Third party payment processors: FFIEC, FDIC and FinCEN in plain words

Third party payment processors are covered in the FFIEC’s BSA/AML Examination Manual as bank customers that process payments for merchants the bank has no relationship with, and the manual tells examiners to assess whether the bank can manage that risk and monitor it. In plain words, the FFIEC, the FDIC, the OCC and FinCEN expect the same five things: a processor-approval program that goes beyond credit, background checks on the processor, its owners and its merchants, monitoring of returns of every kind and of complaints, periodic audits of the relationship, and suspicious activity reports where warranted. None of it can be delegated to the processor. The hard part is scale: a processor may send for hundreds or thousands of merchants, and the bank meets none of them. Botminds’ Third-Party Sender Due Diligence does the reading that guidance assumes: every originator behind a sender screened, evidenced and measured from the bank’s own files, with a person deciding.

The sample review on this page is fictional: Tessaly Community Bank and its sender Larkfield Payroll Services, as they run through the solution. The guidance is quoted from each agency’s own page, in its current revision.

What the FFIEC manual says about third party payment processors

The FFIEC section opens with its examination objective: “Assess the adequacy of the bank’s systems to manage the risks associated with its relationships with third-party payment processors, and management’s ability to implement effective monitoring and reporting systems” (FFIEC BSA/AML Examination Manual, Third-Party Payment Processors). Everything after is the content of that adequacy.

Three lines carry most of the weight. The first explains why the bank carries the risk: “Processors generally are not subject to BSA/AML regulatory requirements.” The second sets the minimum: “If a bank has not implemented an adequate processor-approval program that goes beyond credit risk management, it could be vulnerable to processing illicit or OFAC-sanctioned transactions.” The third is about returns, and it is the one most programs underweight: monitoring “should not be limited to only unauthorized transactions, but include returns for other reasons that may warrant further review,” such as insufficient funds or administrative returns.

The manual also names a specific evasion: transactions should be watched for “patterns that may be indicative of attempts to evade NACHA limitations on returned entries.” Its example is a resubmission “under a different name or for slightly modified dollar amounts,” which it calls a violation of the Nacha rules. That is a pattern visible only in the entries themselves, at the level of each merchant, not in a processor’s monthly summary.

Third party payment processor regulation: who is regulated, and how

In most cases the bank is regulated, not the processor. The FFIEC’s line that processors are generally outside the BSA’s program requirements is the reason the agencies address their guidance to banks, and the reason FinCEN’s advisory tells banks to check whether a processor has “obtained all necessary state licenses, registrations, and approvals” (FinCEN). The processor is bound in other ways: by the Nacha Operating Rules through its origination agreement, where it acts as a third-party sender, and by consumer-protection law, which the FDIC invokes through the unfair or deceptive acts provisions of the Federal Trade Commission Act.

The ACH layer adds the obligations the regulators assume. A processor that holds the origination agreement with the bank is, in Nacha’s terms, a third-party sender, with its own registration, risk assessment and annual audit, as set out in third party sender requirements. The FFIEC’s IT examination procedures then ask whether the bank has “established limits and monitoring of the third-party sender’s creditworthiness relative to its underlying originators and the nature and type of ACH activity that it warrants” (FFIEC IT Handbook, Retail Payment Systems, Appendix A). That is one examination question that needs two kinds of data: the sender’s financial condition and every originator’s activity.

Is FDIC payment processor guidance still in effect? Yes, revised in February 2026

Yes. FIL-3-2012 remains on the FDIC’s site as current guidance, with a revision note at the top: “On 02/03/2026, this FIL and attachment were revised to remove references to reputation risk” (FDIC FIL-3-2012). The OCC made the same change a year earlier, striking the reputation-risk references from its processor bulletin as of March 20, 2025 (OCC Bulletin 2008-12) and from its 2006 ACH bulletin on the same date, which otherwise stands, as how examiners apply OCC Bulletin 2006-39 sets out.

The practical reading is that the 2025–26 changes took out a ground for criticism that was hard to measure, and left every measurable expectation in place. A bank can no longer be told to exit a processor because of how the relationship might look. It can still be told its due diligence on the processor’s merchants was inadequate, its return monitoring stopped at the processor, or it relied on the processor’s word. Whether processors are, in themselves, high risk, and what the enforcement record says about getting this wrong, is the subject of are third party payment processors high risk.

Can a bank rely on the payment processor’s due diligence?

Not solely. The FDIC says it in one sentence that survived the 2026 revision intact:

Financial institutions are reminded that they cannot rely solely on due diligence performed by the payment processor.

FDIC, FIL-3-2012, Payment Processor Relationships, as revised February 2026

The guidance goes on to say what that means in practice. Banks should require processors to provide information on their merchant clients, “such as the merchant’s name, principal business activity, location, and sales techniques,” and the same for any sub-merchants. They should verify, directly or through the processor, that each merchant is operating a legitimate business. And the less the bank verifies itself, the more it needs an independent check: “The more the financial institution relies on the payment processor for due diligence and monitoring of its merchant client without direct financial institution involvement and verification, the more important it is to have an independent review” (FDIC).

