# Correspondent Banking Due Diligence: [Respondent institution]

> Due diligence assessment of a cross-border correspondent banking
> relationship from the correspondent's side: services requested,
> respondent profile, ownership and licensing, jurisdiction, assessment
> of the respondent's AML/CFT and sanctions controls, nested
> relationships and payable-through accounts, shell bank checks, risk
> rating, documented responsibilities, senior management approval and
> ongoing monitoring. Based on FATF Recommendation 13 (Correspondent
> banking, cited by number and title), the current EU framework
> (Directive (EU) 2015/849 Arts 19 and 24 as transposed in national law),
> the EU Anti-Money Laundering Regulation, Regulation (EU) 2024/1624
> (AMLR) Arts 36, 38 and 39, which apply from 2027-07-10, the UK Money
> Laundering Regulations 2017 (reg. 34) and US rules 31 CFR 1010.610
> (due diligence for correspondent accounts) and 31 CFR 1010.630
> (foreign shell bank prohibition and records), as of 2026-10. Replace
> every `[bracketed]` value and every row marked *Example*. This is a
> document format, not legal, compliance or regulatory advice. Obtain
> the standard or law for the normative text and check current local
> law.

<!--
Guidance: How to use this template
- Purpose: the correspondent bank's own written assessment of one
  respondent institution, which supports the decision to open, keep,
  restrict or end the relationship.
- Inputs: the respondent's completed industry due diligence
  questionnaire (many banks use the Wolfsberg Group Correspondent
  Banking Due Diligence Questionnaire, CBDDQ v1.4), public
  information, supervisory and enforcement records, an interview or
  site visit, and your own payment data. This template does not
  reproduce or follow any industry questionnaire; it records your
  analysis and conclusions in your own structure.
- Fill sections 1 to 5 first (scope, services, profile, ownership,
  jurisdiction), then assess controls (sections 6 to 9), then rate,
  approve and set monitoring (sections 10 to 13).
- The worked example is fictional: Fernhollow Bank (a fictional
  mid-sized EU credit institution with a US branch) assessing Mareval
  Commercial Bank plc, a fictional bank licensed in a third country
  shown as [Country A]. All names are invented.
- Common pitfall: collecting a complete questionnaire and filing it
  without testing any answer against your own payment data or public
  sources.
-->

## Document control

<!-- Guidance: Correspondent files are approved by senior management and refreshed on a fixed cycle. Record which booking entities hold accounts for the respondent, because each may bring a different legal regime. -->

| Field | Value |
|---|---|
| Document ID | [CBDD-YYYY-NNN] (*Example:* CBDD-2026-014) |
| Respondent legal name | [Name] (*Example:* Mareval Commercial Bank plc) |
| Respondent country of licence | [Country] (*Example:* [Country A]) |
| Respondent identifiers | [LEI], [BIC], [Licence number] |
| Correspondent booking entities | [Entities] (*Example:* Fernhollow Bank head office (EUR); Fernhollow Bank New York branch (USD)) |
| Relationship status | [Prospect / Active / Restricted / Exiting / Closed] |
| Version | [1.0] |
| Status | [Draft / Pending approval / Approved / Declined] |
| Owner | [@fi-relationship-manager] |
| Approvers/reviewers | [@fi-kyc-analyst], [@mlro], [@senior-management-approver] |
| Risk rating | [Low / Medium / High] (see section 10) |
| Last updated | YYYY-MM-DD |
| Next review due | YYYY-MM-DD |
| Classification | Confidential: financial crime compliance, need-to-know |

### Approvals

| Role | Name | Decision | Date |
|---|---|---|---|
| FI KYC analyst (preparer) | [@name] | [Complete] | YYYY-MM-DD |
| Financial crime compliance reviewer | [@name] | [Supports / Does not support] | YYYY-MM-DD |
| MLRO or BSA officer (US branch) | [@name] | [Supports / Does not support] | YYYY-MM-DD |
| Senior management approver | [@name] | [Approve / Approve with conditions / Decline] | YYYY-MM-DD |

