Third-Party Service Providers and Third-Party Senders
Two distinct categories
A Third-Party Sender (TPS) acts as an intermediary between an Originator and an ODFI - it transmits entries but is not the Originator and does not hold the Receiver's account. Payroll processors, payment facilitators, and billing aggregators are typical TPSs. A Service Provider is broader: any party providing processing, storage, or transmission services to a participant. A software vendor that never touches entry files is a Service Provider but not a TPS. A TPS is always a Service Provider; the reverse is not true.
The core rule
The ODFI is responsible for the acts of its Originators, TPSs, and Service Providers as if they were its own. Liability cannot be contracted away. The ODFI must therefore hold a written agreement with each TPS, perform due diligence before origination begins, set exposure limits, and review the relationship at least annually.
TPS obligations
- Register with Nacha and pay the annual registration fee; update the registration as information changes.
- Complete an annual Rules compliance audit and a periodic risk assessment.
- Comply directly with the Rules, including authorization, SEC code selection, and record retention.
- Disclose nested TPSs - a TPS that uses another TPS must reveal the chain, and the ODFI must know it.
Traps
Calling a merchant that originates its own entries a TPS (it is the Originator); calling a file-delivery vendor a TPS when it merely transports data; assuming a TPS indemnity agreement shields the ODFI from Nacha.
Rule of thumb: follow the money and the file. Anyone touching entries without being the Originator is a TPS, and the ODFI owns their mistakes.