For a sender with 1,240 originators, “not solely” is a volume problem. A review that screens a sample of the roster by hand and takes the rest on the sender’s word is relying on the processor for most of the book. In the sample, the solution screened all 1,240 names and checked each one’s formation and beneficial ownership evidence; one certification was missing, for Harbor Lane Dental Partners, and the BSA officer confirmed the screening of every row.

1,240 originators, filtered to the five that need a person

What red flags does FinCEN list for payment processors?

FinCEN’s 2012 advisory lists the indicators law enforcement reported, and they still read as a monitoring specification. Each is a pattern across the processor’s merchants that a processor-level summary averages away.

The consolidation-account warning is the one most specific to processors: “Consolidation accounts can be used by Payment Processors to conceal high return or chargeback rates from originating financial institutions and regulators” (FinCEN). The last flag, a rate that looks acceptable in aggregate and is high for individual originators, is worked through with numbers in third party sender ACH risk one layer down.

Third party payment processors and AML: what stays with the BSA officer

The suspicious activity decision stays with the BSA officer, and the guidance shapes how it is filed. FinCEN asks that, when reporting, banks “include the term ‘Payment Processor’ in both the narrative portion and the subject occupation portions of the SAR” (FinCEN), and the FFIEC manual repeats the request. The FDIC lists filing a report among the actions to take when a processor or merchant is involved in fraud.

That has a design consequence for any review of a sender. Information that may become a report is confidential, and it should not travel through a document the sender sees or a committee packet that circulates widely. In the sample solution, report-filing matters are explicitly outside the review: they stay in the financial-crime case file with the BSA officer, they never appear in the findings, the committee packet or the request to the sender, and only the BSA officer can add one to the examiner’s evidence pack. The OCC’s 2006 guidance adds a monitoring point that sits with the same officer: for banks originating for non-customers through third parties, suspicious activity monitoring should include ACH detail when batches are returned or separated (OCC Bulletin 2006-39).

What examiners test on processors that send ACH

Examiners test two things the guidance asks for and one it implies. The OCC put the first two in a sentence in 2008: “Banks have two distinct areas of responsibility to control these risks. The first is due diligence and underwriting, and the second is monitoring these high-risk accounts for high levels of unauthorized returns and for suspicious or unusual patterns of activity” (OCC Bulletin 2008-12). The third is in the FFIEC procedures quoted above: the sender’s creditworthiness set against the originators beneath it.

All three need evidence per originator. Due diligence on a processor’s merchants is a roster read in full and each name verified. Monitoring for unauthorized returns is a rate per originator, with the codes behind it, because a processor’s blended rate cannot show a merchant over the line. And an exposure limit on the sender is only “relative to its underlying originators” if someone knows what those originators send. In the sample program the bank runs 34 senders with 18,600 originators behind them; the program view shows nine originators over the unauthorized threshold and three nested senders found, each figure opening the list behind it.

The processor program in four numbers, each opening its list

Where Third-Party Sender Due Diligence fits the guidance, and where it does not

The solution covers the ACH side of the guidance: registration, the agreement, the roster, each originator’s screening and evidence, each originator’s returns, the sender’s audit and risk assessment, and the decision and remediation that follow. It reads the bank’s own files rather than the processor’s summaries, which is the practical meaning of not relying solely on the processor.

It does not cover card or remotely created check processing, which the FDIC and FinCEN texts also address; it does not run the bank’s transaction monitoring or decide on reports, which stay with the BSA officer; and it does not set the bank’s policy, which the guidance places with the board. Its levels, cycles and clocks are the bank’s settings, versioned, with every change recorded. To see a review end to end, start from Third-Party Sender Due Diligence.

Questions people ask

Where is the FFIEC guidance on third-party payment processors?

In the FFIEC BSA/AML Examination Manual, in the section on third-party payment processors among the risks associated with money laundering and terrorist financing. The FFIEC IT Examination Handbook’s Retail Payment Systems booklet covers the ACH side, including third-party senders, in its examination procedures.

Are third-party payment processors subject to the Bank Secrecy Act?

Generally not to its program requirements, as the FFIEC manual notes, which is why the agencies place the expectations on the banks that serve processors. Some processors may need state licences or registrations, which FinCEN tells banks to check.

What did FDIC FIL-41-2014 change?

It removed the lists of example merchant categories from the FDIC’s processor guidance, because they had been read as prohibitions. It said a bank that manages its customer relationships properly may serve any lawful customer, processors included, and that a bank following the guidance will not be criticized for processor relationships.

What information should a bank get about a processor’s merchants?

The FDIC lists the merchant’s name, principal business activity, location and sales techniques, and the same for sub-merchants, with verification that each operates a legitimate business. The FFIEC manual adds transaction volume and asks banks to compare merchants against public record and fraud databases.

Should return monitoring for processors cover only unauthorized returns?

No. The FFIEC manual says monitoring should include returns for other reasons, such as unusually high insufficient-funds or administrative returns, and watch for resubmissions under a different name or slightly changed amounts that evade Nacha’s limits.