I only have a 2004 copy of the NACHA Operating Guidelines handy, but they state (in Section IV, Chapter I, Subsection B1, dealing with the ODFI's responsibilities):
"Agreements should also be entered into...between the Third-Party Service Provider and the ODFI."
This is important because Subsection D goes on to state:
"The NACHA Operating Rules require any Third-Party Service Provider...to conduct an annual audit of compliance". So you would want to make sure that your agreement stipulated that this be done.