Third party sender vs third party service provider comes down to one contract. A third-party service provider does ACH processing work for someone else, such as building files or transmitting them, while the originator or the bank keeps its own agreement. A third-party sender is the particular kind of service provider that holds the ACH origination agreement with the bank itself and sends entries for originators that have no agreement with the bank at all. Every third-party sender is a service provider; most service providers are not senders. The difference matters because the sender’s position carries registration with Nacha, the sender’s own risk assessment and audit, and the bank’s duty to know originators it has never met. Botminds’ Third-Party Sender Due Diligence is built for the second case: a bank that originates for payment processors and must screen, evidence and measure every originator behind each one.
The sample review mentioned on this page is fictional: Tessaly Community Bank and its sender Larkfield Payroll Services, with 1,240 originators, as they run through the solution. The definitions and roles come from Nacha’s public pages and the federal banking agencies, linked where they are used.
Who holds what: originator, service provider, sender and nested sender
| Question | Originator | Service provider | Third-party sender | Nested sender |
|---|---|---|---|---|
| Has the underlying obligation with the receiver | Yes | No | No | No |
| Holds an ACH origination agreement with the bank | Yes, unless it uses a sender | No | Yes | No, it has one with another sender |
| Registered by the bank in Nacha’s Risk Management Portal | No | No (direct access is registered separately) | Yes | Yes, and the host sender is flagged |
| Owes an annual Rules Compliance Audit | No | Yes, for the functions it performs | Yes | Yes, its own |
| Owes its own ACH risk assessment under the Nacha rules | No | No | Yes | Yes, its own |
| Has a contract with the bank the bank can enforce directly | Yes, if it holds the agreement | Through whoever hired it | Yes | No |
What is the difference between a third party sender and a third party service provider?
A service provider performs ACH work for another party; a sender does that and also stands in the originator’s place in the contract with the bank. Nacha’s definitions are short. A third-party service provider “Provides services related to ACH processing on behalf of another party; may or may not transmit entries directly.” A third-party sender is “A specific type of TPSP that acts on behalf of an Originator to transmit entries through an Originating Depository Financial Institution (ODFI) without a direct agreement between the Originator and the ODFI” (Nacha, Third Parties in the ACH Network).
The OCC described the same split from the bank’s side in 2006, and its wording is still the plainest: “Whereas a bank is a client of a traditional third-party service provider (often called an ACH vendor), the merchant is the customer of a third-party sender (often called an originator aggregator or merchant processor) and the third-party sender is a customer of the bank” (OCC Bulletin 2006-39). A vendor works for the bank or for the originator. A sender’s clients are its own.
That is why the two land in different parts of a bank. A service provider that builds files for a business customer is a vendor question, handled through the bank’s or the customer’s third-party risk management. A sender is a customer question, handled in the ACH risk program, with an exposure limit, a registration and an annual review of everyone behind it.
One test: who signed the origination agreement with the bank
Nacha’s 2014 bulletin reduces the classification to a single question once the underlying payment is understood. The 2014 definition, it says, rests on two characteristics: the sender “acts as an intermediary between the Originator and the ODFI,” and the sender “(rather than the Originator) has the Origination Agreement with the ODFI” (ACH Operations Bulletin #2-2014). Then it gives the test in two lines:
If the Originator has the ACH Origination Agreement with the ODFI, there is no Third-Party Sender involved in the transaction, and the intermediary is only a Third-Party Service Provider. If the intermediary has the ACH Origination Agreement with the ODFI, the intermediary acts as a Third-Party Sender.
Nacha, ACH Operations Bulletin #2-2014
Two things the test does not ask are worth stating, because both cause misclassification. It does not ask whose name is on the settlement account; the bulletin says a client’s settlement account at the bank “does not affect the determination whether the intermediary” is acting as a sender. And it does not ask who transmits the file. A service provider may transmit directly to the ACH operator under the bank’s routing number without becoming a sender, while a sender may hand its files to the bank through the ordinary online banking channel.
Before the agreement question comes the obligation question: who owes the payment to whom. The bulletin’s first step is “to identify the underlying transaction that is taking place and the persons or entities that have the underlying direct obligations to each other.” The party with the obligation to the receiver is the originator. Only after that does the agreement decide whether the intermediary in the middle is a sender or merely a provider. How that plays out with a customer the bank onboarded as an originator is the subject of originator vs third party sender.
