Third party sender ACH risk lives one layer down

Third party sender ACH risk sits with the originators behind the sender, not with the sender itself. A third-party sender is a payment processor that originates ACH through the bank for its own clients, and its return rate is simply their returns added up and divided by their entries. That average can be comfortably inside Nacha’s 0.5% unauthorized threshold while individual originators run two or three times over it, because the big, quiet books dilute the small, bad ones. FinCEN warned banks of exactly this in 2012, and Nacha’s own risk advisory group tells banks to monitor returns for the sender and for each originator. Botminds’ Third-Party Sender Due Diligence measures every originator’s unauthorized, administrative and overall rates from the bank’s own ACH files, against the threshold and levels, and keeps the return codes behind each.

The figures on this page come from a fictional sample: Tessaly Community Bank, its sender Larkfield Payroll Services and Larkfield’s 1,240 originators, measured over a rolling 60 days as they run through the solution. The rules are quoted from Nacha’s public pages.

What is a third party sender in ACH, and where does its risk sit?

A third-party sender is an intermediary that holds the ACH origination agreement with the bank and sends entries for originators that have no agreement with the bank. Its risk is the sum of theirs. When a gym’s members dispute their dues, or a web merchant debits accounts it was never authorized to touch, the returns come back to the bank under the sender’s routing, and the bank, which warranted every entry, carries the loss if the sender cannot.

That is why the guidance points one layer down. Nacha’s Risk Management Advisory Group lists among its sound practices: “Monitor returns at both the TPS level and for each Originator customer of the TPS. This ensures the TPS and each Originator is compliant—not only with the ODFI’s policy, but with Nacha Rules regarding return rates/levels for ACH returns” (Nacha RMAG, 2021). The OCC’s ACH guidance lists, among the items management should report to the board, return rates summarised by originator and, where the bank has them, by third-party sender (OCC Bulletin 2006-39). Neither says the sender’s own rate is enough.

Can a third party sender be under 0.5% with originators over it? The arithmetic

Yes, easily, and a regulator described it before most banks measured it. FinCEN’s 2012 advisory on payment processors put the problem in one sentence:

Payment processors abused by criminals may show an acceptable rate (i.e. an average within normal parameters for the payment system involved) of returned items due to unauthorized transactions, calculated as a percentage of the processor’s total transaction volume, but a much higher rate of returned items when the ratio is calculated on the traffic volume of individual originators.

FinCEN, Advisory FIN-2012-A010, Risk Associated with Third-Party Payment Processors

The sample sender shows the arithmetic at ordinary scale. Larkfield’s payroll and staffing clients send hundreds of thousands of payroll credits and a large book of debits that almost never come back unauthorized. Three web-debit clients account for a small share of debits and a large share of the disputes. Divided together, the result is 0.18%.

Step 7 is the number to take to a committee. With its present volume, Larkfield could absorb a single originator returning nearly 30% of its debits as unauthorized without its own rate reaching 0.5%. A sender-level alert set at the threshold would never fire. An originator-level measure fires at the 11th unauthorized return in Fennimore’s window.

How are return rates measured for a third party sender?

The same way as for any originator, and Nacha’s rules name both parties. The unauthorized rate counts debits returned with codes R05, R07, R10, R11, R29 and R51 over the preceding 60 days or two calendar months, divided by debits originated over the same period or by the debits in the files where the returned entries were first sent (Nacha, Calculate Unauthorized Return Rate). The administrative rate uses R02, R03 and R04; the overall rate uses every debit return, and Nacha allows RCK entries and their returns to be left out of both sides (Nacha, Calculate Administrative or Overall Return Rate). The two methods, worked on one originator, are set out in ACH return rate calculation.

For a sender, three choices decide whether the measure is useful. The first is the unit: each originator, identified by its Company Identification and name, not the sender’s total. The second is the source: the bank’s own origination files and return entries, not a summary the sender sends. A sender that controls the report controls what the bank sees, and FinCEN’s warning about consolidation accounts used “to conceal high return or chargeback rates” is the same problem in a different channel. The third is the window: a rolling 60 days matches Nacha’s method, and the sample bank can switch to 30 or 90 to see a trend.

Return rates in Third-Party Sender Due Diligence, originator by originator

What is the unauthorized return rate threshold, and how do the levels differ?

The unauthorized threshold is 0.5%, and it is different in kind from the two other levels. Nacha cut it from 1.0% in a rule effective September 18, 2015, and it applies to an originator or a third-party sender. The administrative level of 3.0% and the overall level of 15.0% open a preliminary inquiry rather than a rules violation: the review “involves eight steps, and includes an opportunity for Nacha and an industry review panel to review an Originator’s ACH activity prior to any decision to require a reduction in a return rate” (Nacha, ACH Network Risk and Enforcement Topics). Why 0.5% was set where it was is covered in ACH unauthorized return rate threshold.

The levels still say something about the originators that cross them. Nacha set the administrative level at more than nine times the 2013 network average for account-data returns of 0.33%, and the overall level at roughly ten and a half times the overall average of 1.42%, so an originator above either is well outside normal. In the sample, Fennimore Media Group was over two at once: 1.12% unauthorized and 4.29% administrative, on web and telephone debits, a combination that usually means bad account data and bad authorizations arriving together.

Why web and telephone debits carry most of a sender’s return risk

The originators over the line in a sender’s book are rarely its payroll clients. They are the ones debiting consumers on authorizations taken online or by phone, and the OCC’s ACH guidance singles those out: banks in higher-risk ACH activity should check from time to time that each entry carries the right SEC code, because a wrong code can hide fraud (a point what an ACH fraud filter cannot see takes further), and “transactions with higher-risk elements, such as TEL and WEB, should be monitored to ensure that they are within the institution’s risk tolerance” (OCC Bulletin 2006-39).