### Revision history

| Version | Date | Author | Change summary |
|---|---|---|---|
| 1.0 | YYYY-MM-DD | [@name] | Onboarding assessment |
| 1.1 | YYYY-MM-DD | [@name] | *Example:* Added US certification received from respondent |
| 2.0 | YYYY-MM-DD | [@name] | *Example:* Annual review after downstream bank added |

## Contents

1. [Scope and legal basis](#1-scope-and-legal-basis)
2. [Relationship and services requested](#2-relationship-and-services-requested)
3. [Respondent profile](#3-respondent-profile)
4. [Ownership, management and licensing](#4-ownership-management-and-licensing)
5. [Jurisdiction assessment](#5-jurisdiction-assessment)
6. [AML/CFT control assessment](#6-amlcft-control-assessment)
7. [Sanctions control assessment](#7-sanctions-control-assessment)
8. [Nested relationships and payable-through accounts](#8-nested-relationships-and-payable-through-accounts)
9. [Shell bank checks and US records](#9-shell-bank-checks-and-us-records)
10. [Risk rating](#10-risk-rating)
11. [Responsibilities and conditions](#11-responsibilities-and-conditions)
12. [Senior management approval and decision](#12-senior-management-approval-and-decision)
13. [Ongoing monitoring, review and exit](#13-ongoing-monitoring-review-and-exit)
14. [Glossary and references](#14-glossary-and-references)
15. [Standard and licence note](#standard-and-licence-note)

## 1. Scope and legal basis

<!-- Guidance: Record which entities of your group hold accounts for the respondent and which rules each must meet. An EU head office applies national law today and the AMLR from 2027-07-10; a US branch applies the US correspondent account rules. Pitfall: assessing only under head office law while the US branch clears USD for the same respondent. -->

A correspondent relationship exists when one institution (the
correspondent) provides banking services to another institution (the
respondent), such as accounts, payment execution, cash management,
foreign exchange or trade services, so that the respondent can serve
its own customers. The correspondent usually has no direct relationship
with those underlying customers, which is why the law requires extra
measures when the respondent is outside the correspondent's own
jurisdiction.

| Jurisdiction | Rule (as of 2026-10, check local law) | Main requirements, in summary | Status |
|---|---|---|---|
| International | FATF Recommendation 13 (Correspondent banking) | Understand the respondent's business, reputation and supervision; assess its controls; senior management approval; clear responsibilities; payable-through checks; no shell banks | Standard |
| EU (current) | Directive (EU) 2015/849 Art. 19 (cross-border correspondent relationships with third-country respondents) and Art. 24 (shell bank prohibition), via [Member State] law | Enhanced measures for third-country respondents | In force until 2027-07-09 via national law |
| EU (from 2027-07-10) | AMLR Art. 36 (enhanced measures for cross-border correspondent relationships with third-country respondents), Art. 38 (measures where AMLA issues a recommendation on an individual respondent), Art. 39 (no relationships with shell institutions) | Information on business, reputation and supervision; assessment of AML/CFT controls; senior management approval; documented responsibilities; payable-through checks; documented reasons when terminating for AML/CFT reasons | Applies from 2027-07-10 (Art. 90) |
| UK | Money Laundering Regulations 2017, reg. 34 (correspondent relationships) | Enhanced measures for correspondent relationships with third-country respondents; shell bank prohibition | In force, check amendments |
| US | 31 CFR 1010.610 (due diligence programme for correspondent accounts for foreign financial institutions) | Risk-based due diligence for all foreign FI correspondent accounts; enhanced due diligence for foreign banks with offshore licences or licences from designated jurisdictions | In force |
| US | 31 CFR 1010.630 (foreign shell banks; records of owners and agents) | No accounts for foreign shell banks; reasonable steps against indirect use; owner and agent records; certification safe harbour renewed at least every three years | In force |

## 2. Relationship and services requested

<!-- Guidance: Describe exactly what the respondent wants and why. Purpose drives risk: a vostro account for the respondent's own treasury is lower risk than clearing for downstream banks and their customers. Pitfall: approving "correspondent services" in general, then adding nested clearing later without reassessment. -->

Describe the services, currencies, expected volumes and the
respondent's reason for choosing this correspondent. Separate services
for the respondent's own account (treasury, interbank funding) from
services that carry its customers' payments, because the second group
brings the respondent's customer risk into your payment flows.