Is a payroll company a third party sender? Both, one leg at a time
Usually yes for the paychecks and no for its own funding debit, and the bulletin’s payroll scenario shows why. A payroll processor with its own agreement with Bank X runs two kinds of entries. The bulletin also allows for the reverse: “an ACH participant can be a Third-Party Sender for one set of Entries and an Originator for another set of Entries.”
One payroll processor, two legs, two roles
| Leg | Who owes whom | Role of the payroll processor | Entry type and company name |
|---|---|---|---|
| Funding: debit to the employer’s account | The employer owes the payroll processor for the payroll and its fee | Originator, acting in its own name | CCD; the payroll processor’s name |
| Payroll: credits to employees’ accounts | The employer owes its employees their wages | Third-party sender, transmitting for the employer | PPD; the employer’s name |
| Variant: the employer holds its own agreement with the bank | The employer owes its employees their wages | Service provider only; no sender involved | PPD; the employer’s name |
The sample sender sits in the middle row at scale. Larkfield Payroll Services sends for 1,240 companies, 412,000 entries a month, and for each of those companies the bank has no agreement: Larkfield has it. Its 612 staffing and payroll clients send PPD and CCD; its membership, subscription and billing clients send web and telephone debits, which is where the risk concentrates.
Third-Party Sender Due Diligence: the sender at the top, every originator underneath
Who warrants entries sent by a third party service provider? The bank, either way
The bank does, whether the intermediary is a provider or a sender. The FFIEC’s examination handbook says so of service providers that transmit straight to the operator: “it is the ODFI that warrants the validity of each entry transmitted by the service provider, including the basic requirement that a receiver has authorized all entries” (FFIEC IT Handbook, Third-Party ACH Processing). Using a vendor does not move the warranty off the bank.
What a sender adds is a second line of warranties that runs to the bank. Under the rules as the FFIEC summarises them, a sender that signs with an ODFI must “establish the identity of each originator using commercially reasonable methods, warrant that the originators will assume their responsibilities under NACHA rules, and warrant that it will assume the liabilities of the ODFI.” The handbook then adds the condition that makes those warranties worth something: the bank “should be able to substantiate that the third-party sender has sufficient creditworthiness to back the warranties it makes relative to the risk, nature, and volume of ACH transactions; the underlying originators; and the exposure duration.”
So the warranty chain is only as strong as the sender’s balance sheet against what its originators can produce in returns. A sender with $186.4 million a month of entries and a daily exposure limit of $9.5 million, as in the sample, is warranting the conduct of 1,240 companies. If one of them runs fraudulent debits and the sender cannot pay the returns, the bank pays.
What a third-party sender owes that a service provider does not
The sender carries obligations of its own under the Nacha rules, and the bank carries obligations about the sender. A service provider has one network obligation of its own, the audit of the functions it performs. The comparison below is the practical reason a misclassified sender is a problem: every item on the right goes undone.
Third-party service provider vs third-party sender: what each relationship asks of the bank
Service provider (vendor): The originator, which holds its own origination agreement; the provider is its vendor or the bank’s.
Third-party sender (customer): The sender. The originators behind it are its customers, not the bank’s.
Service provider (vendor): None as a provider. A provider with direct access to the operator is registered under the separate direct access rules.
Third-party sender (customer): Registered within 30 days of the first entry, or 10 days after the bank finds an unregistered one; updated within 45 days of a change.
Service provider (vendor): Vendor due diligence on the provider; customer due diligence on the originator, which the bank onboards itself.
Third-party sender (customer): Due diligence on the sender and on its originators, which the bank must obtain through the sender and verify.
Service provider (vendor): An annual Rules Compliance Audit of the ACH functions the provider performs.
Third-party sender (customer): Its own ACH risk assessment and its own annual Rules Compliance Audit, which it cannot borrow from another party.
Service provider (vendor): Per originator, as for any direct customer.
Third-party sender (customer): At the sender and for each originator behind it, against Nacha’s threshold and levels.
Service provider (vendor): The originator’s exposure limit; the provider’s file limits where it transmits directly.
Third-party sender (customer): An exposure limit on the sender, backed by its creditworthiness relative to the originators beneath it.
Registration is the item most often missed, because it has no counterpart for vendors. Nacha’s registration FAQ is blunt about exceptions: “Exceptions to registration would lessen the effectiveness of the registry” (Nacha, Third-Party Sender Registration), and every ODFI must either register its senders or state that it has none. A bank that has filed the second statement while one of its customers is in fact a sender has a registration problem as well as a due diligence one. The full list of what a sender owes, and which items software can evidence, is set out in third party sender requirements.
