Unclaimed property compliance has a reputation for being an accounting problem. Identify dormant items, attempt owner contact, report and remit to the right state by the right deadline. Teams build calendars and reporting processes around that cycle and consider the matter handled.
The awkward part surfaces during an audit, when the examiner asks about property types that the reporting team never saw, because a third party was holding them. Rebate administrators sitting on uncashed incentive payments. Payroll providers holding final wages for employees who never cashed a cheque. Claims administrators holding settlement funds. Payment processors holding unapplied balances. Each of those relationships is governed by a contract, and that contract is where the duty either sits or dangles.
This article covers the vendor relationships where escheatment duties commonly hide, how agreements typically allocate the three separable obligations involved, and the contract controls that make exposure visible before a multistate audit does it for you. The exposure is rarely large in any single relationship, which is exactly why it is left alone until the aggregate arrives in one assessment.
The relationships where duties hide
Any arrangement where a third party holds or disburses funds owed to your customers, employees or counterparties can generate unclaimed property. These are the ones that most often go unexamined.
- Payment and disbursement processors, unapplied balances, returned payments and uncashed disbursements sit on the processor’s ledger while the obligation to the payee remains yours.
- Rebate and incentive administrators, uncashed rebate cheques and expired stored value are a classic audit target, and administrators rarely report them on the client’s behalf unless required to.
- Payroll and benefits providers, final wages, unclaimed reimbursements and small balance retirement distributions accumulate quietly across employee turnover.
- Claims and settlement administrators, settlement funds distributed by a third party generate uncashed items that the administrator may treat as returnable rather than reportable.
- Transfer agents and custodians, dividends, redemption proceeds and small residual balances, where dormancy tracking depends entirely on the agent’s own process.
In each case the pattern is the same. The funds are physically with the vendor, the legal obligation to the owner is with you, and the contract is the only document that says who does what about it. When the contract is silent, the practical result is that nobody does anything until an audit notice arrives. Audits are typically multistate and look back many years, so the cost of that inaction accumulates in a way that few other compliance gaps do.
Escheatment is often treated as a single obligation, which makes allocation sloppy. It is really three: identifying and tracking dormancy, performing owner due diligence outreach within the statutory window, and filing and remitting to the correct jurisdiction. A vendor might reasonably take the first two and not the third. An agreement that assigns escheatment responsibility without separating these is an agreement that will be argued about later.
How agreements get this wrong
The drafting failures are consistent, and they tend to favor the vendor because the vendor’s template is usually the starting point.
- The agreement says nothing at all. Most servicing contracts are silent on unclaimed property, which leaves the holder of record carrying the full obligation by default.
- Responsibility is assigned without detail. A single sentence stating that the vendor will handle escheatment does not say which states, which property types, or what happens to the records.
- Record retention is shorter than the audit window. Unclaimed property audits routinely reach back well beyond standard retention periods, and contracts rarely require the vendor to hold records for that long.
- Data return on termination is undefined. When the relationship ends, the dormancy history often ends with it, leaving no way to establish when an item became reportable.
- Indemnities exclude the exposure. Standard indemnity language covers negligence and breach but not the assessed liability, interest and penalties that follow a failure to report.
Five steps to bring the exposure under control
Step 1, Inventory the fund-handling relationships
Identify every vendor that holds, processes or disburses money on your behalf. Procurement category data is a reasonable starting point, but the reliable method is to work from disbursement flows and ask where each one physically settles. This inventory is smaller than the full vendor list and it contains nearly all of the exposure.
Step 2, Extract what the contracts actually say
Pull escheatment, record retention, data return, audit support and indemnity provisions from each agreement into structured fields. Record silence explicitly. A field that reads not addressed is far more useful than a blank, because it turns an absence into a finding that can be counted and reported.
Step 3, Allocate the three duties deliberately
For each relationship, decide and document who tracks dormancy, who performs due diligence outreach and who reports and remits. Where the vendor takes a duty, require evidence of performance on a defined cadence rather than an annual assurance.
Step 4, Fix retention and data return terms
Set record retention obligations that match the realistic audit lookback rather than the standard business retention period, and require the return of dormancy and outreach data in a usable format on termination. These two terms cost nothing at negotiation and are extremely expensive to acquire later.
Step 5, Put the evidence on a cadence
Where a vendor performs a duty, collect the artifact: the dormancy report, the due diligence mailing log, the state filing confirmation. Store it against the obligation with a date. An audit defence built from retained artifacts is materially stronger than one reconstructed from vendor recollection.
See servicer obligations as tracked records
Watch how dormancy, due diligence and reporting duties become monitored commitments with named owners.
Why this belongs in the contract record
Unclaimed property exposure is a good illustration of a general point about vendor agreements: the liability is continuous, the contract is static, and nothing connects them unless you build the connection. The control pattern is the same one applied to any other regulatory duty allocated to a third party, set out in Vendor contract controls for OCC and FFIEC exam readiness, where each provision maps to a field, a cadence and a named evidence artifact. Holding those as dated obligations rather than as clause text is the approach described in Obligation Management for Financial Services. The same extraction pass that finds escheatment language also surfaces the retention and data return terms, so the marginal cost of covering it is small.
Duty allocation and the evidence it needs
Whichever party performs a duty, the holder of record needs to be able to show it was performed. This table sets out what that looks like in practice.
| Duty | Typical performer | Cadence | Evidence to retain |
|---|---|---|---|
| Dormancy identification | Vendor or holder | Monthly or quarterly | Aging report with item detail |
| Owner due diligence outreach | Vendor or holder | Per statutory window | Mailing log and returned mail record |
| Reporting and remittance | Usually holder | Per state deadline | Filed report and remittance confirmation |
| Record retention | Both parties | Continuous | Retention policy and storage confirmation |
| Data return on exit | Vendor | At termination | Transferred dataset and receipt |
Unclaimed property is one of the few compliance areas where the exposure grows silently for years and then arrives as a single assessment covering all of them. Vendor relationships are where the growth is hardest to see, because the funds and the records both sit outside the organization. The remedy is not complicated: know which vendors handle money on your behalf, make the agreements say who does what, and hold the resulting duties as tracked obligations with dated evidence. Doing that before an audit notice arrives is considerably cheaper than doing it afterwards. It is also one of the few compliance exercises where the remediation is mostly drafting and diarizing rather than systems work.
For related guidance, see OCC and FFIEC vendor contract expectations, explained, OCC and FFIEC vendor oversight, the contract controls and DORA and ICT contracts: what Article 30 requires.
