FATF Correspondent Banking Guidance: Respondent Due Diligence

Correspondent banking is the network of relationships through which one bank provides services to another, so that customers can send and receive money across borders. It is also an area where a bank may be exposed to customers it has never met. In October 2016 the Financial Action Task Force (FATF) issued guidance on how its standards apply to correspondent banking services, partly in response to concerns about banks cutting off whole categories of customers. This guide summarises that guidance for compliance staff and advisers. For training, see our correspondent banking financial crime risk course overview, and for the standard questionnaire used in practice, see our guide to the Wolfsberg CBDDQ.

What FATF means by correspondent banking

According to the guidance, correspondent banking is the provision of services by one bank to another, such as cash management, international wire transfers, cheque clearing, payable-through accounts and foreign exchange. One-off transactions and simple exchanges of SWIFT RMA keys are excluded. The guidance focuses on higher-risk cross-border relationships, especially those involving third-party payments, and it also addresses money or value transfer services that act in a similar way.

No duty to check every customer of the respondent

One of the guidance's central points is that the FATF Recommendations do not require the correspondent bank to carry out customer due diligence on each of the respondent bank's customers. Instead, the correspondent monitors the respondent's own transactions and risk profile. If something looks unusual, it can send a targeted request for information about a specific transaction, and that request does not amount to a customer due diligence obligation.

Assessing risk

The guidance does not give a fixed list of high-risk relationships, because risk depends on many factors and on the mitigating measures in place. It points to factors such as the respondent's jurisdiction, products and services, and customer base, and it asks banks to distinguish inherent risk from residual risk. It also says simplified due diligence is never appropriate for cross-border correspondent relationships where the activities in the definition are carried out.

Why the guidance matters in practice

The guidance tries to balance two pressures. Supervisors expect banks to know the risks of the institutions they serve, while the same guidance warns that blanket exits harm financial inclusion and can drive payments into less transparent channels. For a compliance team, the practical question is whether each relationship has a documented, proportionate rationale: why it exists, what risks were identified, and what controls were agreed. A file that answers those three questions is easier to defend whether the decision is to continue, to restrict or to exit.

Due diligence on the respondent bank

Expectations described in the guidance include:

• identifying and verifying the respondent and its beneficial owners, and understanding its ownership and control structure;
• confirming that the respondent is not a shell bank;
• understanding the purpose of the relationship and the expected activity;
• assessing the respondent's reputation, the quality of its supervision and any past money laundering or terrorist financing investigations or regulatory action;
• reviewing its anti-money laundering controls, including whether they are independently audited, with deeper reviews for higher-risk cases; and
• obtaining senior management approval before establishing a new cross-border relationship.

Payable-through accounts

These are correspondent accounts that third parties use directly to transact on their own behalf. The guidance says they may be offered if the correspondent identifies the associated risks and applies enhanced monitoring. The respondent must have carried out sufficient due diligence on the account users and be able to provide individual customer information on request.

Nested relationships

Nested relationships arise when the respondent's own banking clients use the correspondent relationship indirectly. The guidance says the correspondent should know such relationships exist, check for undisclosed ones, understand the respondent's controls over them, and follow up where disclosure is lacking.

The de-risking message

FATF treats de-risking as a serious concern because it can push transactions into unregulated channels and reduce transparency. Wholesale exclusion of entire countries or customer classes is, in its view, not consistent with the risk-based approach. Institutions should assess each relationship on its own risks, communicate concerns at senior level and consider limiting services or setting conditions before terminating. Termination is appropriate only where the risks cannot be managed.

What this means for advisers: our suggestions

These points are our suggestions, not statements in the guidance. If you advise a bank, test whether its respondent files show the elements listed above, in particular ownership, shell bank confirmation and senior approval. Check whether payable-through and nested activity is identified at all, not only whether it is controlled. Where a bank has exited a relationship, ask what alternatives it considered first. If you want structured training, browse our CPD courses. For the country risk element, see our guide to high-risk third countries and FATF lists.

What we could not confirm

We read a summary of the October 2016 FATF guidance rather than every annex, and we did not review the Wolfsberg Group or Basel Committee papers on the same subject, or later FATF statements. We have not checked whether FATF has updated the guidance since 2016. Our descriptions paraphrase the guidance and are not a substitute for reading it. This post is general information, not legal advice.