Correspondent Banking Due Diligence Template (FATF R.13, 31 CFR 1010.610)

Correspondent Banking Due Diligence: [Respondent institution]

Due diligence assessment of a cross-border correspondent banking relationship from the correspondent's side: services requested, respondent profile, ownership and licensing, jurisdiction, assessment of the respondent's AML/CFT and sanctions controls, nested relationships and payable-through accounts, shell bank checks, risk rating, documented responsibilities, senior management approval and ongoing monitoring. Based on FATF Recommendation 13 (Correspondent banking, cited by number and title), the current EU framework (Directive (EU) 2015/849 Arts 19 and 24 as transposed in national law), the EU Anti-Money Laundering Regulation, Regulation (EU) 2024/1624 (AMLR) Arts 36, 38 and 39, which apply from 2027-07-10, the UK Money Laundering Regulations 2017 (reg. 34) and US rules 31 CFR 1010.610 (due diligence for correspondent accounts) and 31 CFR 1010.630 (foreign shell bank prohibition and records), as of 2026-10. Replace every [bracketed] value and every row marked Example. This is a document format, not legal, compliance or regulatory advice. Obtain the standard or law for the normative text and check current local law.

Document control

Approvals

Revision history

Contents

1. Scope and legal basis
2. Relationship and services requested
3. Respondent profile
4. Ownership, management and licensing
5. Jurisdiction assessment
6. AML/CFT control assessment
7. Sanctions control assessment
8. Nested relationships and payable-through accounts
9. Shell bank checks and US records
10. Risk rating
11. Responsibilities and conditions
12. Senior management approval and decision
13. Ongoing monitoring, review and exit
14. Glossary and references
15. Standard and licence note

1. Scope and legal basis

A correspondent relationship exists when one institution (the correspondent) provides banking services to another institution (the respondent), such as accounts, payment execution, cash management, foreign exchange or trade services, so that the respondent can serve its own customers. The correspondent usually has no direct relationship with those underlying customers, which is why the law requires extra measures when the respondent is outside the correspondent's own jurisdiction.

2. Relationship and services requested

Describe the services, currencies, expected volumes and the respondent's reason for choosing this correspondent. Separate services for the respondent's own account (treasury, interbank funding) from services that carry its customers' payments, because the second group brings the respondent's customer risk into your payment flows.

Stated purpose: [Summary] Example: Mareval Commercial Bank plc serves importers and exporters in [Country A] trading with the EU and needs EUR and USD clearing with trade finance support. It is replacing a correspondent that withdrew from the region in 2025.

Assess the relationship on its own risk rather than ending it by category. Withdrawing from whole regions or respondent types can push payments into less transparent channels; the risk-based approach expects the correspondent to manage the risk of each respondent where it can, and to record its reasons where it cannot.

3. Respondent profile

Gather enough information to understand the nature of the respondent's business and to determine from public information its reputation and the quality of its supervision. Use annual reports, regulatory disclosures, rating agency reports and press, and confirm material points in a call or visit with the respondent's management and its compliance function.

4. Ownership, management and licensing

Identify who owns and controls the respondent, who runs it and who licenses and supervises it. For a listed bank, record the listing and any shareholder above your policy threshold; for a non-listed bank, identify the natural persons or state bodies that own or control it. Where US enhanced due diligence applies, identify each owner of 10 percent or more of any class of securities of a foreign bank whose shares are not publicly traded (31 CFR 1010.610(b)(3)), treating members of the same family as one person.

Holdings sum to 62.0 + 18.0 + 9.0 + 11.0 = 100.0 percent.

5. Jurisdiction assessment

Assess the home jurisdiction's AML/CFT regime and supervisory quality and any jurisdiction that shapes the respondent's risk. For a US covered institution, record whether the respondent operates under an offshore banking licence, under a licence from a country designated as non-cooperative by an intergovernmental group in which the United States participates and concurs, or under a licence from a country designated by the Treasury as warranting special measures: any of these requires the enhanced due diligence in 31 CFR 1010.610(b). For an EU correspondent, record whether the country is on the Commission's list of high-risk third countries, which brings additional enhanced measures.

6. AML/CFT control assessment

Assess whether the respondent's AML/CFT controls are adequate and effective for its risks. The law requires the correspondent to assess the respondent's controls, not to audit them; use proportionate evidence. Score each area, explain the score in a sentence and note the evidence. The areas below are this template's own structure; they are not the order or wording of any industry questionnaire.

Average control score in the example: (1 + 2 + 1 + 2 + 1 + 2 + 1) / 7 = 10 / 7 = 1.43, which the example methodology maps to "adequate with improvement points".

Test the claims against your own data. Example: Fernhollow Bank reviewed three months of the respondent's payments through its previous correspondent (provided by the respondent) and found that 96% of value matched the stated trade corridors and sectors. The remaining 4% were transfers to money service businesses. That share is higher than the 0.4% deposit share stated in section 3, because these customers move funds quickly and hold low balances; the respondent explained the flows and provided its due diligence on the two largest money service business customers, and the gap is recorded as a monitoring point (MON-001).

7. Sanctions control assessment

Assess the respondent's sanctions programme against the regimes that bind your institution (EU, UN, national and, for USD clearing, US OFAC) and the respondent's own regimes. Payments routed through your accounts must not breach the sanctions that apply to you, regardless of the respondent's home law. Link to your own procedure (compliance/sanctions-compliance-procedure) for the controls you apply to the respondent's payments.

