The Nacha Risk Management Advisory Group (RMAG) has developed sound business practices for ODFIs for both the onboarding of new Third-Party Sender (TPS) clients and the ongoing monitoring of existing TPS clients.

Following recent discussions on the topic of TPSs and the ODFIs that process for them, the group recommended these sound business practices:

•    Third-Party Senders (TPSs) should be specifically defined in the ODFI’s risk assessment and credit risk policy.
    o    Based on the ODFI’s policy, the TPS or any or all of the Originators serviced by the TPS may be defined as high risk and may require extended due diligence procedures prior to onboarding.
•    Educate the ODFI’s Treasury Management, Sales, and Operations staff on the specific policies regarding the onboarding requirements for TPS clients.
•    Ensure that the TPS has an annual ACH Rules compliance audit done by an outside party.
•    Ensure the TPS has documented an assessment of their risks and has instituted the proper controls. 
•    Monitor returns at both the TPS level and for each Originator customer of the TPS. This ensures the TPS and each Originator is compliant—not only with the ODFI’s policy, but with Nacha Rules regarding return rates/levels for ACH returns.
•    Ensure that each TPS is registered with current and accurate information in the Nacha Risk Management Portal. 
•    Ensure that if aTPS is a Direct Access Debit Participant that this status is also registered in the Nacha Risk Management Portal.
•    Focus on financial aspects including: 
    o    The initial review and regular reviews of exposure limits, e.g., the risk of returns for ACH debits, including same day returns, and returns up to 60 days for consumer entries.
    o    Understanding the enterprise-wide relationship with the TPS. e.g., FI loan relationships with the TPS.
    o    Processing relationships the TPS may have with other ODFIs.
    o    AML High Risk Review
•    A TPS should have the same expectation of their Originators that the ODFI has of them with regards to agreements, underwriting standards, and onboarding processes, for example. Similarly, as with their TPS client, the ODFI should have an exit strategy in case conditions at the TPS or any underlying Originator changes or deteriorates. 

Much of this work by RMAG provided the groundwork for the Request for Comment on Third-Party Senders issued in May 2021 by the Nacha Rules and Operations Committee.

RMAG plays several key roles in the Nacha eco-system. In particular, RMAG has provided input on the development of key rules, such as ACH Network enforcement and risk management and assessment, and published sound business practices on risk management.

The group continues to play a leading role in identifying potential risks in the ACH Network. RMAG is proactive and relies on member collaboration in order to help Nacha and the industry maintain a safe, efficient and high-quality ACH Network.

Nacha Risk Management Portal