| Service | Currency | For respondent's own account or customers? | Expected monthly count | Expected monthly value | Requested? |
|---|---|---|---|---|---|
| Vostro current account *(Example)* | EUR | Both | 3,500 | EUR 210,000,000 | Yes |
| USD clearing via US branch *(Example)* | USD | Customers | 2,200 | USD 140,000,000 | Yes |
| Trade finance (letters of credit confirmation) *(Example)* | EUR, USD | Customers | 40 | EUR 18,000,000 equivalent | Yes |
| FX spot and forwards *(Example)* | Multiple | Own account | 60 | EUR 35,000,000 | Yes |
| Cash (banknote) services | Any | | | | No |
| Payable-through or sub-accounts for customers | Any | | | | No (prohibited by policy) |
| Downstream (nested) clearing for other banks *(Example)* | USD | Other banks' customers | 300 | USD 12,000,000 | Yes, see section 8 |

Stated purpose: [Summary] *Example:* Mareval Commercial Bank plc
serves importers and exporters in [Country A] trading with the EU and
needs EUR and USD clearing with trade finance support. It is replacing a
correspondent that withdrew from the region in 2025.

Assess the relationship on its own risk rather than ending it by
category. Withdrawing from whole regions or respondent types can push
payments into less transparent channels; the risk-based approach
expects the correspondent to manage the risk of each respondent where
it can, and to record its reasons where it cannot.

## 3. Respondent profile

<!-- Guidance: Understand the respondent's business well enough to predict its payment flows. Questions: who are its customers, which sectors, which countries, which products? What is its size and market position? Pitfall: describing the respondent with its own marketing text instead of your analysis. -->

Gather enough information to understand the nature of the respondent's
business and to determine from public information its reputation and
the quality of its supervision. Use annual reports, regulatory
disclosures, rating agency reports and press, and confirm material
points in a call or visit with the respondent's management and its
compliance function.

| Item | Value |
|---|---|
| Business lines | [Lines] (*Example:* Corporate and SME banking 55%, retail 35%, treasury 10% of revenue) |
| Total assets and market position | [Amount, rank] (*Example:* EUR 9.6 billion equivalent; fourth largest bank in [Country A]) |
| Customer base | [Segments] (*Example:* 1.1 million retail customers; 18,000 corporate customers, mainly agriculture exports and construction materials imports) |
| Higher-risk customer segments | [Segments and share] (*Example:* Money service businesses 0.4% of deposits; PEP relationships 120) |
| Geographic footprint | [Branches, subsidiaries] (*Example:* 140 branches in [Country A]; representative office in the EU) |
| Products of concern | [Products] (*Example:* No bearer instruments; prepaid cards with limits; no virtual asset services) |
| External auditor | [Firm] |
| Credit rating | [Agency and rating, date] |
| Reputation search | [Summary and date] (*Example:* No AML enforcement in the last five years; a 2024 regional press article on a fraud case at a branch, closed with no regulatory action) |

## 4. Ownership, management and licensing

<!-- Guidance: Identify the owners and controllers and confirm the licence and supervisor. For the US branch, owners of 10 percent or more of any class of voting securities of a non-public foreign bank must be identified where enhanced due diligence applies. Pitfall: accepting a group chart without identifying the ultimate natural persons or state owner. -->

Identify who owns and controls the respondent, who runs it and who
licenses and supervises it. For a listed bank, record the listing and
any shareholder above your policy threshold; for a non-listed bank,
identify the natural persons or state bodies that own or control it.
Where US enhanced due diligence applies, identify each owner of 10
percent or more of any class of securities of a foreign bank whose
shares are not publicly traded (31 CFR 1010.610(b)(3)), treating
members of the same family as one person.

