Third party sender requirements come from Nacha’s Operating Rules and fall on two parties. The sender must work under an origination agreement with the bank, warrant its originators’ compliance, disclose any other sender it transmits for, supply registration information within two banking days of a request, conduct its own ACH risk assessment, complete its own Rules Compliance Audit by December 31 each year and, since 2026, run risk-based fraud monitoring. The bank must register the sender, flag it if it allows nested senders, keep the registration current, set and review an exposure limit, monitor returns for the sender and each originator, and do due diligence on originators it never contracts with. Most of that is evidence work, which is what Botminds’ Third-Party Sender Due Diligence does: its agents read the registration, the agreement, the roster, the files and the audit, and prepare the review. The decisions the requirements imply, to approve, condition, suspend or report, stay with the analyst, the BSA officer and the committee.
The sample review on this page is fictional: Tessaly Community Bank and its sender Larkfield Payroll Services, with 1,240 originators, as they run through the solution. The requirements are quoted from Nacha’s public rule pages; the licensed rulebook is not reproduced.
Third party sender requirements in four numbers
30days
to register a sender after its first entry; 10 days once the bank finds an unregistered one
45days
to update registration after any change, including termination
2banking days
for a sender to give the bank registration information it asks for
Dec 31
each year, the sender’s own Rules Compliance Audit, which it cannot borrow from another party
Nacha third party sender requirements: what the sender owes
A sender owes the network roughly what a bank would owe for the same entries, because it has stepped into part of the bank’s position. Nacha said as much when it made the risk assessment explicit: the obligation “extended to Third-Party Senders when the Third-Party Sender took on the role of the Originating Depository Financial Institution (ODFI), although it wasn’t expressly stated” (Nacha, November 2022). The rule pages and Nacha’s summary of third-party obligations add up to this list.
An origination agreement and its warranties. The sender signs with the bank, warrants its originators’ compliance and assumes the bank’s liabilities for its entries. Since September 30, 2022 the agreement must also say whether the sender may have nested senders, and push an agreement down to any it has. Disclosure. A sender must tell the bank about any other sender it transmits for before it does so, and supply registration information on request within two banking days. Its own risk assessment and risk management program, and its own annual Rules Compliance Audit, neither of them borrowed. Fraud monitoring: risk-based processes to identify entries initiated by fraud, from March 20, 2026 for senders with 2023 origination volume of 6 million entries or more and from June 22, 2026 for the rest (the rule date was June 19, a federal holiday) (Nacha, Fraud Monitoring Phase 1; Nacha, Third Parties). Data security: senders and service providers with over 2 million ACH transactions a year must render stored account data unreadable.
Return rates bind the sender too. Nacha’s return rules apply to an originator “or Third-Party Sender”, with the 0.5% unauthorized threshold, whose breach brings the bank’s reporting obligations and potential enforcement, and the 3% administrative and 15% overall levels, which are starting points for an inquiry rather than violations (Nacha, ACH Network Risk and Enforcement Topics). Where the rates are measured, and why the sender’s own rate is the wrong place to stop, is the subject of third party sender ACH risk one layer down.
Third party sender registration: what the bank files, and by when
Registration is the bank’s requirement, not the sender’s, and it has no exemptions. Nacha’s FAQ: “Every ODFI will be required to either register its Third-Party Senders, or state that it has no Third-Party Senders” (Nacha, Third-Party Sender Registration). The initial registration is short: the bank’s name and contact, the sender’s name and principal business location, the routing number used for its entries, and its Company Identifications.
The clocks are the part that catches banks out. Registration is due within 30 days of the first entry, or within 10 days once the bank determines that an unregistered customer is in fact a sender. “An ODFI must update registration information within 45 days following any change,” which in practice means every new Company Identification, every change of address and every termination. Since 2022, every sender that permits nested senders is flagged, on the later of the same two clocks. On a written request from Nacha after a risk event, the bank has ten banking days to supply more: the sender’s other names, tax identification, principals, the approximate number of originators it sends for and whether it sends debits, credits or both (Nacha).
Registration is also checked through the audit. The 2017 rule added an audit item verifying that the bank has registered its senders and kept the information current, so a stale registration is an audit finding before it is an enforcement matter.
Third party sender audit requirements: by December 31, and never borrowed
Every sender completes an annual Rules Compliance Audit by December 31, and since 2022 it must be its own. Nacha’s reminder to senders put the rule in one sentence: “Third-Party Senders may not rely on the risk assessments or rules compliance audits of another party that is also required to conduct a risk assessment or audit” (Nacha). That rules out leaning on the bank’s audit, or on the audit of a larger sender above it in a nested chain.
