Correspondent banking due diligence is the assessment that a correspondent bank makes of another bank, the respondent, before agreeing to hold accounts and process payments on its behalf, and at intervals afterwards. Because the correspondent handles transactions for the respondent's customers without knowing those customers itself, it has to satisfy itself that the respondent is properly owned, licensed, supervised and able to control money laundering, terrorist financing and sanctions risk.
The process is a specialised form of enhanced due diligence applied to financial institutions rather than to individuals or companies. It sits at the centre of correspondent banking, and its cost and difficulty are among the main reasons banks have withdrawn from some markets, a trend known as de-risking.
International standards behind the review
The global baseline is Recommendation 13 of the Financial Action Task Force. It requires a correspondent to gather enough information to understand the respondent's business, to judge its reputation and the quality of its supervision, to assess its anti-money laundering and counter-terrorist financing controls, to obtain senior management approval before opening the relationship, and to understand the responsibilities of each side. It also prohibits relationships with a shell bank.
FATF guidance issued in 2016 clarified that the standard does not require a correspondent to carry out due diligence on each of the respondent's customers, sometimes called know your customer's customer. The Basel Committee on Banking Supervision has published its own guidance on correspondent banking risk, and national laws add detail. In the United States, sections 312 and 313 of the USA PATRIOT Act require risk-based due diligence on foreign correspondent accounts and ban accounts for foreign shell banks.
What the correspondent examines
A typical file covers the following areas.
- Identity and ownership. The respondent's licence, legal form, group structure, major shareholders and any ultimate beneficial owner, together with its board and senior management, including any politically exposed persons.
- Business and geography. The products it offers, the types of customer it serves, the countries it operates in and the expected volume and nature of activity through the account.
- Regulation and reputation. The quality of supervision in its home country, any enforcement action, fines or adverse media, and whether the jurisdiction appears on FATF lists.
- Control framework. Its policies for customer due diligence, transaction monitoring, sanctions screening, suspicious activity reporting, training and independent audit.
- Downstream access. Whether the respondent offers nested correspondent banking to other banks or payable-through accounts that give its customers direct access to the correspondent account.
The questionnaire and industry tools
Much of the information is collected through a standard questionnaire. The Wolfsberg Group, an association of global banks, publishes the Correspondent Banking Due Diligence Questionnaire, which was introduced in 2018 to replace a shorter earlier form and which most large banks now accept. A shorter financial crime compliance questionnaire is used for lower-risk relationships. Shared utilities, such as the registry operated by SWIFT, let a respondent publish its documents once for many correspondents to read.
A completed questionnaire is evidence, not a conclusion. The correspondent is expected to test the answers against public sources, its own payment data and, for higher-risk respondents, calls or site visits with the respondent's compliance staff. Each relationship is given a risk rating that sets the depth of review and how often it is repeated.
Ongoing monitoring and review
Due diligence does not end at account opening. The correspondent monitors the flow of payments for patterns that do not match the respondent's stated business, such as unexpected currencies, sudden growth in volume or payments linked to high-risk sectors. When an alert cannot be explained, it sends a request for information to the respondent and expects a timely and complete reply. Persistent failure to answer is itself a warning sign.
Periodic reviews, usually every one to three years depending on risk, refresh the file. Event-driven reviews follow a change of ownership, a regulatory penalty or negative news. Where concerns cannot be resolved, the correspondent may restrict services, for example by closing the account in one currency, or exit the relationship altogether.
Criticism and limits
The burden of these reviews falls unevenly. Small banks in developing countries often lack the staff to complete long questionnaires for several correspondents, and correspondents may conclude that modest fee income does not justify the compliance cost. The resulting loss of relationships can cut whole countries off from international payments and push activity towards less transparent channels. Standard setters have responded by stressing that the risk-based approach calls for managing risk relationship by relationship rather than ending whole categories of business.