s review of each sender with every originator screened, evidenced and measured, reads the sender’s own risk assessment and audit for date, period and scope, finds a sender behind the sender in the files, and drafts findings with reason codes for the analyst, the BSA officer and the committee. Its levels, cycles and confidence floor are the bank’s settings.
It does not write the sender’s risk assessment for it, which Nacha requires the sender to own; it does not set the bank’s risk appetite or tiering policy; and it does not decide. A bank that wants to know whether it finds what it claims should plant the six problems in a copy of one sender’s data and watch. To start from the sample review, see Third-Party Sender Due Diligence; for the evidence an examiner then asks for, see third party sender ACH audit workbook.
Questions people ask
When did third-party senders have to complete their first risk assessment?
The requirement was made explicit by Nacha’s rule effective September 30, 2022, with a six-month grace period. Senders that had never conducted one had until March 31, 2023.
Is the third-party sender risk assessment the same as the fraud risk assessment under Nacha’s 2026 rules?
No. The 2022 rule requires an assessment of all the sender’s ACH risks. The 2026 fraud monitoring rules require risk-based processes to identify fraudulent entries and an annual review of them; a sender can draw on its assessment for that work, but the obligations are separate.
How often should a bank review a third-party sender?
Nacha requires the bank to review exposure limits periodically but sets no review cycle; that belongs to the bank’s policy, usually by risk tier. The sample bank reviews high-tier senders every 12 months, medium every 18 and low every 24, and watches the files daily between reviews.
What is a third-party payment processor risk assessment?
It is the bank’s assessment of a processor customer under the banking agencies’ guidance, covering the processor, its owners and its merchants, its returns and complaints, and the bank’s controls. For a processor that sends ACH, it is the same document as the bank’s assessment of a third-party sender.
Should a bank test its own due diligence process?
Yes, if it wants to know what the process finds rather than what it covers. Planting known problems in a copy of real data, with reviewers who do not know which rows were changed, is the most direct test, and it applies equally to a manual process and to any tool.