| ID | Owner | Type | Holding % | Ultimate owner or controller | Screening result |
|---|---|---|---|---|---|
| OWN-001 *(Example)* | Mareval Holdings S.A. | Holding company | 62.0 | Listed on the [Country A] stock exchange; free float 71% | Clear |
| OWN-002 *(Example)* | [Country A] Sovereign Development Fund | State fund | 18.0 | Government of [Country A] | Clear; state ownership noted for PEP analysis |
| OWN-003 *(Example)* | International development finance institution | Multilateral lender | 9.0 | Member states | Clear |
| OWN-004 *(Example)* | Free float | Public | 11.0 | Dispersed | Not applicable |

Holdings sum to 62.0 + 18.0 + 9.0 + 11.0 = 100.0 percent.

| Item | Value |
|---|---|
| Banking licence | [Type, number, issuer, date] (*Example:* Full commercial banking licence, central bank of [Country A]) |
| Offshore licence (restricted to non-residents)? | [Yes / No] (*Example:* No) |
| Prudential and AML supervisor | [Authority] |
| Board and senior management | [Chair, CEO, CFO, head of compliance, MLRO; screening results] |
| PEPs in ownership or management | [Names and functions or "none"] (*Example:* Two board members appointed by the sovereign fund, both senior civil servants) |
| Physical presence confirmed | [Head office address, staff count, evidence] |

## 5. Jurisdiction assessment

<!-- Guidance: Assess the AML/CFT regime and supervision of the respondent's home country and of the countries where its owners are incorporated. Use FATF mutual evaluations and public statements, your national risk assessment, the EU high-risk third-country list and sanctions regimes. Pitfall: relying on a country score from last year without checking the latest FATF plenary outcome. -->

Assess the home jurisdiction's AML/CFT regime and supervisory quality
and any jurisdiction that shapes the respondent's risk. For a US
covered institution, record whether the respondent operates under an
offshore banking licence, under a licence from a country designated as
non-cooperative by an intergovernmental group in which the United
States participates and concurs, or under a licence from a country
designated by the Treasury as warranting special measures: any of
these requires the enhanced due diligence in 31 CFR 1010.610(b). For
an EU correspondent, record whether the country is on the Commission's
list of high-risk third countries, which brings additional enhanced
measures.

| Jurisdiction | Role | FATF status (date checked) | EU high-risk list (date checked) | Sanctions regimes | US 1010.610(c) category | Assessment |
|---|---|---|---|---|---|---|
| [Country A] *(Example)* | Licence and head office | Not on public statements; last mutual evaluation rated [summary] (YYYY-MM-DD) | Not listed (YYYY-MM-DD) | None country-wide | None | Medium: regional trade with sanctioned neighbour noted |
| [Country B] *(Example)* | Neighbour with large trade flows | [Status] | [Status] | EU and US sectoral sanctions | Not applicable | Raises sanctions evasion exposure for trade finance |

## 6. AML/CFT control assessment

<!-- Guidance: Assess the respondent's controls, not just whether policies exist. Use the questionnaire answers as claims and test them: ask for evidence, compare with your payment data, read supervisory findings. Pitfall: rating controls "adequate" because every questionnaire answer is "yes". -->

Assess whether the respondent's AML/CFT controls are adequate and
effective for its risks. The law requires the correspondent to assess
the respondent's controls, not to audit them; use proportionate
evidence. Score each area, explain the score in a sentence and note
the evidence. The areas below are this template's own structure; they
are not the order or wording of any industry questionnaire.

| ID | Area | Evidence reviewed | Score *(Example scale 1 strong to 3 weak)* | Comment |
|---|---|---|---|---|
| CTL-001 *(Example)* | Governance: board oversight, MLRO independence, resources | Board minutes extract, organisation chart, interview with MLRO | 1 | MLRO reports to the board risk committee; 42 compliance staff |
| CTL-002 *(Example)* | Business-wide risk assessment | Summary of latest assessment, approval date | 2 | Assessment covers trade-based risk but not proliferation financing in detail |
| CTL-003 *(Example)* | Customer due diligence and EDD, including PEPs | Policy, sample test results from internal audit | 1 | Clear EDD triggers; PEP approvals at executive level |
| CTL-004 *(Example)* | Transaction monitoring and suspicious transaction reporting | System description, alert volumes, STR statistics | 2 | Rules-based system; tuning last performed 2024 |
| CTL-005 *(Example)* | Independent testing and audit findings | Internal audit summary, external auditor letter | 1 | No open high findings |
| CTL-006 *(Example)* | Regulatory findings and enforcement | Supervisor's public statements, respondent disclosure | 2 | 2023 supervisory inspection found weaknesses in record keeping, closed in 2025 |
| CTL-007 *(Example)* | Training and staff screening | Training plan, completion rates | 1 | 97% completion in 2025 |

Average control score in the example: (1 + 2 + 1 + 2 + 1 + 2 + 1) / 7
= 10 / 7 = 1.43, which the example methodology maps to "adequate with
improvement points".

