Your software platform is a Third-Party Sender (TPS) if it holds the bank agreement and sends automated clearing house (ACH) payments for your clients. If each client signs its own agreement with the bank, your platform is a Third-Party Service Provider (TPSP) instead. The difference matters. A third-party sender takes on duties under the Nacha Operating Rules, including a risk assessment and an annual audit due by December 31.
This guide explains how Nacha defines each role, how to tell which one your platform plays, and what a TPS has to do today. It draws on Nacha’s own definitions and examples.
What Is a Third-Party Sender?
Nacha defines a Third-Party Sender as a type of Third-Party Service Provider. A TPS acts on behalf of an Originator to send ACH entries through an Originating Depository Financial Institution (ODFI). The Originator has no direct agreement with that bank (Nacha).
A Third-Party Service Provider performs ACH processing work for another party, and it may or may not send the entries itself. The Originator is the business whose payment it is. It instructs its bank, or its TPS, to send the payment.
Nacha’s guidance on third parties sets two tests for a TPS. It sits between the Originator and the ODFI. It also holds the Origination Agreement with the ODFI, in place of the Originator (Nacha ACH Operations Bulletin #2-2014).
| Role | What it does | Agreement with the bank (ODFI) |
|---|---|---|
| Originator | Starts the payment and instructs its bank or its TPS to send it | Holds it when no TPS is involved |
| Third-Party Sender (TPS) | Sends entries through an ODFI on behalf of Originators | Holds the Origination Agreement |
| Third-Party Service Provider (TPSP) | Performs ACH processing work for another party; may or may not send entries | None; the Originator or a TPS holds it |
| Nested Third-Party Sender | Acts for an Originator under an agreement with another TPS | None; its agreement is with the other TPS |
One business can hold more than one role. Nacha’s guidance says an ACH participant can be a Third-Party Sender for one set of entries and an Originator for another.
How Do You Know If Your Platform Is a Third-Party Sender?
Nacha’s guidance works through two questions. First, who holds the Origination Agreement with the ODFI? If your platform holds it, your platform is a Third-Party Sender. If your client holds it, your platform is a Third-Party Service Provider.
Second, on whose behalf are you acting? When you collect or pay money for a client, you act for that client. When you collect money your own business is owed, you are the Originator of that payment.
Two details are easy to miss. Any business that moves funds for another party through the ACH Network is at least a TPSP. And funds settling into your platform’s account don’t change whether you are a TPS (Nacha).
Nacha also offers a Third-Party Sender identification tool that walks through the same questions. Your role depends on your agreements, and your ODFI or processor confirms it.
Examples From Payroll and Billing Platforms
Nacha’s guidance uses common business models to show how the roles split. One platform can play two roles in a single payment cycle.
- Payroll provider. The provider is the Originator of the ACH debit that pulls payroll funds from the employer’s account. It is a Third-Party Sender for the ACH credits that pay each employee.
- Tuition processor. A processor that collects tuition by ACH debit for a university is a TPS for those debits. When it pays the collected funds to the university, it is the Originator of that ACH credit.
- Wallet provider. A provider that debits a user’s bank account to fund that user’s wallet is the Originator. The debit is on the provider’s own behalf.
The same two questions apply to property management, membership billing, and other vertical software. Map each payment flow, then ask who holds the bank agreement and whose payment it is.
What Is a Nested Third-Party Sender?
A Nested Third-Party Sender is a TPS that has an agreement with another TPS to act on behalf of an Originator. It has no direct agreement with the ODFI (Nacha). Nacha’s rule on Third-Party Sender roles took effect September 30, 2022. Risk assessments and registration updates had a grace period to March 31, 2023.
This is the arrangement to check if your platform sends payments through a payment processor that holds the bank relationship. If your clients sign with you and you send their payments through a processor that is a TPS, you may be a nested TPS. If your clients sign directly with the processor and your software only passes their payment data, you may be a TPSP.
Under the rule:
- The TPS and the nested TPS must have an Origination Agreement with each other.
- The ODFI identifies in Nacha’s Risk Management Portal every TPS that allows nested TPS relationships.
- Each TPS, nested or not, must complete its own risk assessment and its own Rules compliance audit.
- Nacha sets no limit on how many levels a chain can have.
A TPS can’t rely on the audit or risk assessment of another TPS in its chain, or of its bank partner (Nacha, November 2022). Ask your processor, in writing, which role your platform plays in its setup.
What Does a Third-Party Sender Have to Do?