The sample sender follows the pattern. Its 612 staffing and payroll clients, sending PPD and CCD, make up half its originators and most of its volume. Its 341 originators sending web or telephone debits sit in four smaller industry groups, and all three originators over the threshold are among them. The same 341 were outside the scope of the sender’s last Rules Compliance Audit, which covered PPD and CCD only: the part of the book carrying the returns was the part nobody had audited. A review that measures by entry type as well as by originator sees both problems in the same place.

ACH return rate by originator: what the sender’s average was hiding

Measured one layer down, the sample sender’s book separates into three kinds of originator. Most are quiet, like the staffing and payroll clients whose debits rarely come back. A handful sit just under the line, such as Halliwell Digital Press at 0.45% and Brackenhill Athletic Clubs at 0.42%. And three are over it.

The return codes say what kind of problem each is. Fennimore’s 24 unauthorized returns were 19 R10, receivers saying they do not know the originator or never authorized it, and 5 R05. Fernhill’s 27 were 22 R10 and 5 R07, members revoking their authorizations for dues. Hallowell’s 39 were 31 R10 and 8 R11, which since April 2020 marks an error in an otherwise authorized payment: R11 conveys “error” rather than “no authorization,” and the originator may correct the error and send a new entry without a new authorization (Nacha, Differentiating Unauthorized Return Reasons). The same 0.6% means a different conversation with each, and the codes are what make the conversation specific. The sender’s total carries none of it.

What happens when an originator exceeds the return rate levels?

The bank, and through it the sender, must act. Nacha’s rule page describes the consequence plainly: “Originators and Third-Party Senders with unauthorized debit return rates above the new threshold may be required by their ODFIs, and, in the case of some Originators, their Third-Party Senders, to take action to reduce their return rate” (Nacha). For an originator behind a sender, that means a plan agreed through the sender, with dates and evidence, and a decision by the bank about what happens if it fails.

In the sample, the review writer drafted a recommendation and a reason code for each of the three: approve with conditions, a 60-day plan for all three, a sample of web authorizations for Fennimore and monthly rate reporting for Fernhill. The analyst then added a monthly unauthorized, administrative and overall rate report from all three, through the sender, until December 19, owned by the partner oversight manager. The conditions go to the committee with the review. No agent can approve them; the chair does, with a reason code from the bank’s own list.

First Bank of Delaware: one corner of a book, far over the line

The enforcement record shows how far one corner can drift when nobody measures it. FinCEN’s 2012 assessment against First Bank of Delaware found that merchants using the bank’s remotely created check service “were responsible for unauthorized return rates of up to 8%, which was over 250 times the average ACH rate for 2010 of 0.03%” (FinCEN, Assessment of Civil Money Penalty, First Bank of Delaware). Those were check returns compared with the ACH average, but the lesson carries: the activity flowed through a handful of processors, and the bank’s monitoring did not reach the merchants behind them.

The same assessment records what happened when the bank did see it: “Two merchant clients of one RCC service customer had unauthorized return rates of 5% for five and six month periods,” and they were not terminated, against the bank’s own policy. Measuring each originator is the first half of the control. The second is a decision, by a named person with a reason, when one crosses the line. What the case cost the bank is in are third party payment processors high risk.

Measuring every originator: what Third-Party Sender Due Diligence keeps

The solution’s returns agent measures each originator’s unauthorized, administrative and overall rates from the bank’s own origination files and return entries over the configured window, compares each with the level in the bank’s settings, and keeps the return codes behind every rate. It is read-only on the payments platform: it never suspends or releases entries and never adjusts a rate. The levels are the bank’s: 0.5%, 3% and 15% by default, with tighter early-warning options of 0.4% or 0.3%, 2.5% or 2%, and 10% or 8%.

The threshold and levels are the bank’s settings, versioned

Between reviews, a separate watcher compares each morning’s files with the last review and opens an alert for a rate over a level, with its evidence and a five-business-day clock in the sample bank’s settings. In the sample program, that queue held Brayford Tools & Supply at 0.58% under another sender, over the threshold for a second window. A nested sender in the files is a different finding with its own rules, covered in nested third party sender examples. To see the rates, the codes and the decisions together, start from Third-Party Sender Due Diligence.

Questions people ask

Does Nacha measure return rates for the third-party sender or for each originator?

The rules apply the threshold and levels to an originator or a third-party sender, and Nacha’s risk advisory group recommends that banks monitor both, at the sender level and for each originator behind it. Measuring only the sender lets one originator run far over the line inside a healthy average.

Which return codes count as unauthorized?

R05, R07, R10, R11, R29 and R51, according to Nacha’s calculation guide. R11 has counted toward the unauthorized rate since April 1, 2020; the administrative rate counts R02, R03 and R04, and the overall rate counts every debit return.

Should the bank rely on the sender’s own return reports?

Not alone. The bank holds the origination files and the returns, so it can compute each originator’s rate itself. FinCEN has warned that processors can route returns through consolidation accounts to conceal high return rates, which a report produced by the processor would not show.

Is a 0.5% unauthorized rate normal?

No. When Nacha set the threshold it was more than sixteen times the 2013 network average for unauthorized debits of 0.03%, so an originator near 0.5% is already far outside ordinary experience. A bank can set an earlier warning below it, as the sample bank’s settings allow at 0.4% or 0.3%.

How often should originator return rates be measured?

Nacha’s method uses the preceding 60 days or two calendar months, but nothing stops a bank from measuring daily on a rolling window. A rate measured once a year at the annual review can sit over the threshold for months before anyone sees it.