A third-party sender sits between a bank and the businesses whose payments it originates. The model is useful: a payroll provider, a billing platform or a payment facilitator aggregates volume, handles onboarding and formatting, and submits files to the bank. The bank gains volume without onboarding each underlying business. It also gains their risk.
Network rules make the originating institution the warranting party for every entry it transmits. If an entry is unauthorized, if the originator had no valid authorization, if the account was never properly identified, the warranty sits with the bank regardless of how many intermediaries handled the file. The underlying businesses may be entirely unknown to it. That is the asymmetry at the centre of the relationship.
Supervisory expectations have followed. Examiners look for evidence that the bank understands who is originating through its channel, has assessed those parties, monitors the resulting activity and can stop it. All of that has to be grounded in the agreement, because the bank has no direct contractual relationship with the originators themselves.
Where third-party sender oversight fails
Problems in these relationships tend to surface as a sudden deterioration in return rates or an examination finding, and the root causes are consistent across institutions.
- No originator visibility, the bank receives files without a current list of the originators behind them, so it cannot assess concentration, industry risk or sudden new entrants.
- Undisclosed nesting, the third-party sender uses its own third-party senders, placing originators two or more steps away with no disclosure obligation in the agreement.
- Aggregate-only exposure limits, a single cap across the relationship hides the one originator whose volume and return profile is driving the risk.
- Weak audit rights, the agreement allows an annual review on notice, which is insufficient when return rates move within days.
- Slow termination mechanics, notice periods written for commercial convenience leave the bank originating entries it has already decided it does not want.
Each of these is a contract design question as much as a monitoring question. Monitoring without the right to demand originator data produces incomplete analysis, and analysis without the ability to suspend quickly produces findings the bank cannot act on. The agreement is the instrument that makes both possible.
When a third-party sender submits entries that originated with another third-party sender's customers, the originating bank is warranting entries from parties it has no visibility into at all. Network rule changes in recent years have sharpened disclosure and registration expectations for exactly this structure. An agreement that is silent on nesting leaves the bank unable to answer the most basic supervisory question about its own origination channel.
The terms that make oversight possible
Five contractual elements convert an origination relationship into one the bank can actually supervise. Each should be tracked as an obligation with a cadence, not treated as boilerplate agreed at onboarding.
- Originator disclosure and warranties. a current list of originators with the right to require identifying information, and a warranty from the sender that each has a valid origination agreement and authorization practices.
- Nesting disclosure and consent. an express prohibition on nested senders without prior written consent, with disclosure of any that exist and the same warranties flowing down.
- Per-sender and per-originator exposure limits. limits set and monitored at both levels, with defined action when thresholds are approached rather than only when they are breached.
- Audit, risk assessment and data rights. the right to conduct or require risk assessments and audits, to receive return-rate reporting at originator level, and to obtain records on demand within a short period.
- Suspension and termination on short notice. the right to suspend origination immediately on defined triggers, including return-rate thresholds and suspected unauthorized activity, with termination exercisable without extended notice.
A five-step roadmap for the ODFI
Step 1, Map the origination channel end to end
Document, for each third-party sender, who the originators are, whether any nesting exists, what industries are represented and what volumes flow. The exercise frequently reveals originators the bank would not have onboarded directly, which is the point of doing it before an examiner does, and it draws on the same OCC and FFIEC vendor oversight contract controls applied elsewhere in the institution.
Step 2, Rewrite the agreement around visibility
Build in originator disclosure, nesting prohibition absent consent, flow-down warranties, and data rights with short response periods. Make the obligations specific: a right to request information without a defined turnaround is not a right the bank can rely on during a developing problem.
Step 3, Set limits at the level risk actually occurs
Establish exposure limits per sender and per originator, with thresholds that trigger review before they trigger breach. Monitor return rates by originator, since an aggregate figure across a large sender will mask a single deteriorating participant until the deterioration is substantial.
Step 4, Operationalize the monitoring cadence
Convert reporting, risk assessment, audit and attestation duties into dated obligations with owners. The failure mode here is the one third-party risk contract automation exists to prevent, an agreement with strong rights that nobody exercises on schedule, which examiners treat much the same as not having the rights at all.
Step 5, Rehearse suspension
Confirm operationally that origination can be suspended for one sender, or one originator within a sender, within the period the agreement contemplates. A contractual right that takes a week to implement does not address a risk that materializes in days.
Track sender obligations as live controls
Aavenir holds originator disclosure, reporting, audit and attestation duties as dated obligations with owners and evidence on each sender agreement.
What good looks like to an examiner
An institution in good shape can produce, without a project, the current list of third-party senders, the originators behind each, any disclosed nesting, the exposure limits in force, recent return-rate reporting at originator level, the date of the last risk assessment and the evidence it was performed. All of that derives from obligations in the agreement, tracked as live items rather than reconstructed when requested. The institutions that struggle are rarely the ones with weak drafting; they are the ones whose strong drafting created rights that were never converted into a monitoring schedule anybody owned.
Risk, term and monitoring cadence
The table pairs each principal risk in the relationship with the contractual term that addresses it and the cadence at which it should be tested.
| Risk | Contractual term | Monitoring cadence | Evidence |
|---|---|---|---|
| Unknown originators | Disclosure and warranty terms | Monthly list refresh | Current originator schedule |
| Undisclosed nesting | Consent requirement, flow-down | At onboarding and annually | Consent records, attestations |
| Credit and settlement exposure | Per-sender and per-originator limits | Daily monitoring | Limit reports, exception log |
| Unauthorized entries | Authorization warranties, audit rights | Quarterly sampling | Audit findings, authorizations |
| Deteriorating return rates | Suspension triggers | Continuous with thresholds | Return-rate reports, actions |
A third-party sender relationship gives a bank origination volume it would not otherwise reach, on the condition that it accepts warranty responsibility for parties it does not contract with. That trade is manageable, but only through the agreement. Originator disclosure, a prohibition on undisclosed nesting, flow-down warranties, limits set where the risk actually sits, data rights with short response periods and suspension that works in days rather than weeks are what make supervision possible. The institutions that handle this well treat those terms as monitored obligations with owners and evidence, which is also, not coincidentally, the form in which an examiner expects to see them. The drafting work is finite and the monitoring work is routine; what neither tolerates is being deferred until a return-rate report forces the question.
For related guidance, see Vendor contract controls for OCC and FFIEC exam readiness, The bank’s guide to DORA ICT third-party contract terms and OCC and FFIEC expectations for vendor contract files.