Third party sender vs third party payment processor: one risk, two vocabularies
A third-party payment processor is the regulators’ term and a third-party sender is Nacha’s; in ACH they usually describe the same business seen from two rulebooks. FinCEN’s 2012 advisory describes processors as “financial institution customers that provide payment processing services to merchants and other business entities, typically initiating transactions on behalf of merchant clients that do not have a direct relationship with the Payment Processor’s financial institution” (FinCEN Advisory FIN-2012-A010). That is a sender, described by its effect rather than its contract.
The terms are not identical. A payment processor in the regulators’ sense may process card payments or remotely created checks as well as ACH, and its risk is judged under the Bank Secrecy Act and consumer-protection law, not under the Nacha rules. Nacha itself acknowledges the overlap: its 2022 roles rule says a sender’s risk assessment will likely cover the same risks as one done “by the TPS as required for other payment systems when the TPS acts as a TPPP.” In practice, a processor the BSA officer calls a TPPP and the ACH team calls a TPS should be one file, not two, which is the argument of third party payment processors under FFIEC, FDIC and FinCEN guidance.
Does a third party service provider need a rules compliance audit?
Yes, but only for what it does. Nacha’s Third Parties page says the rules define obligations for service providers “including an annual Rules Compliance Audit that applies to the functions of ACH processing that it performs on behalf of a Participating DFI or a TPS” (Nacha). A sender’s audit is broader, because a sender has taken on obligations the bank would otherwise have, and the same page names both its audit and its risk assessment.
The bank’s view of the two audits differs too. The FFIEC says a financial institution “should review and assess all audits of its service provider’s internal controls” (FFIEC). For a sender, the question is scope as much as completion: an audit that covered only some of the entry types the sender originates leaves the rest untested. In the sample, Larkfield’s audit of November 22, 2025 covered PPD and CCD only, while 341 of its originators send web and telephone debits.
What the bank must be able to show for one sender
Five questions that settle the label for any intermediary
Most misclassifications happen at onboarding, when a business is set up as an originator because that is the product it asked for. These questions, asked of every business customer whose description includes billing, payroll, payments, collections or software, settle the label before the first file.
Sender, service provider or originator: five questions to ask at onboarding
- For each kind of entry, who owes the payment to the receiver?
The party with the underlying obligation is the originator. If it is the customer’s client, the customer is an intermediary.
- Who will sign the ACH origination agreement with the bank?
If the intermediary signs, it is a sender. If its client signs, it is a service provider.
- Whose name will appear in the company name field?
A sender transmitting for clients puts the client’s name there; a business originating for itself uses its own.
- Does it send for any other processor?
A sender must disclose any other sender it transmits for before the first entry. Ask, and put the answer in the agreement.
- Does it transmit directly to an ACH operator?
Direct access is registered separately and needs the bank’s controls over files and settlement, whatever the label.
Where Third-Party Sender Due Diligence fits is after the label is settled: once a customer is a sender, the solution registers and reviews it one layer deeper, every originator screened, evidenced and measured from the bank’s own files. It does not decide the label for the bank. When it finds a Company Identification sending under a sender that looks like a processor in its own right, it raises the question with its evidence, and a person decides. See the whole review at Third-Party Sender Due Diligence.
Questions people ask
Is every third-party sender also a third-party service provider?
Yes. Nacha defines a third-party sender as a specific type of service provider, the one that holds the origination agreement with the bank and acts for originators without their own agreement. The reverse is not true: a provider that only builds or transmits files for a client with its own agreement is not a sender.
Who is the originator when a third-party sender is involved?
The business that owes or is owed the payment by the receiver, such as the employer paying wages or the university collecting tuition. The sender transmits on its behalf. In Nacha’s payroll example the employer is the originator of the payroll credits even though the payroll processor holds the agreement.
Does a third-party service provider have to be registered with Nacha?
Not as a service provider. Third-party sender registration covers senders only, while a provider that transmits directly to an ACH operator falls under Nacha’s separate direct access registration, which the bank also files in the Risk Management Portal.
Can a business be a third-party sender for some entries and an originator for others?
Yes. Nacha’s 2014 bulletin says a participant can be a sender for one set of entries and an originator for another. A payroll processor originates its own funding debit to the employer and acts as a sender for the employees’ wage credits.
Is a payment facilitator a third-party sender?
It depends on the same test: if the facilitator holds the origination agreement with the bank and sends ACH entries for merchants that owe or are owed the payments, it is acting as a sender for those entries. If each merchant has its own agreement with the bank, the facilitator is a service provider.