Test the claims against your own data. *Example:* Fernhollow Bank
reviewed three months of the respondent's payments through its
previous correspondent (provided by the respondent) and found that
96% of value matched the stated trade corridors and sectors. The
remaining 4% were transfers to money service businesses. That share
is higher than the 0.4% deposit share stated in section 3, because
these customers move funds quickly and hold low balances; the
respondent explained the flows and provided its due diligence on the
two largest money service business customers, and the gap is recorded
as a monitoring point (MON-001).

## 7. Sanctions control assessment

<!-- Guidance: Sanctions risk flows through the correspondent's own payments, so the respondent's screening quality matters directly. Assess lists screened, screening points, ownership rules, trade controls and any history of violations. Pitfall: ignoring the respondent's exposure to sanctioned neighbouring countries through trade finance. -->

Assess the respondent's sanctions programme against the regimes that
bind your institution (EU, UN, national and, for USD clearing, US OFAC)
and the respondent's own regimes. Payments routed through your
accounts must not breach the sanctions that apply to you, regardless
of the respondent's home law. Link to your own procedure
(`compliance/sanctions-compliance-procedure`) for the controls you
apply to the respondent's payments.

| Area | Finding | Assessment |
|---|---|---|
| Lists screened | [Lists] (*Example:* UN, EU, OFAC, UK, local list) | [Adequate / Gap] |
| Screening points | [Points] (*Example:* Onboarding, daily customer rescreening, real-time payment screening, trade documents) | |
| Ownership and control rules | [Approach] (*Example:* Applies 50 percent aggregation for OFAC and EU control tests) | |
| Trade finance controls | [Approach] (*Example:* Vessel and port checks, dual-use goods review) | |
| Payment message transparency | [Approach] (*Example:* Full originator and beneficiary data in ISO 20022 messages; no cover payment stripping) | |
| Violations or voluntary disclosures in last five years | [Details or none] | |
| Exposure to sanctioned jurisdictions | [Summary] (*Example:* Customers export to [Country B]; respondent has a written policy prohibiting USD flows involving [Country B] sanctioned sectors) | |

## 8. Nested relationships and payable-through accounts

<!-- Guidance: Nested (downstream) relationships let other banks use your correspondent account through the respondent. They hide a further layer of customers. Identify every downstream institution and decide whether to allow them. Pitfall: discovering downstream banks only when their names appear in payment messages. -->

Determine whether the respondent will let other financial institutions
use its account with you (nested or downstream correspondent
relationships), and whether any account would function as a
payable-through account, meaning the respondent's own customers would
have direct access to your account. For US accounts subject to
enhanced due diligence, the correspondent must find out whether the
foreign bank provides correspondent services to other foreign banks
that use the account and take reasonable steps to assess those banks,
and must obtain information about persons with authority to direct
transactions through any payable-through account. Under the AMLR
(Art. 36(e)) and current EU law, for payable-through accounts the
correspondent must be satisfied that the respondent has performed CDD
on customers with direct access and can provide CDD data on request.

| ID | Downstream institution | Country | Services used | Expected monthly value | Respondent's due diligence on it | Decision |
|---|---|---|---|---|---|---|
| NST-001 *(Example)* | Corlan Savings Bank (fictional) | [Country A] | USD clearing | USD 7,000,000 | File reviewed, rated medium | Allowed with monitoring |
| NST-002 *(Example)* | Brisk Microfinance Ltd (fictional) | [Country A] | USD clearing | USD 3,000,000 | File reviewed, rated medium | Allowed with monitoring |
| NST-003 *(Example)* | Tessaly Exchange Bank (fictional) | [Country C] | USD clearing | USD 2,000,000 | Licence restricted to non-residents | Not allowed |

