If the bank has a business account that is an insurance agent and they sell policies to customers that are actually from other insurance companies such as Progressive, Traveler's, etc. The bank's customer sells the policy to their customer, receives the payment for the policy, and then passes part of that payment to the insurance company that holds the policy (Ie: Progressive). Since the bank's insurance agent customer is still doing payments on behalf of both parties, in addition to selling the policy, would they still be considered a TPPP?

Under an official agency agreement - I would not considered them a TPPP.

The definition in the FFIEC manual is:
Nonbank or third-party payment processors (processors) are bank customers that provide payment-processing services to merchants and other business entities. Traditionally, processors contracted primarily with retailers that had physical locations in order to process the retailers’ transactions. These merchant transactions primarily included credit card payments but also covered automated clearing house (ACH) transactions, 221 remotely created checks (RCC),222 and debit and prepaid cards transactions. With the expansion of the Internet, retail borders have been eliminated. Processors now provide services to a variety of merchant accounts, including conventional retail and Internet-based establishments, prepaid travel, telemarketers, and Internet gaming enterprises. Third-party payment processors often use their commercial bank accounts to conduct payment processing for their merchant clients. For example, the processor may deposit into its account RCCs generated on behalf of a merchant client, or process ACH transactions on behalf of a merchant client. In either case, the bank does not have a direct relationship with
the merchant. The increased use of RCCs by processor customers also raises the risk of fraudulent payments being processed through the processor’s bank account. The Federal Deposit Insurance Corporation (FDIC), Office of the Comptroller of the Currency (OCC), and Financial Crimes Enforcement Network (FinCEN) have issued guidance regarding the risks, including the BSA/AML risks, associated with banking third-party processors.223

So I think you could say your scenario fits this definition. But not all TPPP pose the same level of risk. After doing some due diligence you may determine that this entity is not higher-risk. Hopefully your BSA Program addresses the necessary due diligence, determining the risk rating and associated monitoring.

Yes, I read this same definition in the FFIEC BSA/AML manual and determined it could go either way.

Do you have any information that you are basing your thoughts on that would be helpful?

Nonbank or third-party payment processors (processors) are bank customers that provide payment-processing services to merchants and other business entities

If I am insurance agent for Nationwide - I am not a third-party payment processor. I represent Nationwide through my agency agreement. Why would processing payments to or from Nationwide make me a TPPP. when I legally represent them?

Hi - thank you for the quick reply. I'm just thinking it through here - not sure about it. If the bank's customer is "ABC Insurance" and they do policies, not for just Nationwide but any agency that has a policy to fit their customer (the insurance policy purchaser), does that make a difference?

Well, if you have doubts, you are well within your rights to classify them as TPPP. Let's say that you do - what does that mean from a monitoring standpoint based on your internal policies and procedures or what other impact will that have based on your profile?

Would you consider this same logic for an professional employment organization (PEO) operating as a co-employer of their clients?

As I look at it - I would still categorize as a TPPP because for all intents and purposes the employee receiving payroll works for the PEO client. The client has hired the PEO to provide services to include payroll processing. Our bank is originating the payroll file for the co-employees.

I was not aware that FinCEN has defined what a PEO might be and what additional risk that you might see, whether or not you feel like they might be a TPPP. It is a specialty company and like all specialty companies, the bank should be performing a customer-based risk assessment.