8. Nested relationships and payable-through accounts

Determine whether the respondent will let other financial institutions use its account with you (nested or downstream correspondent relationships), and whether any account would function as a payable-through account, meaning the respondent's own customers would have direct access to your account. For US accounts subject to enhanced due diligence, the correspondent must find out whether the foreign bank provides correspondent services to other foreign banks that use the account and take reasonable steps to assess those banks, and must obtain information about persons with authority to direct transactions through any payable-through account. Under the AMLR (Art. 36(e)) and current EU law, for payable-through accounts the correspondent must be satisfied that the respondent has performed CDD on customers with direct access and can provide CDD data on request.

Downstream values sum to USD 12,000,000 a month, as in section 2; after the decision on NST-003, the permitted nested value is USD 10,000,000 a month.

9. Shell bank checks and US records

Confirm that the respondent is not a shell bank and that it does not let shell banks use its accounts. US rules prohibit covered institutions from maintaining a correspondent account for a foreign shell bank, require reasonable steps to ensure the account is not used to serve a shell bank indirectly, and allow an exception only for a regulated affiliate (31 CFR 1010.630(a)(1)(iii)). EU law prohibits correspondent relationships with shell institutions (Directive (EU) 2015/849 Art. 24 via national law; AMLR Art. 39 from 2027-07-10).

For US correspondent accounts, keep records in the United States of the owners of a foreign bank whose shares are not publicly traded and of a US resident agent authorised to accept service of legal process, unless the bank files a Form FR Y-7 with the Federal Reserve that identifies its owners (31 CFR 1010.630(a)(2)). A certification or recertification from the foreign bank, obtained at least every three years, provides a safe harbour; for a new account the certification must be obtained within 30 calendar days of opening or the accounts must be closed within a commercially reasonable time (31 CFR 1010.630(b) and (d)(2)). Keep these records for at least five years after the last correspondent account for that bank is closed (31 CFR 1010.630(e)).

10. Risk rating

Rate inherent risk by factor, apply the control assessment and record the residual rating. Use the institution's financial institution risk methodology; the weights below are an Example.

Residual risk in the example methodology is the inherent score multiplied by a control factor: 0.9 for an average control score up to 1.5, 1.0 up to 2.2 and 1.2 above 2.2. The example has an average control score of 1.43, so residual = 2.20 x 0.9 = 1.98, which falls in the example band Medium (1.80 to 2.39). Because a correspondent relationship with a third-country respondent is an automatic EDD case, enhanced measures apply whatever the residual band.

11. Responsibilities and conditions

Document the AML/CFT responsibilities of each institution, so that both sides know who performs customer due diligence on the underlying customers, who screens what, how requests for information will be answered and how quickly. Record any conditions attached to the approval.

12. Senior management approval and decision

Obtain senior management approval before establishing the relationship. The approver must have the full file and must be able to decide independently of the commercial target. When a relationship is ended for AML/CFT reasons, the AMLR (Art. 36, from 2027-07-10) requires the decision to be documented; record the reasons here even under current law.

13. Ongoing monitoring, review and exit

Monitor the respondent's activity against the expected profile in section 2, the nested caps in section 8 and the responsibilities in section 11. Under 31 CFR 1010.610(a)(3), the due diligence programme must include periodic review of account activity sufficient to judge whether it remains consistent with the type, purpose and anticipated activity of the account. Review the file at a frequency set by risk and earlier when a trigger occurs. If due diligence cannot be performed, follow your procedure: refuse to open, suspend activity, consider a suspicious activity or transaction report, or close the account (31 CFR 1010.610(d) for US accounts).

Early review triggers: change of control or licence, supervisory enforcement, new downstream bank, inclusion of the home country on a high-risk or sanctions list, an AMLA recommendation on the respondent (AMLR Art. 38, from 2027-07-10), a pattern of late or incomplete answers to requests for information, and suspicious activity reports involving the respondent's customers.

14. Glossary and references

References (obtain current versions):

• FATF Recommendation 13, Correspondent banking (cited by number and title only).
• Directive (EU) 2015/849 as amended, Arts 19 and 24, and the [Member State] transposing law.
• Regulation (EU) 2024/1624 (AMLR), Arts 36, 38 and 39, applies from 2027-07-10, EUR-Lex.
• UK Money Laundering Regulations 2017 (SI 2017/692), reg. 34.
• 31 CFR 1010.605 (definitions), 1010.610 (correspondent account due diligence), 1010.630 (foreign shell banks, owner and agent records), eCFR.
• Wolfsberg Group CBDDQ v1.4 (name and version only; no content used).
• Related templates: KYC and CDD Customer Profile (compliance/kyc-cdd-profile), EDD Memo (compliance/edd-memo), Sanctions Compliance Procedure (compliance/sanctions-compliance-procedure), Sanctions Exposure Assessment (compliance/sanctions-exposure-assessment), Transaction Monitoring Scenario Specification (compliance/transaction-monitoring-scenario-spec), AML Business Risk Assessment (compliance/aml-business-risk-assessment), ISO 20022 Payments Design (industry/iso20022-payments-design).

Standard and licence note

Based on public law: US federal regulations in 31 CFR Chapter X (US government works); EU legislation from EUR-Lex (Directive (EU) 2015/849 and Regulation (EU) 2024/1624), reused with acknowledgement under Commission Decision 2011/833/EU and summarised in original wording; and the UK Money Laundering Regulations 2017 cited by regulation number. FATF Recommendation 13 is cited by number and title only. The Wolfsberg Group CBDDQ is named for identification only; its questions, section order and guidance are not reproduced or mirrored. This template is not affiliated with or endorsed by FinCEN, the European Commission, AMLA, the FATF or the Wolfsberg Group. All names, institutions and figures in the examples are fictional. This template is original text written for this collection. Check the current official version of each law and your national transposition before use. Template licence: MIT.