Downstream values sum to USD 12,000,000 a month, as in section 2;
after the decision on NST-003, the permitted nested value is
USD 10,000,000 a month.

| Question | Answer |
|---|---|
| Payable-through or sub-accounts requested? | [Yes / No] (*Example:* No; prohibited by Fernhollow Bank policy) |
| Downstream list provided and updated how often? | [Frequency] (*Example:* Quarterly, plus notice before any addition) |
| Nested activity identifiable in payment messages? | [Yes / No, how] |

## 9. Shell bank checks and US records

<!-- Guidance: A shell bank is a bank with no physical presence in any country (the US definition) or an institution without meaningful mind and management in its country of incorporation and not part of a regulated group (the EU concept). Verify physical presence independently and, for US accounts, keep the certification and owner and agent records. Pitfall: a certification on file that is more than three years old. -->

Confirm that the respondent is not a shell bank and that it does not
let shell banks use its accounts. US rules prohibit covered
institutions from maintaining a correspondent account for a foreign
shell bank, require reasonable steps to ensure the account is not used
to serve a shell bank indirectly, and allow an exception only for a
regulated affiliate (31 CFR 1010.630(a)(1)(iii)). EU law prohibits
correspondent relationships with shell institutions (Directive (EU)
2015/849 Art. 24 via national law; AMLR Art. 39 from 2027-07-10).

For US correspondent accounts, keep records in the United States of
the owners of a foreign bank whose shares are not publicly traded and
of a US resident agent authorised to accept service of legal process,
unless the bank files a Form FR Y-7 with the Federal Reserve that
identifies its owners (31 CFR 1010.630(a)(2)). A certification or recertification from the
foreign bank, obtained at least every three years, provides a safe
harbour; for a new account the certification must be obtained within
30 calendar days of opening or the accounts must be closed within a
commercially reasonable time (31 CFR 1010.630(b) and (d)(2)). Keep
these records for at least five years after the last correspondent
account for that bank is closed (31 CFR 1010.630(e)).

| Check | Evidence | Date | Result |
|---|---|---|---|
| Physical presence (head office, staff, records, supervisor inspection) | [Evidence] (*Example:* Supervisor's register; site visit report SV-2026-03) | YYYY-MM-DD | [Confirmed] |
| Respondent policy prohibits services to shell banks | [Policy reference] | YYYY-MM-DD | |
| US certification received (new account: within 30 days) | [Document reference] | YYYY-MM-DD | |
| Certification renewal due (three years) | | YYYY-MM-DD | |
| US agent for service of process | [Name, US street address] | YYYY-MM-DD | |
| Owner records or FR Y-7 filer | [Records / FR Y-7] | YYYY-MM-DD | |

## 10. Risk rating

<!-- Guidance: Combine inherent risk (jurisdiction, business, ownership, services, nested activity) with the control assessment to reach a residual rating. Pitfall: a rating that ignores nested activity, the factor that most often surprises correspondents. -->

Rate inherent risk by factor, apply the control assessment and record
the residual rating. Use the institution's financial institution risk
methodology; the weights below are an *Example*.

| Factor | Weight *(Example)* | Inherent score 1 to 3 *(Example)* | Weighted | Reason |
|---|---|---|---|---|
| Jurisdiction | 0.30 | 2 | 0.60 | Section 5 |
| Business and customer base | 0.20 | 2 | 0.40 | Trade-focused, small MSB segment |
| Ownership and PEP links | 0.10 | 2 | 0.20 | State fund holding, PEP board members |
| Services and products | 0.20 | 2 | 0.40 | USD clearing and trade finance |
| Nested activity | 0.20 | 3 | 0.60 | Two downstream banks |
| **Inherent total** | **1.00** | | **2.20** | |

Residual risk in the example methodology is the inherent score
multiplied by a control factor: 0.9 for an average control score up to
1.5, 1.0 up to 2.2 and 1.2 above 2.2. The example has an average
control score of 1.43, so residual = 2.20 x 0.9 = 1.98, which falls in
the example band Medium (1.80 to 2.39). Because a correspondent
relationship with a third-country respondent is an automatic EDD case,
enhanced measures apply whatever the residual band.