Nacha describes Third-Party Senders as having obligations to perform and warrant ODFI obligations. The duties below apply to Third-Party Senders today; the data security rule depends on volume.
| Duty | What it means | In effect since |
|---|---|---|
| Origination Agreements | Agreements with the ODFI, and with each Originator or nested TPS, define roles and obligations | Agreements with nested TPSs since September 30, 2022 |
| Registration | Your ODFI registers you with Nacha. You give it registration details within 2 banking days of a request | September 29, 2017 |
| Risk assessment | Assess the risks of your ACH activity, and run a risk management program based on it | September 30, 2022 (grace period to March 31, 2023) |
| Annual Rules compliance audit | Complete your own audit of compliance with the Nacha Rules | Due by December 31 each year |
| Fraud monitoring | Run risk-based processes to identify entries that may be unauthorized or sent under false pretenses, and review them at least once a year | June 22, 2026, regardless of volume |
| Account data security | Render stored account numbers unreadable once your ACH volume reaches 2 million entries a year, counted across all clients | June 30, 2022, for the 2 million threshold |
| Return rates | Your bank, and you as a TPS, may require clients to reduce return rates that pass Nacha’s thresholds | 0.5% unauthorized threshold; 3% and 15% inquiry levels |
Sources: Third Parties in the ACH Network, Third-Party Sender Registration, Risk Management Portal, Fraud Monitoring Phase 2, Supplementing Data Security Requirements, and ACH Network Risk and Enforcement Topics.
Expect your bank to ask about these duties. Since October 2025, Nacha has used its Risk Management Portal to request proof of audit from more financial institutions. A bank answering for a TPS customer may ask that TPS for proof the audit was done (Nacha ACH Operations Bulletin #3-2025).
Bank regulators also expect banks to oversee payment processors. FDIC guidance says banks can’t rely solely on a payment processor’s own due diligence, and it calls nested processor relationships hard to monitor (FDIC).
What to Do Next
- Map each ACH payment flow your platform touches: whose payment it is, and who holds each agreement.
- Ask your processor or bank, in writing, whether it treats your platform as a TPS, a nested TPS, or a TPSP.
- If you are a TPS, confirm your registration details with your bank, and list any nested TPSs you serve.
- Complete or update your risk assessment, and put the annual audit on the calendar before December 31.
- Write down your fraud monitoring processes and schedule their yearly review. Our fraud monitoring procedure template is a starting point.
- Check where your systems store client bank account numbers, and whether they are unreadable at rest.
- Review return rates by client each month. Our guide to ACH return codes explains what each return tells you.
Our posts on ACH integration for SaaS platforms and ACH APIs cover the build side of adding ACH to your product.
How ReliaFund Helps
ReliaFund has processed payments since 2001, and ACH processing is our primary focus. Our partner program works with developers, resellers, and independent sales organizations (ISOs). Our platform is built 100% in-house, with a well-documented API, sandbox and test accounts, and cloud integrations.
We’re a member of the Third Party Payment Processors Association (TPPPA). When you call 1-866-243-5040, a team member answers and directs your call.
Talk to an expert. Call 1-866-243-5040.
Frequently Asked Questions
Do software platforms register with Nacha? Not directly. Your ODFI registers its Third-Party Sender customers with Nacha. A TPS must give its ODFI the registration information it asks for within 2 banking days.
What is the difference between a TPS and a TPSP? A TPS holds the Origination Agreement with the ODFI and sends entries for Originators. A TPSP performs ACH processing work for another party, and the Originator or a TPS holds the bank agreement.
Can a platform be a TPS and an Originator at the same time? Yes. A platform can be a TPS for payments it sends for clients and the Originator of payments it makes or collects for itself.
Does the fraud monitoring rule apply to a small TPS? Yes. Since June 22, 2026, Nacha’s fraud monitoring rule has covered every Third-Party Sender and Third-Party Service Provider, whatever its volume.
Can we rely on our processor’s audit or risk assessment? No. Each TPS in a chain must complete its own risk assessment and its own Rules compliance audit.
This article is general information. It isn’t legal or compliance advice. Confirm your obligations with your bank and legal counsel.
Sources
- Nacha: Third Parties in the ACH Network and Third-Party Sender identification tool
- Nacha: ACH Operations Bulletin #2-2014, ACH Transactions Involving Third-Party Senders (December 30, 2014)
- Nacha: Third-Party Sender Roles and Responsibilities (effective September 30, 2022) and risk assessment reminder (November 2, 2022)
- Nacha: Third-Party Sender Registration (effective September 29, 2017)
- Nacha: Risk Management Portal and ACH Operations Bulletin #3-2025 (September 11, 2025)
- Nacha: Fraud Monitoring Phase 2, Supplementing Data Security Requirements, and ACH Network Risk and Enforcement Topics
- FDIC: Payment Processor Relationships, FIL-3-2012 (revised July 2014 and February 2026)