The bank’s part is narrower than many assume. Nacha samples banks each quarter for attestations through the Risk Management Portal, and a bank asked about a particular sender must attest that the sender’s audit was done (Nacha Risk Management Portal). What the bank collects to support that attestation, the full audit, a summary or the sender’s own attestation, is a policy choice. The audit’s scope is where the risk sits: in the sample, Larkfield’s audit of November 22, 2025 covered PPD and CCD entries only, while 341 of its originators send web and telephone debits. The file an examiner asks for around that audit is laid out in third party sender ACH audit workbook.
Does a third party sender need a risk assessment? Yes, its own, in no set format
Yes. The 2022 rule “Makes explicit that a Third-Party Sender, whether Nested or not, must complete a Risk Assessment of its ACH activities” and implement a risk management program based on it (Nacha, Third-Party Sender Roles and Responsibilities). Senders that had never done one had until March 31, 2023.
Two details shape what a bank asks for. Nacha prescribes no method or list of topics, though it names the broad categories a sender’s assessment will likely cover: operational, return, credit, fraud, compliance and reputational risk. And the bank is not obliged to read it: “ODFIs would not be required to review TPS Risk Assessments, but may choose to institute policies to encourage TPS compliance.” Nacha’s risk advisory group recommends that banks do so, listing among its sound practices to “Ensure the TPS has documented an assessment of their risks and has instituted the proper controls” (Nacha RMAG, 2021). What a usable one contains is covered in the sample third party sender risk assessment.
ODFI responsibilities for third party senders, beyond registration
The bank’s own list is longer than the sender’s, and most of it is continuous rather than annual. The bank must set, apply and periodically review an exposure limit for each sender, and the sender must do the same for its originators, as Nacha’s network risk staff restated in 2025 (Nacha, Why are Exposure Limits So Important?); the arithmetic of a limit is worked through in how to calculate an ACH exposure limit. It must monitor returns for its originators and senders against the threshold and levels. All ODFIs have been subject to the fraud-monitoring rule since March 20, 2026. And it must know, at a minimum, every originator whose entries it transmits, which in a sender relationship means getting that list through the sender and verifying it against the files.
The supervisory expectations sit on top. The FDIC’s processor guidance, revised in February 2026, still tells banks that the processor’s own due diligence on its merchants is not enough by itself (FDIC FIL-3-2012; read clause by clause in the FFIEC and FDIC guidance on payment processors), and Nacha’s risk advisory group recommends defining senders specifically in the bank’s risk assessment and credit risk policy, monitoring returns at the sender level and for each originator, and keeping an exit strategy for when a sender or any originator behind it deteriorates.
Each requirement, the evidence that proves it, and who decides
| Requirement | Evidence the bank keeps | Who decides what to do about it |
|---|---|---|
| Sender registered, current, nested flag set | The registration record against the Company Identifications actually sending in the files | The analyst registers or updates; the committee decides on an undeclared sender |
| Origination agreement covers nesting, warranties and access to originators’ files | The clause, quoted from the signed agreement and its amendments | The relationship owner negotiates; the committee approves an amendment |
| Sender’s own risk assessment | The document, its date and whether it covers what the sender actually does | The analyst asks for it; the committee accepts it or conditions approval |
| Sender’s own Rules Compliance Audit, by December 31 | The audit, its period, its entry types and originators in scope, and its findings | The analyst requests a scope extension; the committee decides whether a gap blocks approval |
| Every originator known and screened | The roster read in full, each name screened, each formation and ownership document on file | The BSA officer clears or escalates every potential match |
| Returns within the threshold and levels, sender and originators | Rates per originator from the bank’s own files, with the return codes behind each | The committee approves a reduction plan, a condition or a suspension |
| Exposure limit set and reviewed | Limit, peak use and breaches in the period | A second signature above the bank’s threshold |
Which third party sender requirements agents can evidence, and which only people decide
Almost every requirement above has two halves: a fact to establish and a decision to make. The facts are reading and comparison work that agents can do on every row rather than a sample. The decisions carry the bank’s accountability under the Nacha rules and its supervisors’ guidance, and they need a named person who can be asked why.
One annual review in Third-Party Sender Due Diligence: six agents prepare, three people decide
Agent
Registration agentReads the registration record and the origination agreement, lists the Company Identifications actually sending, quotes the nesting clause.
Never: Registers or amends a registration.
Agent
Roster agentReads all 1,240 roster rows in whatever shape they arrive, screens each name and checks the due diligence evidence on file.
Never: Clears or closes a screening hit.
Agent
Returns agentMeasures each originator’s unauthorized, administrative and overall rates from the bank’s own files over the configured window.
Never: Suspends or releases entries, or adjusts a rate.