## 11. Responsibilities and conditions

<!-- Guidance: The law requires the respective AML/CFT responsibilities of each institution to be documented. Put them in the account agreement or a side letter and summarise them here. Pitfall: responsibilities agreed in an email that nobody can find at review time. -->

Document the AML/CFT responsibilities of each institution, so that
both sides know who performs customer due diligence on the underlying
customers, who screens what, how requests for information will be
answered and how quickly. Record any conditions attached to the
approval.

| ID | Responsibility or condition | Party | Reference | Timing |
|---|---|---|---|---|
| RSP-001 *(Example)* | CDD and EDD on its own customers whose payments pass through the account | Respondent | Account agreement clause [n] | Ongoing |
| RSP-002 *(Example)* | Real-time sanctions screening of all payments through the account | Both | Agreement clause [n] | Ongoing |
| RSP-003 *(Example)* | Reply to requests for information on transactions | Respondent | Agreement clause [n] | Within 5 business days, 2 for urgent requests |
| RSP-004 *(Example)* | Notify additions to downstream banks before activity starts | Respondent | Side letter [ref] | 30 days before |
| CND-001 *(Example)* | No payable-through or sub-accounts | Respondent | Agreement clause [n] | Ongoing |
| CND-002 *(Example)* | Downstream activity capped at USD 10,000,000 a month, NST-003 excluded | Correspondent monitoring | This file, section 8 | Ongoing |
| CND-003 *(Example)* | Respondent to share proliferation financing risk assessment update | Respondent | Approval letter | By 2027-03-31 |

## 12. Senior management approval and decision

<!-- Guidance: New correspondent relationships with third-country respondents need senior management approval before they are established. Record the approver, information provided and decision. If the relationship is ended for AML/CFT reasons, record why. Pitfall: approval by a business head whose bonus depends on the relationship. -->

Obtain senior management approval before establishing the
relationship. The approver must have the full file and must be able to
decide independently of the commercial target. When a relationship is
ended for AML/CFT reasons, the AMLR (Art. 36, from 2027-07-10) requires
the decision to be documented; record the reasons here even under
current law.

| Item | Value |
|---|---|
| Decision | [Approve / Approve with conditions / Decline / Restrict / Exit] (*Example:* Approve with conditions RSP-001 to CND-003) |
| Rationale | [Summary] (*Example:* Established, supervised bank with adequate controls; inherent risk driven by nested activity and regional sanctions exposure, mitigated by caps, exclusion of NST-003 and transaction monitoring) |
| Approver and role | [@name, role] |
| Date | YYYY-MM-DD |
| Exit reason (if exiting) | [Reason documented] |

## 13. Ongoing monitoring, review and exit

<!-- Guidance: Monitor the relationship as a whole, not only payments: request-for-information response times, downstream changes, alerts, adverse news and supervisory actions. Set a review cycle by risk and list early review triggers. Pitfall: periodic reviews that only refresh the questionnaire. -->

Monitor the respondent's activity against the expected profile in
section 2, the nested caps in section 8 and the responsibilities in
section 11. Under 31 CFR 1010.610(a)(3), the due diligence programme
must include periodic review of account activity sufficient to judge
whether it remains consistent with the type, purpose and anticipated
activity of the account. Review the file at a frequency set by risk
and earlier when a trigger occurs. If due diligence cannot be
performed, follow your procedure: refuse to open, suspend activity,
consider a suspicious activity or transaction report, or close the
account (31 CFR 1010.610(d) for US accounts).

| ID | Monitoring control | Metric or threshold *(Example)* | Frequency | Owner |
|---|---|---|---|---|
| MON-001 *(Example)* | Volume and value versus profile | Variance above 30% by corridor escalated | Monthly | [@fi-monitoring] |
| MON-002 *(Example)* | Nested activity cap | USD 10,000,000 a month; any unknown downstream BIC escalated | Monthly | [@fi-monitoring] |
| MON-003 *(Example)* | Request-for-information performance | 95% answered within 5 business days | Quarterly | [@fi-rm] |
| MON-004 *(Example)* | Adverse media and supervisory actions | Daily screening of respondent and owners | Continuous | [@screening] |
| MON-005 *(Example)* | US certification renewal | Renew before three-year date | Calendar | [@fi-kyc] |
| MON-006 *(Example)* | Full file review | Medium residual with EDD: every 12 months | Annual | [@fi-kyc] |

Early review triggers: change of control or licence, supervisory
enforcement, new downstream bank, inclusion of the home country on a
high-risk or sanctions list, an AMLA recommendation on the respondent
(AMLR Art. 38, from 2027-07-10), a pattern of late or incomplete
answers to requests for information, and suspicious activity reports
involving the respondent's customers.

| ID | Date | Type | Findings | Outcome |
|---|---|---|---|---|
| REV-001 *(Example)* | 2027-06-30 | Trigger: request-for-information delays | 4 of 25 requests answered after 5 business days | Warning letter; MON-003 remediation plan agreed |
| REV-002 *(Example)* | 2027-10-31 | Annual | Activity within profile; NST-001 merged into respondent | Medium confirmed; file updated |

## 14. Glossary and references

<!-- Guidance: Define terms in your own words and keep the references to the rules relied on. -->

| Term | Meaning in this file |
|---|---|
| Correspondent | Institution providing banking services to another institution |
| Respondent | Institution receiving those services to serve its own customers |
| Nested (downstream) relationship | Use of the respondent's account by other financial institutions |
| Payable-through account | Account through which the respondent's customers can transact directly |
| Shell bank | Bank without physical presence in any country (US definition); in EU law, an institution without meaningful mind and management where it is incorporated and not part of a regulated group |
| Regulated affiliate | Under US rules, a shell bank affiliated with a bank that has a physical presence, and supervised by the banking authority that regulates that affiliated bank |
| Offshore banking licence | Under US rules, a licence that bars the bank from banking with citizens of, or in the local currency of, the licensing country |
| CBDDQ | Wolfsberg Group Correspondent Banking Due Diligence Questionnaire (v1.4 current as of 2026-10), named only |

References (obtain current versions):

- FATF Recommendation 13, Correspondent banking (cited by number and title only).
- Directive (EU) 2015/849 as amended, Arts 19 and 24, and the [Member State] transposing law.
- Regulation (EU) 2024/1624 (AMLR), Arts 36, 38 and 39, applies from 2027-07-10, EUR-Lex.
- UK Money Laundering Regulations 2017 (SI 2017/692), reg. 34.
- 31 CFR 1010.605 (definitions), 1010.610 (correspondent account due diligence), 1010.630 (foreign shell banks, owner and agent records), eCFR.
- Wolfsberg Group CBDDQ v1.4 (name and version only; no content used).
- Related templates: KYC and CDD Customer Profile (`compliance/kyc-cdd-profile`), EDD Memo (`compliance/edd-memo`), Sanctions Compliance Procedure (`compliance/sanctions-compliance-procedure`), Sanctions Exposure Assessment (`compliance/sanctions-exposure-assessment`), Transaction Monitoring Scenario Specification (`compliance/transaction-monitoring-scenario-spec`), AML Business Risk Assessment (`compliance/aml-business-risk-assessment`), ISO 20022 Payments Design (`industry/iso20022-payments-design`).

## Standard and licence note

Based on public law: US federal regulations in 31 CFR Chapter X (US
government works); EU legislation from EUR-Lex (Directive (EU) 2015/849
and Regulation (EU) 2024/1624), reused with acknowledgement under
Commission Decision 2011/833/EU and summarised in original wording; and
the UK Money Laundering Regulations 2017 cited by regulation number.
FATF Recommendation 13 is cited by number and title only. The Wolfsberg
Group CBDDQ is named for identification only; its questions, section
order and guidance are not reproduced or mirrored. This template is not
affiliated with or endorsed by FinCEN, the European Commission, AMLA,
the FATF or the Wolfsberg Group. All names, institutions and figures in
the examples are fictional. This template is original text written for
this collection. Check the current official version of each law and
your national transposition before use. Template licence: MIT.