Agent
Nesting agentCompares what is sent with what is declared and raises a suspected sender behind the sender with its evidence and a confidence.
Never: Concludes on its own.
Agent
Audit evidence agent and review writerRead the audit and risk assessment for date, period and scope; draft findings, each cited to its record, with a recommendation and reason code.
Never: Signs off a scope gap or approves anything.
A person decides
ACH risk analystPrepares the review: accepts, edits or dismisses each finding with a reason, and decides whether a suspected nested sender is one.
A person decides
BSA officerConfirms or rejects every screening result, and alone handles anything that may become a report.
A person decides
ACH risk committeeApproves, conditions or suspends, with a reason code and a signature; a second signature above the exposure threshold.
Twelve steps, 1 min 48 s, every value with its record
Can software approve a third party sender? No, and the rules assume a person
No. Nothing in the Nacha rules or the agencies’ guidance contemplates software making the approval, and the way the obligations are written assumes accountable people: a board-approved policy, an attestation by a registered administrator, a decision a bank must be able to explain to Nacha and to its examiner. The OCC’s 2006 guidance calls for a written agreement with each sender that sets out the “board-approved risk parameters” it must operate within (OCC Bulletin 2006-39), and the FDIC’s for “Board-approved policies and programs” for processor relationships (FDIC FIL-3-2012). The origination-side equivalent, the assessment a bank keeps on each direct originator, is laid out in the ACH originator risk assessment template.
The 2026 model risk guidance does not fill the gap. The interagency revision issued on April 17, 2026 placed generative and agentic AI models outside its scope and announced a request for information on AI to follow (OCC Bulletin 2026-13). Until that work produces something, the defensible design is the one the requirements already imply: agents establish facts and draft, each claim tied to its record, and the approval, the suspension and the signature belong to a named person with a reason code. In the sample solution that is not a convention but a constraint: the agents have no action that approves, suspends, registers or clears.
Who decides to suspend a third party sender?
The bank does, through whoever its policy names, and in most programs that is a committee rather than an analyst. The guidance is clear that the bank must be able to act quickly: the FDIC lists requiring a processor to stop processing for a merchant, freezing balances against expected returns and terminating the relationship as appropriate actions, and Nacha’s risk advisory group tells banks to keep an exit strategy for a sender or any originator behind it. What the guidance does not do is say who signs. That belongs in the bank’s policy, with a named role, a reason code and a second signature where exposure is large.
In the sample, the decision screen shows the chain with its times: prepared by the analyst at 09:38 on October 20, screening confirmed by the BSA officer the evening before with all 1,240 originators cleared, and the decision waiting for the committee on October 23. The chair suspended QuickRun Billing’s entries pending its registration as a nested sender, with reason code TPS-04, in her own words. Switched to internal audit’s view, every one of those actions is unavailable and the evidence pack still downloads.
Who prepares, who checks, who decides, on one screen
That is the whole design in one screen: the requirements turned into evidence, the evidence into findings, and the findings into decisions people sign. To see it on one of your own senders, start from Third-Party Sender Due Diligence.
Questions people ask
What information does a bank give Nacha to register a third-party sender?
For the initial registration, only the bank’s name and contact, the sender’s name and principal business location, the routing number used for its entries and its Company Identifications. More, such as principals, tax identification and the approximate number of originators, is supplied within ten banking days if Nacha requests it after a risk event.
Is there a cost to register a third-party sender with Nacha?
No. Nacha’s FAQ says there is no registration charge for the bank; the registry is funded through network administration fees. The cost is the bank’s own work of knowing and updating what it registers.
Must the bank review its third-party sender’s risk assessment?
The Nacha rules do not require it, but Nacha says banks may set policies to encourage compliance, and its risk advisory group recommends confirming that each sender has documented its risks and controls. Supervisors expect the bank to manage the risk the sender poses, which is hard to do without reading it.
Do Nacha’s 2026 fraud monitoring rules apply to third-party senders?
Yes. Phase 1, effective March 20, 2026, covered every originating bank and the senders, service providers and non-consumer originators with 2023 origination of 6 million entries or more. Phase 2 covered the rest from June 22, 2026, the next banking day after the June 19 rule date.
What does a third-party sender agreement need to say about nested senders?
Since September 30, 2022, whether the sender may have nested senders and, if so, that each nested sender must have its own origination agreement with the sender. A bank can also require its prior written consent and prompt notice of any request, as the sample bank’s agreement does.
Can a third-party sender rely on its bank’s Rules Compliance Audit?
No. Nacha says a sender is not covered by the audit or risk assessment of its bank partner or of another sender in its chain. It may hire outside help, but the audit must be its own.